diff --git a/.ai/lessons.md b/.ai/lessons.md
index 980e572c45..9408a4d308 100644
--- a/.ai/lessons.md
+++ b/.ai/lessons.md
@@ -7,15 +7,22 @@
 - Test serialized worker tasks with the real process driver. An in-process test does not prove that captured models or nested closures survive serialization.
 - Use the same regression test before and after the production change so the result shows the behavior difference.
 - Several dev instances can run from one checkout (see `./scripts/dev urls`). After you add a migration, run it on each running instance of that checkout, or those instances fail on the new code.
-- The checkout is shared with other sessions. When the full suite fails, rerun each failing file alone and compare with a clean `git archive HEAD` copy before you connect a failure to your change.
+- The checkout is shared with other sessions. When the full suite fails, rerun each failing file alone and compare with a clean `git archive HEAD` copy before you connect a failure to your change. The dev instance of the checkout runs its live files, so a live repro also runs the uncommitted edits of other sessions: run `git diff` on the code under test before you trust the result.
 - Run seeders and other artisan commands that write SSH keys in a dev container as `www-data` (`docker exec -u www-data`). Root-owned files in `storage/app/ssh` make every SSH call from the web process fail.
+- Files written on a server with `tee` get the server umask (027/077 on hardened hosts). Set the mode explicitly (`chmod 644`) for files that a non-root container user reads through a read-only bind mount.
 - `sshd` keeps the login shell of an open multiplexed SSH connection. Call `SshMultiplexingHelper::removeMuxFile()` before a live test of SSH or login-shell behavior.
+- Remote command batches run in `bash -se` (`sh -se` only when the host has no bash). A command that can fail without being an error (such as `cat` of an optional file) stops the batch unless it ends with `|| true`. `Process::fake()` cannot show this, so run such a command once in a real `bash -se` on the target host.
 - SSH retries replay the full command batch. Only exit code 255 is an SSH transport failure; other exit codes come from the remote command, so do not retry them. Keep batches safe to run twice (for example `docker rm -f <name> || true` before `docker run --name <name>`).
+- Do not put `pkill -f "playwright run-server"` in the same shell command as other work; the pattern matches that shell and kills it. Run it as its own command.
 - Redirect browser test output to a file (`> /tmp/x.log 2>&1`); piping it (`| tail`) hangs because the Playwright server keeps the pipe open.
 - Browser `click()`/`assertSee()` wait forever when nothing matches, so a bad selector hangs the run instead of failing it. `click('Text')` can match a hidden element first (use `button:visible:has-text("Text")`); `:text-is()` on an element with child elements and `assertSee()` text with double quotes never match. Prefer plain CSS selectors.
 - A new worktree has no `vendor/` or `public/build/`. Run `composer install --ignore-platform-req=ext-zip` on the host and copy `public/build` from the main checkout before page-rendering tests; otherwise they fail with a Vite manifest error.
 - Never run `php artisan test` inside a dev container (`./scripts/dev exec` or `docker exec coolify-dev-*`). The container sets `DB_CONNECTION=pgsql` as a real environment variable, which wins over `phpunit.xml`, so `RefreshDatabase` runs `migrate:fresh` on the dev database and wipes it. Run tests on the host only.
+- The helper image runs `docker compose` for deployments and for the Coolify upgrade itself. Before you bump its Docker CLI or Compose, test them against the oldest supported Docker Engine (for example a `docker:<version>-dind` container); newer clients can reject data from older daemons.
 - Do not symlink `vendor` into another worktree. Composer resolves the base path from the real `vendor` path, so the tests load the app classes of the other checkout. Run `composer install --ignore-platform-req=ext-zip` in the worktree.
+- To assert that the unsaved-changes bar shows, check `el.classList.contains('is-dirty')`. Playwright treats the hidden bar (`opacity-0`) as visible, and its class attribute always contains the text `is-dirty` from Tailwind variants.
+- Do not call `sleep()` in a browser test. The app server runs in the test process, so `sleep()` stops it; use `$page->wait()`.
+- In tests, turning on `is_metrics_enabled` (and other Sentinel settings) with `save()`/`update()` runs the settings hook, which starts Sentinel over a real SSH connection on the sync queue. Use `saveQuietly()` or `Queue::fake()`.
 - Call `visit()` directly in each `tests/v4/Browser` test body; Pest does not mark a test that only uses helper-wrapped `visit()` as a browser test, so it fails with `sendText() on null`.
 - SQLite returns `0`/`1` for boolean columns without a `boolean` cast, while Postgres returns real booleans. A strict `=== false` check on such a column never matches in tests, so tests can pass on behavior that Postgres blocks. Add the cast or compare loosely.
 
@@ -116,3 +123,9 @@
 - `StandaloneDocker`/`SwarmDocker` `server` uses `Server::findCached()`, a per-process identity map that is flushed only when the `servers` row updates. A `ServerSetting` save does not flush it, so pass the current `Server` instance (`setRelation('server', $server)`) when generated output depends on just-saved settings.
 - Application deployments use the stored `custom_labels` when they exist. When a server-level setting changes the generated labels, regenerate the stored labels of read-only (`is_container_label_readonly_enabled`) applications, or a redeploy keeps the old labels.
 - Tailwind `text-base` is a colour utility here (`--color-base`, near-black), not a font size. Use `text-[16px]` for size.
+
+## Keep browser form restore away from app state
+- Firefox session restore writes saved input values back and fires a trusted `input` event. Add `autocomplete="off"` to inputs that only mirror client state (for example an Alpine-bound color picker), or their handlers run without a user action.
+
+## Session writes are last-writer-wins
+- Laravel saves the whole session payload at the end of every request, and pages run concurrent `wire:poll` requests. A value that one request changes can be overwritten by a request that started earlier. `KeepConcurrentTeamSwitch` protects `currentTeam`; protect any new session value that changes mid-session the same way, or keep it out of the session.
diff --git a/.gitignore b/.gitignore
index 3b583795bf..7f342543fe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -54,3 +54,6 @@ ref
 
 # Multi-instance local Coolify env files (scripts/dev-instances)
 .dev-instances/
+
+# Service parser template snapshots: generated locally by scripts/parser-snapshot-diff, not committed
+/tests/Fixtures/parser/expected/templates/
diff --git a/AGENTS.md b/AGENTS.md
index a57f2c2c4c..3016656c89 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -66,6 +66,22 @@ npm run dev                     # vite dev server
 npm run build                   # production build
 ```
 
+## Testing the Service Parser
+
+`tests/Feature/ServiceParserReferenceTest.php` is a golden test for both compose parsers (`serviceParser` with `updateCompose`, and `applicationParser`) and the proxy label and magic-variable helpers. It parses `tests/Fixtures/parser/service-reference.yaml` and `application-reference.yaml` (one service per parser feature, with setting variations and error fixtures) and every template in `templates/compose`, then compares the output with `tests/Fixtures/parser/expected/`. Only the reference expected files are committed. Template expected files are gitignored, so CI checks only that each template parses.
+
+```bash
+./scripts/parser-snapshot-diff save       # before a parser change: save the output of all cases (~90 s)
+./scripts/parser-snapshot-diff baseline   # after the change: one line per changed case, full diff in storage/framework/testing/parser-snapshot-diff.diff
+php artisan test --compact tests/Feature/ServiceParserReferenceTest.php    # before you commit
+UPDATE_PARSER_SNAPSHOTS=1 php artisan test --compact tests/Feature/ServiceParserReferenceTest.php   # accept an intended change, then review git diff tests/Fixtures/parser/
+```
+
+- A refactor must give "No differences". For an intended change, check every changed line in the diff file.
+- When you add a parser feature, add a small service that uses it to `service-reference.yaml` or `application-reference.yaml` and regenerate the expected files.
+- `./scripts/parser-snapshot-diff <git-ref>` compares with a commit instead of a saved baseline.
+- It covers only the latest compose parsing version. Older parsing versions are not covered.
+
 ## Browser Tests (Pest Browser Plugin)
 
 Uses `pestphp/pest-plugin-browser` (Playwright). Browser tests go in `tests/v4/Browser/`.
@@ -175,6 +191,22 @@ Because the "server" and the test share one PHP process, they share the phpunit
 - **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
 - **Proxy** — Traefik reverse proxy managed per server.
 
+### Server transfer (keep it complete)
+
+A server transfer moves a server and every record that belongs to it to another Coolify instance: `ServerTransferExporter` writes the bundle, `ServerTransferImporter` reads it (`app/Services/ServerTransfer/`). `ServerTransferCoverage` records the transfer decision for every model and every column.
+
+- When you add a model, a column, or a relation that belongs to a server or to a resource on a server (application, preview, database, service, volume, environment variable, backup, scheduled task, tag, or setting), decide whether a transfer moves it:
+  - **Moved:** export and import it, and add a round-trip assertion to `tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php`. For a new model, also add it to `ServerTransferCoverage::TRANSFERRED`.
+  - **Not moved:** add the model to `ServerTransferCoverage::NOT_TRANSFERRED`, or the column to `NOT_EXPORTED_COLUMNS`, with the reason. If the data is lost for the user, also add an export warning.
+- `tests/Unit/ServerTransfer/ServerTransferCoverageTest.php` exports a server with one record of every transferred model. It fails when a model or a column has no decision. When you add a transferred model, add a record of it to the fixture of that test.
+- `docs/server-transfer-full-coverage.md` lists what to set up on a source server for a manual transfer test that covers every transferred model and setting. Add new transferred models and settings to it.
+- `scripts/transfer-test/` has live end-to-end transfer tests between two dev instances (see its README). Run them after a change to the transfer flow. When you add transferred data that the unit tests cannot prove (remote commands, provider calls, queue behavior), add a check to `extras-e2e.sh`.
+- Application, Service, and the standalone databases export their `$fillable` columns, plus hand-written lists for hidden columns. A column that is not fillable is lost unless you add it to those lists.
+- Do not copy a foreign key as a raw ID. IDs are different on the target. Link the record by UUID, or leave the column out with a reason.
+- Team credentials that a moved record needs (integration tokens, S3 storages, git sources, private keys, cloud provider tokens) move with it.
+- When the user must do a step after the transfer (for example, change a webhook URL at GitHub), add an item type to `TransferFinishChecklist`: the "Finish the transfer" list on the server page of the instance that manages the server now. Give it a check where Coolify can verify the step, and a fix where it can do the step. Also add it to the `post_transfer_checklist` of the bundle (`{target_url}` stands for the URL of the target), which the source shows as text.
+- On the source, a transferred server (`Server::isTransferredAway()`) is only an archive, because another instance manages the host. Do not run remote commands, cloud provider calls, or DNS provider calls for it, also not when the archive is deleted.
+
 ### Instance sentinels (`id = 0`)
 
 Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentinel meaning “this is the Coolify instance itself”, not a normal autoincrement id. Do not migrate, resequence, or “fix” these to a positive id.
diff --git a/DESIGN.md b/DESIGN.md
index a482fa3e50..02757f53f7 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -229,8 +229,13 @@ sub-header.
 The dashboard is a compact overview, not a metrics wall. It has no page header:
 live active deployments come first as a compact table, followed by traffic
 analytics when a server has it enabled, then two full-width sections (Projects,
-then Servers) that follow the projects-page grid pattern. Each section uses
-`x-section-heading` linking to its full index. Communicate server health with
+then Servers). Each section uses `x-section-heading` with a small "View all"
+link to its full index (next to the switcher) and a table / grid `x-canvas-view-toggle` (no canvas
+link). Table is the default; each section remembers its own choice. A page-level
+List / Canvas switch at the top opens `/dashboard/canvas`: the servers canvas
+with a "Deploying" / "Queued" pill on each application card that has an active
+deployment, and a foldable Recent deployments panel at the bottom left (active, then
+recent; a row shows its card, the status opens the deployment). Communicate server health with
 the shared status badge.
 
 ### Top-level dashboard destinations
diff --git a/app/Actions/Database/StartClickhouse.php b/app/Actions/Database/StartClickhouse.php
index bcf5e051f7..86545e010f 100644
--- a/app/Actions/Database/StartClickhouse.php
+++ b/app/Actions/Database/StartClickhouse.php
@@ -192,7 +192,7 @@ class StartClickhouse
             $environment_variables->push("CLICKHOUSE_DB={$this->database->clickhouse_db}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
diff --git a/app/Actions/Database/StartDragonfly.php b/app/Actions/Database/StartDragonfly.php
index 0bef866db7..2602de63d1 100644
--- a/app/Actions/Database/StartDragonfly.php
+++ b/app/Actions/Database/StartDragonfly.php
@@ -269,6 +269,8 @@ class StartDragonfly
             $environment_variables->push("REDIS_PASSWORD={$this->database->dragonfly_password}");
         }
 
+        $this->addCoolifyEnvironmentVariables($environment_variables);
+
         return $environment_variables->all();
     }
 
diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index f7066fc1f8..dddb86e2c2 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -269,7 +269,7 @@ class StartKeydb
             $environment_variables->push("REDIS_PASSWORD={$this->database->keydb_password}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index 6f67500801..234583a538 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -268,7 +268,7 @@ class StartMariadb
             $environment_variables->push("MARIADB_PASSWORD={$this->database->mariadb_password}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
@@ -282,5 +282,7 @@ class StartMariadb
         $content = $this->database->mariadb_conf;
         $content_base64 = base64_encode($content);
         $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/{$filename} > /dev/null";
+        // The container user must read the read-only mount; a strict server umask leaves the file unreadable.
+        $this->commands[] = "chmod 644 $this->configuration_dir/{$filename}";
     }
 }
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 5d748cd4f4..0064b43e38 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -325,7 +325,7 @@ class StartMongodb
             $environment_variables->push("MONGO_INITDB_DATABASE={$this->database->mongo_initdb_database}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
@@ -372,6 +372,8 @@ class StartMongodb
         $content = $this->database->mongo_conf;
         $content_base64 = base64_encode($content);
         $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/{$filename} > /dev/null";
+        // The container user must read the read-only mount; a strict server umask leaves the file unreadable.
+        $this->commands[] = "chmod 644 $this->configuration_dir/{$filename}";
     }
 
     private function add_default_database()
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 01e8ff5edf..e8c24d5179 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -280,7 +280,7 @@ class StartMysql
             $environment_variables->push("MYSQL_PASSWORD={$this->database->mysql_password}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
@@ -294,5 +294,7 @@ class StartMysql
         $content = $this->database->mysql_conf;
         $content_base64 = base64_encode($content);
         $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/{$filename} > /dev/null";
+        // The container user must read the read-only mount; a strict server umask leaves the file unreadable.
+        $this->commands[] = "chmod 644 $this->configuration_dir/{$filename}";
     }
 }
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index ca22dcfebb..88bb59a88b 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -291,7 +291,7 @@ class StartPostgresql
             $environment_variables->push("POSTGRES_DB={$this->database->postgres_db}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
@@ -342,5 +342,7 @@ class StartPostgresql
         }
         $content_base64 = base64_encode($content);
         $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $config_file_path > /dev/null";
+        // The container user must read the read-only mount; a strict server umask leaves the file unreadable.
+        $this->commands[] = "chmod 644 $config_file_path";
     }
 }
diff --git a/app/Actions/Database/StartRedis.php b/app/Actions/Database/StartRedis.php
index 6eecbec902..b0ac2e7001 100644
--- a/app/Actions/Database/StartRedis.php
+++ b/app/Actions/Database/StartRedis.php
@@ -284,7 +284,7 @@ class StartRedis
             }
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
diff --git a/app/Actions/Database/StartSqlite.php b/app/Actions/Database/StartSqlite.php
index 6cc806dc5e..b63598f998 100644
--- a/app/Actions/Database/StartSqlite.php
+++ b/app/Actions/Database/StartSqlite.php
@@ -153,7 +153,7 @@ class StartSqlite
             $environment_variables->push("SQLITE_DATABASES={$this->database->sqlite_databases}");
         }
 
-        add_coolify_default_environment_variables($this->database, $environment_variables, $environment_variables);
+        $this->addCoolifyEnvironmentVariables($environment_variables);
 
         return $environment_variables->all();
     }
diff --git a/app/Actions/Server/CleanupDocker.php b/app/Actions/Server/CleanupDocker.php
index c49c057060..ff4df515f4 100644
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@@ -131,10 +131,7 @@ class CleanupDocker implements ShouldBeUnique
             }
         }
         $helperImageVersion = getHelperVersion();
-        $helperImage = coolifyHelperImage();
-        $helperImageWithVersion = "$helperImage:$helperImageVersion";
-        $helperImageWithoutPrefix = 'coollabsio/coolify-helper';
-        $helperImageWithoutPrefixVersion = "coollabsio/coolify-helper:$helperImageVersion";
+        $helperImageWithVersion = coolifyHelperImage().":$helperImageVersion";
 
         $cleanupLog = [];
 
@@ -163,8 +160,7 @@ class CleanupDocker implements ShouldBeUnique
             'docker builder prune -af',
             // The prune fails on a stopped builder, so start it first.
             railpackBuilderHelperCommand(railpackBuildxMetadataVolume($server), $helperImageWithVersion, 'docker buildx inspect --bootstrap coolify-railpack >/dev/null 2>&1; docker buildx prune --builder coolify-railpack -af'),
-            "docker images --filter before=$helperImageWithVersion --filter reference=$helperImage | grep $helperImage | awk '{print $3}' | xargs -r docker rmi -f",
-            "docker images --filter before=$helperImageWithoutPrefixVersion --filter reference=$helperImageWithoutPrefix | grep $helperImageWithoutPrefix | awk '{print $3}' | xargs -r docker rmi -f",
+            $this->buildCoolifyImageCleanupCommand($helperImageVersion),
         ];
 
         if ($deleteUnusedVolumes) {
@@ -219,6 +215,22 @@ class CleanupDocker implements ShouldBeUnique
             "awk '{print $1}' | xargs -r docker rm";
     }
 
+    /**
+     * Build a command that removes unused images of the Coolify helper, realtime and sentinel,
+     * from any registry. They have the coolify.managed=true label, so the generic image prune
+     * skips them. The current helper version stays, and docker rmi (without -f) keeps images
+     * that a container uses, for example the running sentinel.
+     */
+    private function buildCoolifyImageCleanupCommand(string $helperImageVersion): string
+    {
+        $escapedHelperVersion = preg_replace('/([.\\\\+*?\[\]^$(){}|])/', '\\\\$1', $helperImageVersion);
+
+        return "docker images --format '{{.Repository}}:{{.Tag}}' | ".
+            "grep -E '(^|/)coollabsio/(coolify-helper|coolify-realtime|sentinel):' | ".
+            "grep -v -E ':<none>$|(^|/)coollabsio/coolify-helper:{$escapedHelperVersion}$' | ".
+            'xargs -r docker rmi 2>/dev/null || true';
+    }
+
     /**
      * Build a docker image prune command that excludes application image repositories.
      *
@@ -254,17 +266,18 @@ class CleanupDocker implements ShouldBeUnique
         // - Don't have coolify.managed=true label
         // Images in use by containers will fail silently with docker rmi
         // Pattern matches both uuid:tag and uuid_servicename:tag (Docker Compose with build)
+        // Images pulled by digest have no tag and are not dangling, so they are listed as repo@digest
         $grepCommands = "grep -v '<none>'";
 
         // Add application repo exclusion if there are applications
         if ($applicationImageRepos->isNotEmpty()) {
-            $grepCommands .= " | grep -v -E '^({$appExcludePatterns})[_:].+'";
+            $grepCommands .= " | grep -v -E '^({$appExcludePatterns})[_:@].+'";
         }
 
         // Add infrastructure image exclusion (matches any registry prefix)
         $grepCommands .= " | grep -v -E '{$infraExcludePattern}'";
 
-        $commands[] = "docker images --format '{{.Repository}}:{{.Tag}}' | ".
+        $commands[] = "docker images --digests --format '{{if eq .Tag \"<none>\"}}{{.Repository}}@{{.Digest}}{{else}}{{.Repository}}:{{.Tag}}{{end}}' | ".
             $grepCommands.' | '.
             "xargs -r -I {} sh -c 'docker inspect --format \"{{index .Config.Labels \\\"coolify.managed\\\"}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
 
diff --git a/app/Actions/Server/StartSentinel.php b/app/Actions/Server/StartSentinel.php
index 3dcc2650ac..b888892cea 100644
--- a/app/Actions/Server/StartSentinel.php
+++ b/app/Actions/Server/StartSentinel.php
@@ -148,7 +148,9 @@ class StartSentinel
             ? '-v '.escapeshellarg("{$trafficLogDirectory}:{$trafficLogDirectory}:ro").' '
             : '';
         $network = $server->isLocalhost() ? ' --network coolify' : '';
-        $dockerCommand = "docker run -d$network $dockerEnvironments --name coolify-sentinel --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db {$trafficMount}--pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-start-period 120s --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
+        // A userns-remap daemon refuses --pid host unless the container opts out of remapping.
+        // On other daemons --userns host has no effect. https://docs.docker.com/engine/security/userns-remap/
+        $dockerCommand = "docker run -d$network $dockerEnvironments --name coolify-sentinel --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db {$trafficMount}--userns host --pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-start-period 120s --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
 
         $server->sentinelHeartbeat(isReset: true);
         $server->forceFill(['sentinel_waiting_since' => now()])->save();
diff --git a/app/Actions/Service/DeployServiceApplication.php b/app/Actions/Service/DeployServiceApplication.php
index 4db4834d4c..2a475cd462 100644
--- a/app/Actions/Service/DeployServiceApplication.php
+++ b/app/Actions/Service/DeployServiceApplication.php
@@ -47,24 +47,30 @@ class DeployServiceApplication
             $commands->push("docker network inspect {$safeProjectName} >/dev/null 2>&1 || docker network create --attachable {$safeProjectName}");
         }
 
+        $connectToPredefinedNetwork = (bool) data_get($service, 'connect_to_docker_network');
         $upCommand = "docker compose --project-directory {$safeWorkdir} -f {$safeComposeFile} --project-name {$safeProjectName} up -d --no-deps";
         if ($forceRebuild) {
             $upCommand .= ' --build';
         }
+        if ($connectToPredefinedNetwork) {
+            $upCommand .= ' --no-start';
+        }
         // No stdin for Compose prompts: they would read the next script lines (see StartService).
         $upCommand .= " {$safeComposeServiceName} < /dev/null";
         $commands->push('echo Starting service container.');
         $commands->push($upCommand);
 
-        $commands->push("docker network connect {$safeProjectName} coolify-proxy >/dev/null 2>&1 || true");
-
-        if (data_get($service, 'connect_to_docker_network')) {
-            $network = escapeshellarg($service->destination->network);
-            $containerName = escapeshellarg("{$composeServiceName}-{$service->uuid}");
-            $networkAlias = escapeshellarg("{$composeServiceName}-{$service->uuid}");
-            $commands->push("docker network connect --alias {$networkAlias} {$network} {$containerName} >/dev/null 2>&1 || true");
+        if ($connectToPredefinedNetwork) {
+            // Connect to the predefined network before the container starts (see StartService).
+            $serviceConfig = data_get(parseDockerComposeYaml($service->docker_compose ?? ''), "services.{$composeServiceName}");
+            if ($command = StartService::predefinedNetworkConnectCommand($service, $composeServiceName, $serviceConfig)) {
+                $commands->push($command);
+            }
+            $commands->push('docker start '.escapeshellarg("{$composeServiceName}-{$service->uuid}").' >/dev/null');
         }
 
+        $commands->push("docker network connect {$safeProjectName} coolify-proxy >/dev/null 2>&1 || true");
+
         return remote_process($commands->toArray(), $service->server, type_uuid: $service->uuid, callEventOnFinish: 'ServiceStartFinished', callEventData: $service->id, queue: deployment_queue());
     }
 }
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 3823c71661..5f71218e0c 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -55,17 +55,22 @@ class StartService
             $commands[] = "docker network inspect $service->uuid >/dev/null 2>&1 || docker network create --attachable $service->uuid";
         }
         $commands[] = 'echo Starting service.';
-        $commands[] = "docker compose --project-directory {$workdir} -f {$workdir}/docker-compose.yml --project-name {$service->uuid} up -d --remove-orphans --force-recreate --build < /dev/null";
-        $commands[] = "docker network connect $service->uuid coolify-proxy >/dev/null 2>&1 || true";
+        $compose = "docker compose --project-directory {$workdir} -f {$workdir}/docker-compose.yml --project-name {$service->uuid}";
         if (data_get($service, 'connect_to_docker_network')) {
-            $compose = data_get($service, 'docker_compose', []);
-            $safeNetwork = escapeshellarg($service->destination->network);
-            $serviceNames = data_get(parseDockerComposeYaml($compose), 'services', []);
-            foreach ($serviceNames as $serviceName => $serviceConfig) {
-                $containerName = escapeshellarg("{$serviceName}-{$service->uuid}");
-                $commands[] = "docker network connect --alias {$containerName} {$safeNetwork} {$containerName} >/dev/null 2>&1 || true";
+            // Connect the created containers to the predefined network before they start. A container
+            // that needs this network during a service_healthy wait never gets it after `up -d`.
+            $commands[] = "{$compose} up -d --remove-orphans --force-recreate --build --no-start < /dev/null";
+            $composeServices = data_get(parseDockerComposeYaml(data_get($service, 'docker_compose', '')), 'services', []);
+            foreach ($composeServices as $serviceName => $serviceConfig) {
+                if ($command = self::predefinedNetworkConnectCommand($service, $serviceName, $serviceConfig)) {
+                    $commands[] = $command;
+                }
             }
+            $commands[] = "{$compose} start < /dev/null";
+        } else {
+            $commands[] = "{$compose} up -d --remove-orphans --force-recreate --build < /dev/null";
         }
+        $commands[] = "docker network connect $service->uuid coolify-proxy >/dev/null 2>&1 || true";
         $commands = array_merge($commands, $this->logDrainNetworkConnectCommands($service));
         if ($service->is_maintenance_enabled) {
             // Domains can change with the compose file, so the maintenance routes follow them.
@@ -79,6 +84,24 @@ class StartService
         return remote_process($commands, $service->server, type_uuid: $service->uuid, callEventOnFinish: 'ServiceStartFinished', callEventData: $service->id, queue: deployment_queue());
     }
 
+    /**
+     * Connects a container to the predefined network of the destination, unless it is already
+     * connected (declared in the compose file, or a running container that was not recreated).
+     * Containers with a network_mode cannot join other networks and are skipped.
+     */
+    public static function predefinedNetworkConnectCommand(Service $service, string $serviceName, mixed $serviceConfig): ?string
+    {
+        if (data_get($serviceConfig, 'network_mode') !== null) {
+            return null;
+        }
+        $network = escapeshellarg($service->destination->network);
+        $containerName = escapeshellarg("{$serviceName}-{$service->uuid}");
+        $warning = escapeshellarg("Warning: Could not connect {$serviceName} to the {$service->destination->network} network.");
+        $connectedNetworks = "docker container inspect --format '{{range \$name, \$_ := .NetworkSettings.Networks}}{{println \$name}}{{end}}' {$containerName}";
+
+        return "{$connectedNetworks} | grep -qxF {$network} || docker network connect --alias {$containerName} {$network} {$containerName} || echo {$warning}";
+    }
+
     /**
      * Shows the volume warnings of the last parse (for example an external volume that the
      * service does not use yet) in the start log.
diff --git a/app/Console/Commands/Generate/OpenApi.php b/app/Console/Commands/Generate/OpenApi.php
index 64d83e1bf9..0a91e6e9cf 100644
--- a/app/Console/Commands/Generate/OpenApi.php
+++ b/app/Console/Commands/Generate/OpenApi.php
@@ -21,9 +21,6 @@ class OpenApi extends Command
         $process = Process::env(['XDEBUG_MODE' => 'off'])->run([
             './vendor/bin/openapi',
             'app',
-            // Server transfer endpoints are development-only (isDev()), so they stay out of the public docs.
-            '--exclude',
-            'Http/Controllers/Api/ServerTransferController.php',
             '-o',
             'openapi.yaml',
             '--version',
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index a88ba64a81..7f3e5fb8bf 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -25,6 +25,8 @@ use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
 
 class Kernel extends ConsoleKernel
 {
+    private const CDN_JITTER_SECONDS = 600;
+
     private Schedule $scheduleInstance;
 
     private InstanceSettings $settings;
@@ -91,8 +93,8 @@ class Kernel extends ConsoleKernel
             $this->scheduleInstance->command('horizon:snapshot')->everyFiveMinutes();
             $this->scheduleInstance->command('cleanup:unreachable-servers')->daily()->onOneServer();
 
-            $this->scheduleInstance->job(new PullTemplatesFromCDN)->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
-            $this->scheduleInstance->job(new PullChangelog)->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
+            $this->scheduleInstance->job($this->withCdnJitter(new PullTemplatesFromCDN))->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
+            $this->scheduleInstance->job($this->withCdnJitter(new PullChangelog))->cron($this->updateCheckFrequency)->timezone($this->instanceTimezone)->onOneServer();
 
             $this->scheduleInstance->job(new CleanupInstanceStuffsJob)->everyTwoMinutes()->onOneServer();
             $this->scheduleUpdates();
@@ -117,7 +119,7 @@ class Kernel extends ConsoleKernel
 
     private function pullImages(): void
     {
-        $this->scheduleInstance->job(new CheckHelperImageJob)
+        $this->scheduleInstance->job($this->withCdnJitter(new CheckHelperImageJob))
             ->cron($this->updateCheckFrequency)
             ->timezone($this->instanceTimezone)
             ->onOneServer();
@@ -162,20 +164,29 @@ class Kernel extends ConsoleKernel
 
     private function scheduleUpdates(): void
     {
-        $this->scheduleInstance->job(new CheckForUpdatesJob)
+        $this->scheduleInstance->job($this->withCdnJitter(new CheckForUpdatesJob))
             ->cron($this->updateCheckFrequency)
             ->timezone($this->instanceTimezone)
             ->onOneServer();
 
         if ($this->settings->is_auto_update_enabled) {
             $autoUpdateFrequency = $this->settings->auto_update_frequency;
-            $this->scheduleInstance->job(new UpdateCoolifyJob)
+            $this->scheduleInstance->job($this->withCdnJitter(new UpdateCoolifyJob))
                 ->cron($autoUpdateFrequency)
                 ->timezone($this->instanceTimezone)
                 ->onOneServer();
         }
     }
 
+    /**
+     * All instances share the same default cron, so without a random delay they all request the CDN
+     * at the same second and Cloudflare rejects the burst (error 1200).
+     */
+    private function withCdnJitter(object $job): object
+    {
+        return $job->delay(random_int(0, self::CDN_JITTER_SECONDS));
+    }
+
     protected function commands(): void
     {
         $this->load(__DIR__.'/Commands');
diff --git a/app/Data/FileEntry.php b/app/Data/FileEntry.php
new file mode 100644
index 0000000000..7e01793ea3
--- /dev/null
+++ b/app/Data/FileEntry.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Data;
+
+class FileEntry
+{
+    public function __construct(
+        public string $name,
+        public string $type,
+        public int $size,
+        public int $mtime,
+        public string $perms = '',
+        public string $owner = '',
+        public string $group = '',
+    ) {}
+
+    public function isDir(): bool
+    {
+        return $this->type === 'dir';
+    }
+
+    public function isEditableCandidate(): bool
+    {
+        return ! $this->isDir();
+    }
+
+    /**
+     * @param  array<int, self>  $entries
+     * @return array<int, self>
+     */
+    public static function sort(array $entries): array
+    {
+        usort($entries, function (self $a, self $b) {
+            if ($a->isDir() !== $b->isDir()) {
+                return $a->isDir() ? -1 : 1;
+            }
+
+            return strcasecmp($a->name, $b->name);
+        });
+
+        return $entries;
+    }
+}
diff --git a/app/Data/Traffic/TrafficBreakdownData.php b/app/Data/Traffic/TrafficBreakdownData.php
index a98e5323a4..47114f1362 100644
--- a/app/Data/Traffic/TrafficBreakdownData.php
+++ b/app/Data/Traffic/TrafficBreakdownData.php
@@ -10,14 +10,23 @@ class TrafficBreakdownData extends Data
         public string $value,
         public int $requests,
         public int $bytesOut,
+        public ?float $lat = null,
+        public ?float $lon = null,
     ) {}
 
     public static function fromSentinel(array $row): self
     {
+        $lat = data_get($row, 'lat');
+        $lon = data_get($row, 'lon');
+        $hasCoordinates = is_numeric($lat) && is_numeric($lon)
+            && abs((float) $lat) <= 90 && abs((float) $lon) <= 180;
+
         return new self(
             value: (string) data_get($row, 'value', ''),
             requests: (int) data_get($row, 'requests', 0),
             bytesOut: (int) data_get($row, 'bytes_out', 0),
+            lat: $hasCoordinates ? (float) $lat : null,
+            lon: $hasCoordinates ? (float) $lon : null,
         );
     }
 }
diff --git a/app/Enums/TrafficIpMode.php b/app/Enums/TrafficIpMode.php
index 6f2b09d89a..4b9f5f48d1 100644
--- a/app/Enums/TrafficIpMode.php
+++ b/app/Enums/TrafficIpMode.php
@@ -44,7 +44,8 @@ enum TrafficIpMode: string
     }
 
     /**
-     * Drop the `ip` dimension when Sentinel does not record it.
+     * Drop the `ip` and `city` dimensions when Sentinel does not record them
+     * (Sentinel finds the city from the client IP, so `off` stores no cities).
      *
      * @param  array<int, string>  $dimensions
      * @return array<int, string>
@@ -55,7 +56,7 @@ enum TrafficIpMode: string
             return $dimensions;
         }
 
-        return array_values(array_filter($dimensions, fn (string $dimension): bool => $dimension !== 'ip'));
+        return array_values(array_filter($dimensions, fn (string $dimension): bool => ! in_array($dimension, ['ip', 'city'], true)));
     }
 
     public function breakdownLabel(): string
diff --git a/app/Events/DockerCleanupDone.php b/app/Events/DockerCleanupDone.php
index 2bd7fee198..f229c66451 100644
--- a/app/Events/DockerCleanupDone.php
+++ b/app/Events/DockerCleanupDone.php
@@ -21,4 +21,18 @@ class DockerCleanupDone implements ShouldBroadcast
             new PrivateChannel('team.'.$this->execution->server->team->id),
         ];
     }
+
+    /**
+     * Keep the payload under Reverb's max message size: the cleanup log can be large.
+     *
+     * @return array{executionId: int, serverId: int, status: string}
+     */
+    public function broadcastWith(): array
+    {
+        return [
+            'executionId' => $this->execution->id,
+            'serverId' => $this->execution->server_id,
+            'status' => $this->execution->status,
+        ];
+    }
 }
diff --git a/app/Events/TransferFinishChanged.php b/app/Events/TransferFinishChanged.php
new file mode 100644
index 0000000000..15fd906b90
--- /dev/null
+++ b/app/Events/TransferFinishChanged.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Events;
+
+use App\Models\Server;
+use App\Traits\BroadcastsToTeam;
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Contracts\Events\ShouldDispatchAfterCommit;
+use Illuminate\Foundation\Events\Dispatchable;
+
+/**
+ * A step of the "Finish the transfer" list changed, so open server pages show it without a reload.
+ */
+class TransferFinishChanged implements ShouldBroadcast, ShouldDispatchAfterCommit
+{
+    use BroadcastsToTeam, Dispatchable, InteractsWithSockets;
+
+    public string $serverUuid;
+
+    public function __construct(Server $server)
+    {
+        $this->teamId = $server->team_id;
+        $this->serverUuid = $server->uuid;
+    }
+}
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 4096ef94e5..2904a61806 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -421,7 +421,7 @@ class ApplicationsController extends Controller
                                     ],
                                 ),
                             ],
-                            'watch_paths' => ['type' => 'string', 'description' => 'The watch paths.'],
+                            'watch_paths' => ['type' => 'string', 'description' => 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'],
                             'use_build_server' => ['type' => 'boolean', 'nullable' => true, 'description' => 'Use build server.'],
                             'use_build_secrets' => ['type' => 'boolean', 'default' => false, 'description' => 'Use Docker Build Secrets for build-time environment variables.'],
                             'is_git_submodules_enabled' => ['type' => 'boolean', 'description' => 'Clone Git submodules.'],
@@ -622,7 +622,7 @@ class ApplicationsController extends Controller
                                     ],
                                 ),
                             ],
-                            'watch_paths' => ['type' => 'string', 'description' => 'The watch paths.'],
+                            'watch_paths' => ['type' => 'string', 'description' => 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'],
                             'use_build_server' => ['type' => 'boolean', 'nullable' => true, 'description' => 'Use build server.'],
                             'use_build_secrets' => ['type' => 'boolean', 'default' => false, 'description' => 'Use Docker Build Secrets for build-time environment variables.'],
                             'is_git_submodules_enabled' => ['type' => 'boolean', 'description' => 'Clone Git submodules.'],
@@ -823,7 +823,7 @@ class ApplicationsController extends Controller
                                     ],
                                 ),
                             ],
-                            'watch_paths' => ['type' => 'string', 'description' => 'The watch paths.'],
+                            'watch_paths' => ['type' => 'string', 'description' => 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'],
                             'use_build_server' => ['type' => 'boolean', 'nullable' => true, 'description' => 'Use build server.'],
                             'use_build_secrets' => ['type' => 'boolean', 'default' => false, 'description' => 'Use Docker Build Secrets for build-time environment variables.'],
                             'is_git_submodules_enabled' => ['type' => 'boolean', 'description' => 'Clone Git submodules.'],
@@ -1276,6 +1276,9 @@ class ApplicationsController extends Controller
 
         $this->authorize('create', Application::class);
 
+        // removeUnnecessaryFieldsFromRequest() strips force_domain_override before the docker_compose_domains checks run.
+        $forceDomainOverride = $request->boolean('force_domain_override');
+
         if ($request->instant_deploy) {
             abort_unless($request->user()->tokenCan('deploy') || $request->user()->tokenCan('root'), 403, 'Missing required permissions: deploy');
         }
@@ -1531,7 +1534,7 @@ class ApplicationsController extends Controller
                 });
 
                 $duplicates = $urls->duplicates()->unique()->values();
-                if ($duplicates->isNotEmpty() && ! $request->boolean('force_domain_override')) {
+                if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
                     $errors[] = 'The current request contains conflicting URLs: '.implode(', ', $duplicates->toArray()).' Use force_domain_override=true to proceed.';
                 }
 
@@ -1552,7 +1555,7 @@ class ApplicationsController extends Controller
                         ], 422);
                     }
 
-                    if ($result['hasConflicts'] && ! $request->boolean('force_domain_override')) {
+                    if ($result['hasConflicts'] && ! $forceDomainOverride) {
                         return response()->json([
                             'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
                             'conflicts' => $result['conflicts'],
@@ -1577,7 +1580,7 @@ class ApplicationsController extends Controller
                 $application->domain_port_overrides = $domainPortOverrides;
             }
             $gitRepository = $application->git_repository;
-            $httpsRepository = scpStyleGitUrlToHttps($gitRepository);
+            $httpsRepository = sshGitUrlToHttps($gitRepository);
             if (is_string($httpsRepository)) {
                 $gitRepository = $httpsRepository;
                 $application->git_repository = $httpsRepository;
@@ -1799,7 +1802,7 @@ class ApplicationsController extends Controller
                 });
 
                 $duplicates = $urls->duplicates()->unique()->values();
-                if ($duplicates->isNotEmpty() && ! $request->boolean('force_domain_override')) {
+                if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
                     $errors[] = 'The current request contains conflicting URLs: '.implode(', ', $duplicates->toArray()).' Use force_domain_override=true to proceed. ';
                 }
 
@@ -1820,7 +1823,7 @@ class ApplicationsController extends Controller
                         ], 422);
                     }
 
-                    if ($result['hasConflicts'] && ! $request->boolean('force_domain_override')) {
+                    if ($result['hasConflicts'] && ! $forceDomainOverride) {
                         return response()->json([
                             'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
                             'conflicts' => $result['conflicts'],
@@ -2032,7 +2035,7 @@ class ApplicationsController extends Controller
                 });
 
                 $duplicates = $urls->duplicates()->unique()->values();
-                if ($duplicates->isNotEmpty() && ! $request->boolean('force_domain_override')) {
+                if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
                     $errors[] = 'The current request contains conflicting URLs: '.implode(', ', $duplicates->toArray()).' Use force_domain_override=true to proceed.';
                 }
 
@@ -2053,7 +2056,7 @@ class ApplicationsController extends Controller
                         ], 422);
                     }
 
-                    if ($result['hasConflicts'] && ! $request->boolean('force_domain_override')) {
+                    if ($result['hasConflicts'] && ! $forceDomainOverride) {
                         return response()->json([
                             'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
                             'conflicts' => $result['conflicts'],
@@ -3093,14 +3096,10 @@ class ApplicationsController extends Controller
                     schema: new OA\Schema(
                         type: 'object',
                         properties: [
-                            'project_uuid' => ['type' => 'string', 'description' => 'The project UUID.'],
-                            'server_uuid' => ['type' => 'string', 'description' => 'The server UUID.'],
-                            'environment_name' => ['type' => 'string', 'description' => 'The environment name.'],
                             'github_app_uuid' => ['type' => 'string', 'description' => 'The Github App UUID.'],
                             'git_repository' => ['type' => 'string', 'description' => 'The git repository URL.'],
                             'git_branch' => ['type' => 'string', 'description' => 'The git branch.'],
                             'ports_exposes' => ['type' => 'string', 'description' => 'The ports to expose.'],
-                            'destination_uuid' => ['type' => 'string', 'description' => 'The destination UUID.'],
                             'build_pack' => ['type' => 'string', 'enum' => ['nixpacks', 'railpack', 'static', 'dockerfile', 'dockercompose'], 'description' => 'The build pack type.'],
                             'name' => ['type' => 'string', 'description' => 'The application name.'],
                             'description' => ['type' => 'string', 'description' => 'The application description.'],
@@ -3168,7 +3167,7 @@ class ApplicationsController extends Controller
                                     ],
                                 ),
                             ],
-                            'watch_paths' => ['type' => 'string', 'description' => 'The watch paths.'],
+                            'watch_paths' => ['type' => 'string', 'description' => 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'],
                             'use_build_server' => ['type' => 'boolean', 'nullable' => true, 'description' => 'Use build server.'],
                             'use_build_secrets' => ['type' => 'boolean', 'description' => 'Use Docker Build Secrets for build-time environment variables.'],
                             'http_basic_auth_hash_algorithm' => ['type' => 'string', 'enum' => ['bcrypt', 'argon2id'], 'description' => 'Hash algorithm for the HTTP Basic Authentication password. Argon2id needs the Caddy proxy, version 2.11 or newer.'],
@@ -3301,10 +3300,12 @@ class ApplicationsController extends Controller
         $dnsCleanup = app(ManagedDnsRecordCleanup::class);
         $previousDnsHostnames = $dnsCleanup->hostnamesOf($application);
         $server = $application->destination->server;
-        $allowedFields = ['name', 'description', 'is_static', 'is_spa', 'is_auto_deploy_enabled', 'is_force_https_enabled', 'is_preview_deployments_enabled', 'domains', 'noindex_domains', 'git_repository', 'git_branch', 'git_commit_sha', 'docker_registry_image_name', 'docker_registry_image_tag', 'build_pack', 'static_image', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'ports_mappings', 'custom_network_aliases', 'base_directory', 'publish_directory', 'health_check_enabled', 'health_check_type', 'health_check_command', 'health_check_path', 'health_check_port', 'health_check_host', 'health_check_method', 'health_check_return_code', 'health_check_scheme', 'health_check_response_text', 'health_check_interval', 'health_check_timeout', 'health_check_retries', 'health_check_start_period', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'custom_labels', 'custom_docker_run_options', 'post_deployment_command', 'post_deployment_command_container', 'pre_deployment_command', 'pre_deployment_command_container', 'watch_paths', 'manual_webhook_secret_github', 'manual_webhook_secret_gitlab', 'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea', 'dockerfile_location', 'dockerfile_target_build', 'docker_compose_location', 'docker_compose_custom_start_command', 'docker_compose_custom_build_command', 'docker_compose_domains', 'redirect', 'instant_deploy', 'use_build_server', 'use_build_secrets', 'custom_nginx_configuration', 'is_http_basic_auth_enabled', 'http_basic_auth_username', 'http_basic_auth_password', 'http_basic_auth_hash_algorithm', 'http_basic_auth_bcrypt_cost', 'http_basic_auth_argon2id_memory_cost', 'http_basic_auth_argon2id_time_cost', 'connect_to_docker_network', 'force_domain_override', 'is_container_label_escape_enabled', 'is_preserve_repository_enabled', 'preview_url_template', 'max_restart_count', ...self::APPLICATION_SETTING_FIELDS];
+        $allowedFields = ['name', 'description', 'is_static', 'is_spa', 'is_auto_deploy_enabled', 'is_force_https_enabled', 'is_preview_deployments_enabled', 'domains', 'noindex_domains', 'git_repository', 'git_branch', 'git_commit_sha', 'docker_registry_image_name', 'docker_registry_image_tag', 'build_pack', 'static_image', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'ports_mappings', 'custom_network_aliases', 'base_directory', 'publish_directory', 'health_check_enabled', 'health_check_type', 'health_check_command', 'health_check_path', 'health_check_port', 'health_check_host', 'health_check_method', 'health_check_return_code', 'health_check_scheme', 'health_check_response_text', 'health_check_interval', 'health_check_timeout', 'health_check_retries', 'health_check_start_period', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'custom_labels', 'custom_docker_run_options', 'post_deployment_command', 'post_deployment_command_container', 'pre_deployment_command', 'pre_deployment_command_container', 'watch_paths', 'manual_webhook_secret_github', 'manual_webhook_secret_gitlab', 'manual_webhook_secret_bitbucket', 'manual_webhook_secret_gitea', 'dockerfile_location', 'dockerfile_target_build', 'docker_compose_location', 'docker_compose_custom_start_command', 'docker_compose_custom_build_command', 'docker_compose_domains', 'redirect', 'instant_deploy', 'use_build_server', 'use_build_secrets', 'custom_nginx_configuration', 'is_http_basic_auth_enabled', 'http_basic_auth_username', 'http_basic_auth_password', 'http_basic_auth_hash_algorithm', 'http_basic_auth_bcrypt_cost', 'http_basic_auth_argon2id_memory_cost', 'http_basic_auth_argon2id_time_cost', 'connect_to_docker_network', 'force_domain_override', 'is_container_label_escape_enabled', 'is_preserve_repository_enabled', 'preview_url_template', 'max_restart_count', 'github_app_uuid', 'dockerfile', ...self::APPLICATION_SETTING_FIELDS];
 
         $validationRules = [
             'name' => 'string|max:255',
+            'github_app_uuid' => 'string',
+            'dockerfile' => 'string',
             'description' => 'string|nullable',
             'watch_paths' => 'string|nullable',
             'docker_compose_domains' => 'array|nullable',
@@ -3364,6 +3365,28 @@ class ApplicationsController extends Controller
                 'custom_nginx_configuration' => $customNginxConfiguration,
             ]);
         }
+        if ($request->has('dockerfile')) {
+            if (blank($application->dockerfile)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'dockerfile' => 'The dockerfile can only be updated for applications created from a Dockerfile.',
+                    ],
+                ], 422);
+            }
+            $dockerfile = is_string($request->dockerfile) && isBase64Encoded($request->dockerfile) ? base64_decode($request->dockerfile) : false;
+            if ($dockerfile === false || blank($dockerfile) || mb_detect_encoding($dockerfile, 'UTF-8', true) === false) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'dockerfile' => 'The dockerfile should be base64 encoded.',
+                    ],
+                ], 422);
+            }
+            $request->merge([
+                'dockerfile' => $dockerfile,
+            ]);
+        }
         $return = $this->validateDataApplications($request, $server);
         if ($return instanceof JsonResponse) {
             return $return;
@@ -3383,6 +3406,24 @@ class ApplicationsController extends Controller
             ], 422);
         }
 
+        $githubApp = null;
+        if ($request->has('github_app_uuid')) {
+            if ($application->build_pack === 'dockerimage' || filled($application->dockerfile) || $application->deploymentType() === 'deploy_key') {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'github_app_uuid' => 'The github_app_uuid can only be changed for applications deployed from a GitHub App or public repository.',
+                    ],
+                ], 422);
+            }
+            $githubApp = GithubApp::where('uuid', $request->github_app_uuid)
+                ->where(fn ($query) => $query->where('team_id', $teamId)->orWhere('is_system_wide', true))
+                ->first();
+            if (! $githubApp?->isConnected()) {
+                return response()->json(['message' => 'Github App not found.'], 404);
+            }
+        }
+
         $applicationSettings = $this->applicationSettingsFromRequest($request);
         if ($prefixValidation = $this->containerNamePrefixValidationResponse($applicationSettings, $application->destination->server, $application)) {
             return $prefixValidation;
@@ -3642,6 +3683,12 @@ class ApplicationsController extends Controller
         $requestHasNoindexDomains = $request->has('noindex_domains');
         data_forget($data, 'noindex_domains');
         $application->fill($data);
+        if ($githubApp && ($application->source_id !== $githubApp->id || $application->source_type !== $githubApp->getMorphClass())) {
+            $application->source_id = $githubApp->id;
+            $application->source_type = $githubApp->getMorphClass();
+            // The next deployment fetches the repository ID from the new source.
+            $application->repository_project_id = null;
+        }
         if ($requestHasNoindexDomains) {
             // Must run after fqdn is filled: flags are kept only for domains the app still has.
             $application->setNoindexDomains($request->input('noindex_domains') ?? []);
@@ -3650,6 +3697,9 @@ class ApplicationsController extends Controller
             $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
         }
         $application->withoutAuditLogging(fn () => $application->save());
+        if ($application->wasChanged('dockerfile')) {
+            $application->parseHealthcheckFromDockerfile($application->dockerfile);
+        }
         $dnsCleanup->queueReleaseOfRemovedHostnames($application, $previousDnsHostnames, (int) $teamId);
 
         auditLog('api.application.updated', [
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index fd7c53e90a..634f20720d 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -556,6 +556,7 @@ class DatabasesController extends Controller
                         'limits_cpus' => ['type' => 'string', 'description' => 'CPU limit of the database'],
                         'limits_cpuset' => ['type' => 'string', 'description' => 'CPU set of the database'],
                         'limits_cpu_shares' => ['type' => 'integer', 'description' => 'CPU shares of the database'],
+                        'instant_deploy' => ['type' => 'boolean', 'description' => 'Restart the database after the update. Requires the deploy ability.'],
                         'postgres_user' => ['type' => 'string', 'description' => 'PostgreSQL user'],
                         'postgres_password' => ['type' => 'string', 'description' => 'PostgreSQL password'],
                         'postgres_db' => ['type' => 'string', 'description' => 'PostgreSQL database'],
@@ -644,6 +645,7 @@ class DatabasesController extends Controller
             'limits_cpus' => 'string',
             'limits_cpuset' => 'string|nullable',
             'limits_cpu_shares' => 'numeric',
+            'instant_deploy' => 'boolean',
             'redact_all_env_values_in_logs' => 'boolean',
         ]);
 
@@ -654,6 +656,7 @@ class DatabasesController extends Controller
             ], 422);
         }
         $uuid = $request->uuid;
+        $instantDeploy = $request->boolean('instant_deploy');
         $redactAllEnvValuesInLogs = $request->has('redact_all_env_values_in_logs') ? $request->boolean('redact_all_env_values_in_logs') : null;
         removeUnnecessaryFieldsFromRequest($request);
         $database = queryDatabaseByUuidWithinTeam($uuid, $teamId);
@@ -663,6 +666,11 @@ class DatabasesController extends Controller
 
         $this->authorize('update', $database);
 
+        if ($instantDeploy) {
+            abort_unless($request->user()->tokenCan('deploy') || $request->user()->tokenCan('root'), 403, 'Missing required permissions: deploy');
+            $this->authorize('manage', $database);
+        }
+
         if ($redactAllEnvValuesInLogs !== null) {
             $this->authorize('manageEnvironment', $database);
         }
@@ -890,6 +898,17 @@ class DatabasesController extends Controller
                 'errors' => $errors,
             ], 422);
         }
+        $restartReservation = null;
+        if ($instantDeploy) {
+            $prerequisiteError = StartDatabase::prerequisiteError($database);
+            if ($prerequisiteError !== null) {
+                return response()->json(['message' => $prerequisiteError], 422);
+            }
+            $restartReservation = StartDatabase::reserveOperation($database);
+            if ($restartReservation === null) {
+                return response()->json(['message' => ResourceStartActivity::DATABASE_OPERATION_IN_PROGRESS_MESSAGE], 409);
+            }
+        }
         $whatToDoWithDatabaseProxy = null;
         if ($request->is_public === false && $database->is_public === true) {
             $whatToDoWithDatabaseProxy = 'stop';
@@ -903,12 +922,22 @@ class DatabasesController extends Controller
             $database->redact_all_env_values_in_logs = $redactAllEnvValuesInLogs;
         }
         $database->update($request->only($allowedFields));
+        // The Redis password is stored in the REDIS_PASSWORD variable, not in a column.
+        if ($database instanceof StandaloneRedis && filled($request->redis_password)) {
+            $database->runtime_environment_variables()->updateOrCreate(
+                ['key' => 'REDIS_PASSWORD'],
+                ['value' => $request->redis_password, 'resourceable_id' => $database->id]
+            );
+        }
 
         if ($whatToDoWithDatabaseProxy === 'start') {
             StartDatabaseProxy::dispatch($database);
         } elseif ($whatToDoWithDatabaseProxy === 'stop') {
             StopDatabaseProxy::dispatch($database);
         }
+        if ($restartReservation !== null) {
+            StartDatabase::dispatchReserved(RestartDatabase::class, $database, $restartReservation);
+        }
 
         auditLog('api.database.updated', [
             'team_id' => $teamId,
diff --git a/app/Http/Controllers/Api/HostingerController.php b/app/Http/Controllers/Api/HostingerController.php
index 84017e7ded..af4173e39d 100644
--- a/app/Http/Controllers/Api/HostingerController.php
+++ b/app/Http/Controllers/Api/HostingerController.php
@@ -122,6 +122,7 @@ class HostingerController extends Controller
         responses: [
             new OA\Response(response: 201, description: 'Hostinger VPS purchased and linked to a Coolify server.'),
             new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'The token needs the deploy ability to set post_install_script_id or public_key_ids.'),
             new OA\Response(response: 422, description: 'Validation failed.'),
             new OA\Response(response: 429, description: 'Hostinger rate limit exceeded.'),
         ]
@@ -182,6 +183,10 @@ class HostingerController extends Controller
             ], 422);
         }
 
+        if ($request->filled('post_install_script_id') || $request->array('public_key_ids')) {
+            abort_unless($request->user()->tokenCan('deploy') || $request->user()->tokenCan('root'), 403, 'Missing required permissions: deploy');
+        }
+
         $team = Team::find($teamId);
         if (Team::serverLimitReached($team)) {
             return response()->json(['message' => 'Server limit reached for your subscription.'], 400);
diff --git a/app/Http/Controllers/Api/ServerCanvasController.php b/app/Http/Controllers/Api/ServerCanvasController.php
index e48b8c4aff..79c33553ad 100644
--- a/app/Http/Controllers/Api/ServerCanvasController.php
+++ b/app/Http/Controllers/Api/ServerCanvasController.php
@@ -29,6 +29,22 @@ class ServerCanvasController extends Controller
         return response()->json($this->canvas->payload($teamId, $servers, null, $this->canReadSensitive($request), $this->canEdit($request, $teamId)));
     }
 
+    /**
+     * Dashboard canvas: every server of the team with its resources and their running or queued deployments.
+     */
+    public function dashboard(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $this->authorize('viewAny', Server::class);
+
+        $servers = Server::query()->whereTeamId($teamId)->with('settings')->orderBy('name')->get();
+
+        return response()->json($this->canvas->dashboardPayload($teamId, $servers, $this->canReadSensitive($request), $this->canEdit($request, $teamId)));
+    }
+
     public function show(Request $request, string $uuid): JsonResponse
     {
         $teamId = getTeamIdFromToken();
@@ -73,6 +89,27 @@ class ServerCanvasController extends Controller
         return response()->json(['nodes' => $this->canvas->unmanagedContainerNodes($server)->all()]);
     }
 
+    /**
+     * Latest CPU, memory and disk usage of one server for its zone header on the canvas.
+     */
+    public function usage(string $uuid): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $server = Server::query()->whereTeamId($teamId)->whereUuid($uuid)->with('settings')->first();
+        if (! $server) {
+            return response()->json(['message' => 'Server not found.'], 404);
+        }
+        $this->authorize('view', $server);
+        if (! $server->settings->is_metrics_enabled) {
+            return response()->json(['cpu' => null, 'memory' => null, 'disk' => null]);
+        }
+
+        return response()->json($this->canvas->usage($server));
+    }
+
     private function canReadSensitive(Request $request): bool
     {
         return (bool) $request->attributes->get('can_read_sensitive', false);
diff --git a/app/Http/Controllers/Api/ServerTransferController.php b/app/Http/Controllers/Api/ServerTransferController.php
index f43189abf8..ffc86b8641 100644
--- a/app/Http/Controllers/Api/ServerTransferController.php
+++ b/app/Http/Controllers/Api/ServerTransferController.php
@@ -3,10 +3,12 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
 use App\Models\Server;
+use App\Rules\ValidServerIp;
 use App\Services\ServerTransfer\ServerTransferBundle;
 use App\Services\ServerTransfer\ServerTransferClaimer;
-use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
 use App\Services\ServerTransfer\ServerTransferMigrator;
 use Illuminate\Http\JsonResponse;
@@ -18,17 +20,14 @@ use Throwable;
 class ServerTransferController extends Controller
 {
     public function __construct(
-        private ServerTransferExporter $exporter,
         private ServerTransferImporter $importer,
         private ServerTransferClaimer $claimer,
         private ServerTransferMigrator $migrator,
-    ) {
-        abort_unless(isDev(), 404);
-    }
+    ) {}
 
     #[OA\Post(
         summary: 'Migrate server to another Coolify instance',
-        description: 'One-shot handoff: export this server, import+claim on the target instance (using the provided token), then disable automations here. Requires read:sensitive and write.',
+        description: 'Start a transfer in the background: export this server, import and claim it on the target instance (with the given token), then disable automations here. Follow the progress with GET /servers/{uuid}/transfer. The target URL must use https. Requires read:sensitive and write.',
         path: '/servers/{uuid}/migrate',
         operationId: 'migrate-server-between-instances',
         security: [['bearerAuth' => []]],
@@ -43,13 +42,11 @@ class ServerTransferController extends Controller
                 properties: [
                     new OA\Property(property: 'target_url', type: 'string', example: 'https://coolify-b.example.com'),
                     new OA\Property(property: 'target_token', type: 'string', description: 'API token on the target instance (root or write)'),
-                    new OA\Property(property: 'preserve_uuids', type: 'boolean', default: true),
-                    new OA\Property(property: 'adopt_mode', type: 'boolean', default: true),
                 ]
             )
         ),
         responses: [
-            new OA\Response(response: 200, description: 'Migrated'),
+            new OA\Response(response: 202, description: 'Transfer started'),
             new OA\Response(response: 403, description: 'Missing sensitive permission'),
             new OA\Response(response: 404, ref: '#/components/responses/404'),
             new OA\Response(response: 422, description: 'Validation or remote import failed'),
@@ -83,10 +80,8 @@ class ServerTransferController extends Controller
         $validator = customApiValidator($request->all(), [
             'target_url' => 'required|string|url',
             'target_token' => 'required|string',
-            'preserve_uuids' => 'boolean|nullable',
-            'adopt_mode' => 'boolean|nullable',
         ]);
-        $allowedFields = ['target_url', 'target_token', 'preserve_uuids', 'adopt_mode'];
+        $allowedFields = ['target_url', 'target_token'];
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
         if ($validator->fails() || $extraFields !== []) {
             $errors = $validator->errors();
@@ -101,59 +96,52 @@ class ServerTransferController extends Controller
         }
 
         try {
-            $result = $this->migrator->migrate(
+            $this->migrator->start(
                 server: $server,
                 targetUrl: $request->string('target_url')->toString(),
                 targetToken: $request->string('target_token')->toString(),
-                preserveUuids: $request->boolean('preserve_uuids', true),
-                adoptMode: $request->boolean('adopt_mode', true),
             );
         } catch (Throwable $e) {
             return response()->json(['message' => $e->getMessage()], 422);
         }
 
+        $server->refresh();
         auditLog('api.server.migrate', [
             'team_id' => $teamId,
             'server_uuid' => $server->uuid,
-            'export_id' => $result['export_id'],
-            'target_url' => $result['target_url'],
+            'target_url' => data_get($server->server_metadata, 'migration.target_url'),
         ]);
 
-        return response()->json($result);
+        return response()->json([
+            'server_uuid' => $server->uuid,
+            'migration' => data_get($server->server_metadata, 'migration'),
+            'message' => 'Transfer started. Follow it with GET /api/v1/servers/'.$server->uuid.'/transfer.',
+        ], 202);
     }
 
     #[OA\Get(
-        summary: 'Export server transfer bundle',
-        description: 'Export a server and all resources hosted on it as a versioned transfer bundle for moving between Coolify instances. Requires read:sensitive.',
-        path: '/servers/{uuid}/export',
-        operationId: 'export-server-transfer-bundle',
+        summary: 'Get server transfer status',
+        description: 'Show the transfer state of a server on this instance: the import/claim state (transfer) and the state of a running or finished transfer to another instance (migration).',
+        path: '/servers/{uuid}/transfer',
+        operationId: 'get-server-transfer-status',
         security: [['bearerAuth' => []]],
         tags: ['Servers'],
         parameters: [
             new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
-            new OA\Parameter(name: 'encrypt', in: 'query', required: false, description: 'If true and passphrase is provided, return an encrypted envelope.', schema: new OA\Schema(type: 'boolean')),
-            new OA\Parameter(name: 'passphrase', in: 'query', required: false, description: 'Passphrase used when encrypt=true.', schema: new OA\Schema(type: 'string')),
         ],
         responses: [
-            new OA\Response(response: 200, description: 'Transfer bundle'),
+            new OA\Response(response: 200, description: 'Transfer status'),
             new OA\Response(response: 401, ref: '#/components/responses/401'),
-            new OA\Response(response: 403, description: 'Missing sensitive permission'),
             new OA\Response(response: 404, ref: '#/components/responses/404'),
         ]
     )]
-    public function export(Request $request, string $uuid): JsonResponse
+    public function status(string $uuid): JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        if (! $this->canReadSensitive($request)) {
-            return response()->json([
-                'message' => 'Exporting a server requires a token with read:sensitive (or root) ability and an admin/owner team role.',
-            ], 403);
-        }
-
         $server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
@@ -161,25 +149,106 @@ class ServerTransferController extends Controller
 
         $this->authorize('view', $server);
 
-        try {
-            $bundle = $this->exporter->export($server, includeSensitive: true);
-        } catch (Throwable $e) {
-            return response()->json(['message' => $e->getMessage()], 422);
-        }
-
-        auditLog('api.server.export', [
-            'team_id' => $teamId,
+        return response()->json([
             'server_uuid' => $server->uuid,
-            'export_id' => data_get($bundle, 'export_id'),
+            'transfer' => collect((array) data_get($server->server_metadata, 'transfer', []))
+                ->only(['status', 'export_id', 'imported_at', 'claimed_at', 'transferred_at', 'target_instance_url'])
+                ->all(),
+            'migration' => data_get($server->server_metadata, 'migration'),
         ]);
+    }
 
-        if ($request->boolean('encrypt') && $request->filled('passphrase')) {
-            return response()->json(
-                ServerTransferBundle::encryptWithPassphrase($bundle, $request->string('passphrase')->toString())
-            );
+    #[OA\Get(
+        summary: 'Check server import',
+        description: 'Check that this instance can import a server, before the source instance starts the transfer. It checks the token, the bundle version, the server limit, servers with the same UUID or IP, and that this instance can reach the SSH port of the server.',
+        path: '/servers/import/check',
+        operationId: 'check-server-import',
+        security: [['bearerAuth' => []]],
+        tags: ['Servers'],
+        parameters: [
+            new OA\Parameter(name: 'server_uuid', in: 'query', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'ip', in: 'query', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'port', in: 'query', required: false, schema: new OA\Schema(type: 'integer', default: 22)),
+            new OA\Parameter(name: 'schema_version', in: 'query', required: false, schema: new OA\Schema(type: 'integer')),
+            new OA\Parameter(name: 'system_github_apps[]', in: 'query', required: false, description: 'UUIDs of system-wide GitHub Apps that the server uses. The response lists the ones this instance does not have.', schema: new OA\Schema(type: 'array', items: new OA\Items(type: 'string'))),
+            new OA\Parameter(name: 'system_gitlab_apps[]', in: 'query', required: false, description: 'UUIDs of system-wide GitLab Apps that the server uses. The response lists the ones this instance does not have.', schema: new OA\Schema(type: 'array', items: new OA\Items(type: 'string'))),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'The server can be imported. Lists every check with its result.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 422, description: 'One or more checks failed. Lists every check with its result.'),
+        ]
+    )]
+    public function check(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
         }
 
-        return response()->json($bundle);
+        $this->authorize('create', Server::class);
+
+        $validator = customApiValidator($request->query(), [
+            'server_uuid' => 'required|string',
+            'ip' => ['required', 'string', new ValidServerIp],
+            'port' => 'nullable|integer|between:1,65535',
+            'schema_version' => 'nullable|integer',
+            'system_github_apps' => 'nullable|array|max:100',
+            'system_github_apps.*' => 'string|max:64',
+            'system_gitlab_apps' => 'nullable|array|max:100',
+            'system_gitlab_apps.*' => 'string|max:64',
+        ]);
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        // System-wide git sources are not transferred. Applications re-link only to one with the same uuid here.
+        $missingSystemSources = [
+            'github' => array_values(array_diff((array) $request->query('system_github_apps', []), GithubApp::query()->where('is_system_wide', true)->whereIn('uuid', (array) $request->query('system_github_apps', []))->pluck('uuid')->all())),
+            'gitlab' => array_values(array_diff((array) $request->query('system_gitlab_apps', []), GitlabApp::query()->where('is_system_wide', true)->whereIn('uuid', (array) $request->query('system_gitlab_apps', []))->pluck('uuid')->all())),
+        ];
+
+        $schemaVersion = (int) $request->query('schema_version', ServerTransferBundle::SCHEMA_VERSION);
+        $ip = trim((string) $request->query('ip'));
+        $port = (int) $request->query('port', 22);
+
+        // The target connects to the server over SSH when it takes over management, so an unreachable
+        // server would leave an imported server here that this instance cannot manage.
+        $connection = @fsockopen($ip, $port, timeout: 5);
+        if ($connection !== false) {
+            fclose($connection);
+        }
+
+        $checks = [
+            [
+                'label' => 'the transfer bundle version is supported',
+                'ok' => $schemaVersion === ServerTransferBundle::SCHEMA_VERSION,
+                'message' => $schemaVersion === ServerTransferBundle::SCHEMA_VERSION ? null
+                    : 'This instance reads transfer bundle version '.ServerTransferBundle::SCHEMA_VERSION.", but the source sends version {$schemaVersion}. Upgrade both instances to the same Coolify version.",
+            ],
+            ...collect($this->importer->importChecks((string) $request->query('server_uuid'), $ip, $teamId))
+                ->map(fn (array $check) => collect($check)->only(['label', 'ok', 'message'])->all())
+                ->all(),
+            [
+                'label' => "the target can reach the SSH port of the server ({$ip}:{$port})",
+                'ok' => $connection !== false,
+                'message' => $connection !== false ? null
+                    : "This instance cannot reach the server at {$ip}:{$port}. Allow SSH from this instance to the server, then transfer again.",
+            ],
+        ];
+
+        $failed = collect($checks)->where('ok', false);
+
+        return response()->json([
+            'message' => $failed->isEmpty()
+                ? 'This instance can import the server.'
+                : $failed->pluck('message')->implode(' '),
+            'checks' => $checks,
+            'missing_system_sources' => $missingSystemSources,
+        ], $failed->isEmpty() ? 200 : 422);
     }
 
     #[OA\Post(
@@ -193,8 +262,7 @@ class ServerTransferController extends Controller
             required: true,
             content: new OA\JsonContent(
                 properties: [
-                    new OA\Property(property: 'bundle', type: 'object', description: 'Plain or encrypted transfer bundle'),
-                    new OA\Property(property: 'passphrase', type: 'string', nullable: true),
+                    new OA\Property(property: 'bundle', type: 'object', description: 'Transfer bundle'),
                     new OA\Property(property: 'dry_run', type: 'boolean', default: false),
                     new OA\Property(property: 'preserve_uuids', type: 'boolean', default: true),
                     new OA\Property(property: 'adopt_mode', type: 'boolean', default: true, description: 'Import without forcing redeploy; keep statuses for adoption'),
@@ -224,12 +292,11 @@ class ServerTransferController extends Controller
 
         $validator = customApiValidator($request->all(), [
             'bundle' => 'required|array',
-            'passphrase' => 'string|nullable',
             'dry_run' => 'boolean|nullable',
             'preserve_uuids' => 'boolean|nullable',
             'adopt_mode' => 'boolean|nullable',
         ]);
-        $allowedFields = ['bundle', 'passphrase', 'dry_run', 'preserve_uuids', 'adopt_mode'];
+        $allowedFields = ['bundle', 'dry_run', 'preserve_uuids', 'adopt_mode'];
         $extraFields = array_diff(array_keys($request->all()), $allowedFields);
         if ($validator->fails() || $extraFields !== []) {
             $errors = $validator->errors();
@@ -243,34 +310,21 @@ class ServerTransferController extends Controller
             ], 422);
         }
 
-        $bundle = $request->input('bundle', []);
-        if (data_get($bundle, 'encrypted')) {
-            if (! $request->filled('passphrase')) {
-                return response()->json(['message' => 'Passphrase is required for encrypted bundles.'], 422);
-            }
-            try {
-                $bundle = ServerTransferBundle::decryptWithPassphrase($bundle, $request->string('passphrase')->toString());
-            } catch (Throwable $e) {
-                return response()->json(['message' => $e->getMessage()], 422);
-            }
-        }
-
         try {
             $result = $this->importer->import(
-                bundle: $bundle,
+                bundle: $request->input('bundle', []),
                 teamId: $teamId,
                 dryRun: $request->boolean('dry_run', false),
                 preserveUuids: $request->boolean('preserve_uuids', true),
                 adoptMode: $request->boolean('adopt_mode', true),
             );
         } catch (Throwable $e) {
-            $status = $e instanceof ValidationException ? 422 : 422;
             $payload = ['message' => $e->getMessage()];
             if ($e instanceof ValidationException) {
                 $payload['errors'] = $e->errors();
             }
 
-            return response()->json($payload, $status);
+            return response()->json($payload, 422);
         }
 
         auditLog('api.server.import', [
@@ -285,7 +339,7 @@ class ServerTransferController extends Controller
 
     #[OA\Post(
         summary: 'Mark server transferred',
-        description: 'Source-instance step: disable automations after a successful export/import handoff.',
+        description: 'Source-instance recovery step: disable automations here when the target already manages the server but the transfer could not finish on this instance.',
         path: '/servers/{uuid}/transfer/complete',
         operationId: 'complete-server-transfer',
         security: [['bearerAuth' => []]],
@@ -350,77 +404,6 @@ class ServerTransferController extends Controller
         return response()->json($result);
     }
 
-    #[OA\Post(
-        summary: 'Write transfer bundle to server mailbox',
-        description: 'Write an export bundle to /data/coolify/exports on the managed host for air-gapped import.',
-        path: '/servers/{uuid}/export/mailbox',
-        operationId: 'export-server-transfer-mailbox',
-        security: [['bearerAuth' => []]],
-        tags: ['Servers'],
-        parameters: [
-            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
-        ],
-        requestBody: new OA\RequestBody(
-            content: new OA\JsonContent(
-                properties: [
-                    new OA\Property(property: 'passphrase', type: 'string', nullable: true),
-                ]
-            )
-        ),
-        responses: [
-            new OA\Response(response: 200, description: 'Mailbox write result'),
-            new OA\Response(response: 403, description: 'Missing sensitive permission'),
-            new OA\Response(response: 404, ref: '#/components/responses/404'),
-        ]
-    )]
-    public function writeMailbox(Request $request, string $uuid): JsonResponse
-    {
-        $teamId = getTeamIdFromToken();
-        if (is_null($teamId)) {
-            return invalidTokenResponse();
-        }
-
-        if (! $this->canReadSensitive($request)) {
-            return response()->json([
-                'message' => 'Writing a transfer mailbox requires read:sensitive (or root) ability and an admin/owner team role.',
-            ], 403);
-        }
-
-        $server = Server::whereTeamId($teamId)->whereUuid($uuid)->first();
-        if (! $server) {
-            return response()->json(['message' => 'Server not found.'], 404);
-        }
-
-        $this->authorize('view', $server);
-
-        try {
-            $bundle = $this->exporter->export($server, includeSensitive: true);
-            $result = $this->claimer->writeMailbox(
-                $server,
-                $bundle,
-                $request->filled('passphrase') ? $request->string('passphrase')->toString() : null,
-            );
-        } catch (Throwable $e) {
-            return response()->json(['message' => $e->getMessage()], 422);
-        }
-
-        auditLog('api.server.export_mailbox', [
-            'team_id' => $teamId,
-            'server_uuid' => $server->uuid,
-            'export_id' => data_get($bundle, 'export_id'),
-            'path' => $result['path'],
-        ]);
-
-        return response()->json([
-            'export_id' => data_get($bundle, 'export_id'),
-            'path' => $result['path'],
-            'written' => $result['written'],
-            'message' => $result['written']
-                ? 'Transfer bundle written to server mailbox.'
-                : 'Failed to write mailbox on remote host.',
-        ], $result['written'] ? 200 : 422);
-    }
-
     private function canReadSensitive(Request $request): bool
     {
         return (bool) $request->attributes->get('can_read_sensitive', false);
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index c858c1bc8c..0a86606518 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -210,6 +210,7 @@ class ServicesController extends Controller
 
             $application->fqdn = $containerUrls;
             $application->save();
+            updateCompose($application);
         });
 
         if (! empty($errors)) {
@@ -308,6 +309,7 @@ class ServicesController extends Controller
                         'destination_uuid' => ['type' => 'string', 'description' => 'Destination UUID. Required if server has multiple destinations.'],
                         'instant_deploy' => ['type' => 'boolean', 'default' => false, 'description' => 'Start the service immediately after creation.'],
                         'docker_compose_raw' => ['type' => 'string', 'description' => 'The base64 encoded Docker Compose content.'],
+                        'connect_to_docker_network' => ['type' => 'boolean', 'default' => false, 'description' => 'Connect the service to the predefined docker network.'],
                         'urls' => [
                             'type' => 'array',
                             'description' => 'Array of URLs to be applied to containers of a service.',
@@ -389,7 +391,7 @@ class ServicesController extends Controller
     )]
     public function create_service(Request $request)
     {
-        $allowedFields = ['type', 'name', 'description', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'docker_compose_raw', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'redact_all_env_values_in_logs', 'tags'];
+        $allowedFields = ['type', 'name', 'description', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'docker_compose_raw', 'connect_to_docker_network', 'urls', 'force_domain_override', 'is_container_label_escape_enabled', 'redact_all_env_values_in_logs', 'tags'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -417,6 +419,7 @@ class ServicesController extends Controller
             'name' => 'string|max:255',
             'description' => 'string|nullable',
             'instant_deploy' => 'boolean',
+            'connect_to_docker_network' => 'boolean',
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
@@ -546,7 +549,7 @@ class ServicesController extends Controller
                     'destination_id' => $destination->id,
                     'destination_type' => $destination->getMorphClass(),
                 ];
-                if (in_array($oneClickServiceName, NEEDS_TO_CONNECT_TO_PREDEFINED_NETWORK)) {
+                if (in_array($oneClickServiceName, NEEDS_TO_CONNECT_TO_PREDEFINED_NETWORK) || $request->boolean('connect_to_docker_network')) {
                     data_set($servicePayload, 'connect_to_docker_network', true);
                 }
                 $service = new Service($servicePayload);
diff --git a/app/Http/Controllers/FileBrowserDownloadController.php b/app/Http/Controllers/FileBrowserDownloadController.php
new file mode 100644
index 0000000000..17bed2392e
--- /dev/null
+++ b/app/Http/Controllers/FileBrowserDownloadController.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Server;
+use App\Services\ContainerFilesystemService;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Gate;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+/**
+ * Streams a file browser download straight from the container to the browser.
+ * Livewire download responses are buffered in memory and base64-encoded, so
+ * FileBrowser::download() issues a one-time token and redirects here instead.
+ */
+class FileBrowserDownloadController extends Controller
+{
+    public const TOKEN_TTL_SECONDS = 60;
+
+    public static function cacheKey(string $token): string
+    {
+        return 'file-browser-download:'.$token;
+    }
+
+    public function __invoke(string $token): StreamedResponse
+    {
+        /** @var array{user_id:int,resource_type:class-string,resource_id:int,server_id:int,container:string,path:string,name:string,is_dir:bool}|null $download */
+        $download = Cache::pull(self::cacheKey($token));
+        abort_unless(is_array($download) && $download['user_id'] === auth()->id(), 404);
+
+        Gate::authorize('canAccessTerminal');
+        $resource = $download['resource_type']::findOrFail($download['resource_id']);
+        Gate::authorize('view', $resource);
+        abort_unless((int) $resource->environment->project->team_id === (int) auth()->user()->currentTeam()->id, 403);
+
+        $filesystem = new ContainerFilesystemService(Server::findOrFail($download['server_id']), $download['container']);
+
+        return response()->streamDownload(function () use ($filesystem, $download) {
+            set_time_limit(0);
+            $filesystem->streamDownload($download['path'], $download['is_dir'], function (string $chunk) {
+                echo $chunk;
+                if (ob_get_level() > 0) {
+                    ob_flush();
+                }
+                flush();
+            });
+        }, $download['name'], [
+            'Content-Type' => 'application/octet-stream',
+            // Stop nginx from buffering the response to a temp file on the Coolify host.
+            'X-Accel-Buffering' => 'no',
+        ]);
+    }
+}
diff --git a/app/Http/Controllers/Webhook/Bitbucket.php b/app/Http/Controllers/Webhook/Bitbucket.php
index e06a14e0bf..3138d168a3 100644
--- a/app/Http/Controllers/Webhook/Bitbucket.php
+++ b/app/Http/Controllers/Webhook/Bitbucket.php
@@ -11,6 +11,7 @@ use App\Http\Controllers\Webhook\Concerns\ReadsWebhookPushPayload;
 use App\Http\Controllers\Webhook\Concerns\ValidatesPreviewDeploymentRepository;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Request;
 
@@ -84,7 +85,11 @@ class Bitbucket extends Controller
             $failure_key = $this->manualWebhookFailureRateLimitKey($request, 'bitbucket', $full_name, $branch);
             // A redelivery of the same signed payload is one guess.
             $failure_attempt = $this->manualWebhookSignedPayloadAttempt($request, $x_bitbucket_token);
-            $applications = $this->manualWebhookApplications(Application::query()->where('git_branch', $branch), $full_name);
+            $applications = Application::query();
+            if ($x_bitbucket_event !== 'pullrequest:rejected' && $x_bitbucket_event !== 'pullrequest:fulfilled') {
+                $applications->where('git_branch', $branch);
+            }
+            $applications = $this->manualWebhookApplications($applications, $full_name);
             if ($applications->isEmpty()) {
                 return $this->unauthenticatedManualWebhookResponse($failure_key, $failure_attempt);
             }
@@ -128,6 +133,7 @@ class Bitbucket extends Controller
 
                     continue;
                 }
+                TransferFinishChecklist::recordWebhook('application', $application->uuid);
                 $isFunctional = $application->destination->server->isFunctional();
                 if (! $isFunctional) {
                     $return_payloads->push([
diff --git a/app/Http/Controllers/Webhook/Gitea.php b/app/Http/Controllers/Webhook/Gitea.php
index b3c0b22a48..05ceebeabd 100644
--- a/app/Http/Controllers/Webhook/Gitea.php
+++ b/app/Http/Controllers/Webhook/Gitea.php
@@ -11,6 +11,7 @@ use App\Http\Controllers\Webhook\Concerns\ReadsWebhookPushPayload;
 use App\Http\Controllers\Webhook\Concerns\ValidatesPreviewDeploymentRepository;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -84,7 +85,10 @@ class Gitea extends Controller
                 }
             }
             if ($x_gitea_event === 'pull_request') {
-                $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $this->manualWebhookApplications($applications, $full_name);
                 if ($applications->isEmpty()) {
                     return $this->unauthenticatedManualWebhookResponse($failure_key, $failure_attempt);
                 }
@@ -114,6 +118,7 @@ class Gitea extends Controller
 
                     continue;
                 }
+                TransferFinishChecklist::recordWebhook('application', $application->uuid);
                 $isFunctional = $application->destination->server->isFunctional();
                 if (! $isFunctional) {
                     $return_payloads->push([
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index ba270cf688..e615abd3c6 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -19,6 +19,7 @@ use App\Models\GithubRunnerExecution;
 use App\Models\PrivateKey;
 use App\Services\GithubRunner\GithubRunnerApi;
 use App\Services\GithubRunner\GithubRunnerContainer;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Exceptions\HttpResponseException;
 use Illuminate\Http\RedirectResponse;
@@ -71,7 +72,6 @@ class Github extends Controller
                     'before_sha' => $before_sha,
                     'after_sha' => $after_sha,
                     'commit_sha' => $commit_sha,
-                    'author_association' => $author_association,
                     'is_fork_pull_request' => $is_fork_pull_request,
                 ] = $this->readPullRequestPayload($payload);
                 $full_name = data_get($payload, 'repository.full_name');
@@ -136,6 +136,7 @@ class Github extends Controller
 
                         continue;
                     }
+                    TransferFinishChecklist::recordWebhook('application', $application->uuid);
                     $isFunctional = $application->destination->server->isFunctional();
                     if (! $isFunctional) {
                         $return_payloads->push([
@@ -239,7 +240,6 @@ class Github extends Controller
                             beforeSha: $before_sha,
                             afterSha: $after_sha,
                             commitSha: $commit_sha,
-                            authorAssociation: $author_association,
                             fullName: $full_name,
                             isForkPullRequest: $is_fork_pull_request,
                         );
@@ -400,7 +400,12 @@ class Github extends Controller
                 // Just pong
                 return response('pong');
             }
-            $github_app = GithubApp::where('app_id', $x_github_hook_installation_target_id)->first();
+            // One GitHub App can be installed on several accounts, each added as its own source.
+            $installation_id = data_get($payload, 'installation.id');
+            $github_app = is_numeric($installation_id)
+                ? GithubApp::where('app_id', $x_github_hook_installation_target_id)->where('installation_id', (int) $installation_id)->first()
+                : null;
+            $github_app ??= GithubApp::where('app_id', $x_github_hook_installation_target_id)->first();
             if (is_null($github_app)) {
                 return response('Nothing to do. No GitHub App found.');
             }
@@ -428,6 +433,7 @@ class Github extends Controller
                     return response('Invalid signature.');
                 }
             }
+            TransferFinishChecklist::recordWebhook('github_app', $github_app->uuid);
             if ($x_github_event === 'installation' || $x_github_event === 'installation_repositories') {
                 // Installation handled by setup redirect url. Repositories queried on-demand.
                 $action = data_get($payload, 'action');
@@ -459,7 +465,6 @@ class Github extends Controller
                     'before_sha' => $before_sha,
                     'after_sha' => $after_sha,
                     'commit_sha' => $commit_sha,
-                    'author_association' => $author_association,
                     'is_fork_pull_request' => $is_fork_pull_request,
                 ] = $this->readPullRequestPayload($payload);
                 $full_name = $this->manualWebhookRepositoryFullName(data_get($payload, 'repository.full_name'));
@@ -484,6 +489,9 @@ class Github extends Controller
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found with branch '$branch'.");
                 }
+                if ($applications->contains(fn (Application $application): bool => filled($application->watch_paths))) {
+                    $changed_files = $this->githubPushComparedFiles($github_app, $payload) ?? $changed_files;
+                }
             }
             if ($x_github_event === 'pull_request') {
                 if ($action !== 'closed') {
@@ -598,7 +606,6 @@ class Github extends Controller
                             beforeSha: $before_sha,
                             afterSha: $after_sha,
                             commitSha: $commit_sha,
-                            authorAssociation: $author_association,
                             fullName: $full_name,
                             isForkPullRequest: $is_fork_pull_request,
                         );
@@ -620,10 +627,39 @@ class Github extends Controller
         }
     }
 
+    /**
+     * Files that the push changes between its before and after commits, from
+     * the GitHub compare API.
+     *
+     * The file lists of the pushed commits are not the net change: a merge
+     * commit names the files that it changes relative to its first parent,
+     * also when the push does not change them. Returns null for a new branch,
+     * a missing repository name or an API failure; the caller then uses the
+     * file lists of the pushed commits.
+     *
+     * @return Collection<int, string>|null
+     *
+     * @throws InvalidWebhookPayloadException When the before or after value is not a commit SHA.
+     */
+    private function githubPushComparedFiles(GithubApp $githubApp, mixed $payload): ?Collection
+    {
+        $before = $this->webhookCommitSha($payload, 'before');
+        $after = $this->webhookCommitSha($payload, 'after');
+        $fullName = $this->manualWebhookRepositoryFullName(data_get($payload, 'repository.full_name'));
+        if ($before === null || $after === null || $fullName === null || preg_match('/\A0+\z/', $before) === 1) {
+            return null;
+        }
+
+        [$owner, $repo] = explode('/', $fullName, 2);
+        $files = getGithubCommitRangeFiles($githubApp, $owner, $repo, $before, $after);
+
+        return $files === null ? null : collect($files);
+    }
+
     /**
      * Read and validate the pull_request payload fields that the handlers use.
      *
-     * @return array{action: string, pull_request_id: int, pull_request_html_url: string, pull_request_title: ?string, branch: ?string, base_branch: ?string, before_sha: ?string, after_sha: ?string, commit_sha: string, author_association: ?string, is_fork_pull_request: bool}
+     * @return array{action: string, pull_request_id: int, pull_request_html_url: string, pull_request_title: ?string, branch: ?string, base_branch: ?string, before_sha: ?string, after_sha: ?string, commit_sha: string, is_fork_pull_request: bool}
      *
      * @throws InvalidWebhookPayloadException When a field has a wrong type or format.
      */
@@ -641,7 +677,6 @@ class Github extends Controller
             'before_sha' => $this->webhookCommitSha($payload, 'before'),
             'after_sha' => $this->webhookCommitSha($payload, 'after') ?? $head_sha,
             'commit_sha' => $head_sha ?? 'HEAD',
-            'author_association' => $this->webhookPayloadString($payload, 'pull_request.author_association'),
             'is_fork_pull_request' => $this->isForkPullRequest($payload),
         ];
     }
@@ -649,13 +684,15 @@ class Github extends Controller
     /**
      * Determine whether a pull_request webhook payload originates from a fork.
      *
-     * GitHub's `author_association` is not a reliable trust signal (it grants
-     * CONTRIBUTOR to anyone who has merely opened an issue/PR before), so fork
-     * detection is gated on whether the PR crosses repository boundaries.
+     * A same-repository PR branch can only be pushed by users with write access,
+     * so this is the trust signal for preview deployments. GitHub's
+     * `author_association` is not reliable for this: users with access through a
+     * team or a private organization membership arrive as CONTRIBUTOR or NONE.
      *
      * The repository id comparison is the canonical signal; the `head.repo.fork`
      * flag and a case-insensitive full_name comparison are fallbacks for payloads
-     * where the ids are unavailable (e.g. a deleted head repository).
+     * where the ids are unavailable. A PR whose head repository is unknown (e.g.
+     * a deleted fork) is treated as a fork.
      *
      * @throws InvalidWebhookPayloadException When a repository id is not a positive integer.
      */
@@ -679,7 +716,7 @@ class Github extends Controller
             return Str::lower($headRepoFullName) !== Str::lower($baseRepoFullName);
         }
 
-        return false;
+        return true;
     }
 
     public function redirect(Request $request)
diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index c135aef328..892408976d 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -13,8 +13,10 @@ use App\Livewire\Source\Gitlab\Change as GitlabSource;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\GitlabApp;
+use App\Services\ServerTransfer\TransferFinishChecklist;
 use Exception;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 
@@ -84,6 +86,9 @@ class Gitlab extends Controller
         try {
             $return_payloads = collect([]);
             $payload = $request->collect();
+            if ($request->header('X-Gitlab-Event') === 'System Hook') {
+                $payload = $this->normalizeSystemHookPayload($payload);
+            }
             $x_gitlab_token = $request->header('X-Gitlab-Token');
             $object_kind = $this->webhookString(data_get($payload, 'object_kind'));
 
@@ -118,6 +123,7 @@ class Gitlab extends Controller
                 ], 401);
             }
 
+            TransferFinishChecklist::recordWebhook('gitlab_app', $gitlab_app->uuid);
             $project_id = $this->webhookPayloadDatabaseId($payload, 'project.id', required: true);
             $applications = Application::where('source_id', $gitlab_app->id)
                 ->where('source_type', GitlabApp::class)
@@ -231,7 +237,10 @@ class Gitlab extends Controller
                     'skip_deploy' => $skip_deploy_pr,
                 ] = $this->readMergeRequestPayload($payload);
 
-                $applications = $applications->where('git_branch', $base_branch)->get();
+                if (! in_array($action, ['closed', 'close', 'merge'])) {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $applications->get();
 
                 foreach ($applications as $application) {
                     if (! $application->destination->server->isFunctional()) {
@@ -440,7 +449,10 @@ class Gitlab extends Controller
                 }
             }
             if ($x_gitlab_event === 'merge_request') {
-                $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
+                if (! in_array($action, ['closed', 'close', 'merge'])) {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $this->manualWebhookApplications($applications, $full_name);
                 if ($applications->isEmpty()) {
                     return $this->unauthenticatedManualWebhookResponse($failure_key, $failure_attempt);
                 }
@@ -469,6 +481,7 @@ class Gitlab extends Controller
 
                     continue;
                 }
+                TransferFinishChecklist::recordWebhook('application', $application->uuid);
                 $isFunctional = $application->destination->server->isFunctional();
                 if (! $isFunctional) {
                     $return_payloads->push([
@@ -661,6 +674,30 @@ class Gitlab extends Controller
         }
     }
 
+    /**
+     * Give a system hook payload the project webhook shape. Current GitLab sends
+     * the project webhook data to system hooks, but the documented push payload
+     * has only `event_name` and a top-level `project_id`.
+     *
+     * @see https://docs.gitlab.com/administration/system_hooks/#push-events
+     *
+     * @param  Collection<string, mixed>  $payload
+     * @return Collection<string, mixed>
+     */
+    private function normalizeSystemHookPayload(Collection $payload): Collection
+    {
+        if (! $payload->has('object_kind') && $payload->has('event_name')) {
+            $payload->put('object_kind', $payload->get('event_name'));
+        }
+
+        $project = $payload->get('project');
+        if (is_array($project) && ! array_key_exists('id', $project) && $payload->has('project_id')) {
+            $payload->put('project', ['id' => $payload->get('project_id')] + $project);
+        }
+
+        return $payload;
+    }
+
     /**
      * Read and validate the merge_request payload fields that the handlers use.
      *
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 2e6c36b722..48710f88fe 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -16,6 +16,7 @@ use App\Http\Middleware\EncryptCookies;
 use App\Http\Middleware\EnsureMcpEnabled;
 use App\Http\Middleware\EnsureTeamMcpEnabled;
 use App\Http\Middleware\EnsureTokenBelongsToCurrentTeamMember;
+use App\Http\Middleware\KeepConcurrentTeamSwitch;
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\RequirePassword;
@@ -73,6 +74,7 @@ class Kernel extends HttpKernel
             EncryptCookies::class,
             AddQueuedCookiesToResponse::class,
             StartSession::class,
+            KeepConcurrentTeamSwitch::class,
             ShareErrorsFromSession::class,
             VerifyCsrfToken::class,
             SubstituteBindings::class,
diff --git a/app/Http/Middleware/ApiIpAllowed.php b/app/Http/Middleware/ApiIpAllowed.php
index da2d009576..ede32567d0 100644
--- a/app/Http/Middleware/ApiIpAllowed.php
+++ b/app/Http/Middleware/ApiIpAllowed.php
@@ -14,13 +14,9 @@ class ApiIpAllowed
             return $next($request);
         }
 
-        $allowedIps = instanceSettings()->allowed_ips;
-        if (! $allowedIps) {
-            return $next($request);
-        }
-
-        // Check for special case: 0.0.0.0 means allow all
-        if (trim($allowedIps) === '0.0.0.0') {
+        $allowedIps = trim((string) instanceSettings()->allowed_ips);
+        // Empty or 0.0.0.0 means allow all
+        if ($allowedIps === '' || $allowedIps === '0.0.0.0') {
             return $next($request);
         }
 
diff --git a/app/Http/Middleware/KeepConcurrentTeamSwitch.php b/app/Http/Middleware/KeepConcurrentTeamSwitch.php
new file mode 100644
index 0000000000..7f9a796ade
--- /dev/null
+++ b/app/Http/Middleware/KeepConcurrentTeamSwitch.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Laravel writes the whole session payload at the end of every request. A request
+ * that started before a team switch (for example a wire:poll update) would write the
+ * previous team back into the session, and the next request would make it permanent.
+ * When this request did not change the team itself, keep the team that is stored now.
+ */
+class KeepConcurrentTeamSwitch
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $teamIdAtStart = data_get($request->session()->get('currentTeam'), 'id');
+
+        $response = $next($request);
+
+        $session = $request->session();
+        if (data_get($session->get('currentTeam'), 'id') !== $teamIdAtStart) {
+            return $response;
+        }
+
+        $storedSession = clone $session;
+        $storedSession->start();
+        $storedTeam = $storedSession->get('currentTeam');
+        if ($storedTeam && data_get($storedTeam, 'id') !== $teamIdAtStart) {
+            $session->put('currentTeam', $storedTeam);
+        }
+
+        return $response;
+    }
+}
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 710dcb823c..ec95267419 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -260,6 +260,8 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $source = data_get($this->application, 'source');
         if ($source) {
             $this->source = $source->getMorphClass()::where('id', $this->application->source->id)->first();
+            // Share one source instance so the job reuses its in-memory GitHub installation token.
+            $this->application->setRelation('source', $this->source);
         }
         $this->server = Server::find($this->application_deployment_queue->server_id);
         $this->timeout = $this->server->settings->dynamic_timeout;
@@ -975,18 +977,35 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         return $composeFile;
     }
 
+    /**
+     * Pulls the registry images of the Compose services before the current deployment stops. Images that
+     * this deployment builds are not pulled: a pull fails for an image that is only local, and a pull of
+     * an image that is also in a registry replaces the new build with the old registry image.
+     */
     private function pull_docker_compose_images(): void
     {
+        if ($this->docker_compose_custom_build_command && ! $this->use_build_server) {
+            $this->application_deployment_queue->addLogEntry('Skipping the image pull before stopping the current deployment, because the custom build command can build images outside of Docker Compose.');
+
+            return;
+        }
+
+        $services = $this->registry_image_compose_services();
+        if ($services->isEmpty()) {
+            return;
+        }
+
         $this->application_deployment_queue->addLogEntry('Pulling image-based services before stopping the current deployment.');
 
+        $services = $services->map(fn (string $service) => escapeshellarg($service))->implode(' ');
         if ($this->use_build_server) {
             $this->write_deployment_configurations();
             $this->server = $this->mainServer;
             $workdir = $this->application->workdir();
-            $command = "{$this->coolify_variables} docker compose --env-file {$workdir}/.env --project-name {$this->application->uuid} --project-directory {$workdir} -f {$workdir}{$this->docker_compose_location} pull --ignore-buildable";
+            $command = "{$this->coolify_variables} docker compose --env-file {$workdir}/.env --project-name {$this->application->uuid} --project-directory {$workdir} -f {$workdir}{$this->docker_compose_location} pull --ignore-buildable {$services}";
         } else {
             $workdir = $this->workdir;
-            $command = executeInDocker($this->deployment_uuid, "{$this->coolify_variables} docker compose --env-file {$workdir}/.env --project-name {$this->application->uuid} --project-directory {$workdir} -f {$workdir}{$this->docker_compose_location} pull --ignore-buildable");
+            $command = executeInDocker($this->deployment_uuid, "{$this->coolify_variables} docker compose --env-file {$workdir}/.env --project-name {$this->application->uuid} --project-directory {$workdir} -f {$workdir}{$this->docker_compose_location} pull --ignore-buildable {$services}");
         }
 
         $this->execute_remote_command([
@@ -995,6 +1014,26 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         ]);
     }
 
+    /**
+     * Returns the names of the Compose services that get their image from a registry. A service with a
+     * `build` section, or a service that uses the image of such a service, gets its image from the build.
+     *
+     * @return Collection<int, string>
+     */
+    private function registry_image_compose_services(): Collection
+    {
+        $services = collect(data_get(Yaml::parse($this->generated_docker_compose), 'services', []));
+        $builtImages = $services->filter(fn ($service) => filled(data_get($service, 'build')))->pluck('image')->filter();
+
+        return $services
+            ->filter(fn ($service) => filled(data_get($service, 'image'))
+                && blank(data_get($service, 'build'))
+                && ! $builtImages->contains(data_get($service, 'image')))
+            ->keys()
+            ->map(fn ($service) => (string) $service)
+            ->values();
+    }
+
     /**
      * Starts the Compose containers. Content files are written first, because `docker compose up`
      * creates a missing bind source as an empty directory.
@@ -1711,7 +1750,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $ports = $this->application->main_port();
         $coolify_envs = $this->generate_coolify_env_variables();
         $coolify_envs->each(function ($item, $key) use ($envs) {
-            $envs->push($key.'='.$item);
+            $envs->push($key.'='.escapeComposeEnvFileValue($item));
         });
         if ($this->pull_request_id === 0) {
             // Generate SERVICE_ variables first for dockercompose
@@ -3189,13 +3228,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private function clone_repository()
     {
-        $importCommands = $this->generate_git_import_commands();
         $this->application_deployment_queue->addLogEntry("\n----------------------------------------");
         $this->application_deployment_queue->addLogEntry("Importing {$this->customRepository}:{$this->application->git_branch} (commit sha {$this->commit}) to {$this->basedir}.");
         if ($this->pull_request_id !== 0) {
             $this->application_deployment_queue->addLogEntry("Checking out tag pull/{$this->pull_request_id}/head.");
         }
-        $this->execute_remote_command(...$this->gitCommandDefinitions($importCommands));
+        $this->import_repository();
         $this->create_workdir();
         $this->execute_remote_command(
             [
@@ -3213,6 +3251,37 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * SSH exits with 255 when the connection drops, which can happen during a long clone. Git exits with
+     * 128 for its own errors, so only 255 is retried. The interrupted clone can still run in the helper
+     * container, so stop it and remove the partial checkout before cloning again.
+     */
+    private function import_repository(): void
+    {
+        $maxAttempts = config('constants.ssh.max_retries');
+
+        for ($attempt = 1; ; $attempt++) {
+            try {
+                $this->execute_remote_command(...$this->gitCommandDefinitions($this->generate_git_import_commands()));
+
+                return;
+            } catch (DeploymentException $e) {
+                if ($e->getCode() !== 255 || $attempt >= $maxAttempts) {
+                    throw $e;
+                }
+
+                $delay = $this->calculateRetryDelay($attempt - 1);
+                $this->application_deployment_queue->addLogEntry('Lost the SSH connection while importing the repository. Retrying in '.$delay.'s (attempt '.($attempt + 1)."/{$maxAttempts}).", 'stderr');
+                Sleep::for($delay)->seconds();
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, 'pkill git; rm -rf '.escapeshellarg($this->basedir)),
+                    'hidden' => true,
+                    'ignore_errors' => true,
+                ]);
+            }
+        }
+    }
+
     private function generate_git_import_commands()
     {
         ['commands' => $commands, 'branch' => $this->branch, 'fullRepoUrl' => $this->fullRepoUrl] = $this->application->generateGitImportCommands(
@@ -3910,7 +3979,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 }
             }
 
-            add_coolify_default_environment_variables($this->application, $coolify_envs, $this->application->environment_variables_preview);
+            // Runtime only, so a project or server change does not break the Docker build cache
+            if (! $forBuildTime) {
+                $coolify_envs = $coolify_envs->merge(coolifyDefaultEnvironmentVariables($this->application, $this->application->environment_variables_preview->pluck('key'), $this->mainServer));
+            }
 
         } else {
             // Only add SOURCE_COMMIT for runtime OR when explicitly enabled for build-time
@@ -3954,7 +4026,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 }
             }
 
-            add_coolify_default_environment_variables($this->application, $coolify_envs, $this->application->environment_variables);
+            // Runtime only, so a project or server change does not break the Docker build cache
+            if (! $forBuildTime) {
+                $coolify_envs = $coolify_envs->merge(coolifyDefaultEnvironmentVariables($this->application, $this->application->environment_variables->pluck('key'), $this->mainServer));
+            }
 
         }
 
diff --git a/app/Jobs/CheckHelperImageJob.php b/app/Jobs/CheckHelperImageJob.php
index 6d76da8eb7..56118a238a 100644
--- a/app/Jobs/CheckHelperImageJob.php
+++ b/app/Jobs/CheckHelperImageJob.php
@@ -9,6 +9,7 @@ use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
 
 class CheckHelperImageJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -20,20 +21,18 @@ class CheckHelperImageJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle(): void
     {
-        try {
-            $response = Http::retry(3, 1000)->get(config('constants.coolify.versions_url'));
-            if ($response->successful()) {
-                $versions = $response->json();
-                $settings = instanceSettings();
-                $latest_version = data_get($versions, 'coolify.helper.version');
-                $current_version = $settings->helper_version;
-                if (version_compare($latest_version, $current_version, '>')) {
-                    $settings->update(['helper_version' => $latest_version]);
-                }
-            }
-        } catch (\Throwable $e) {
-            send_internal_notification('CheckHelperImageJob failed with: '.$e->getMessage());
-            throw $e;
+        $response = Http::retry(3, 1000, throw: false)->get(config('constants.coolify.versions_url'));
+        if ($response->failed()) {
+            // The CDN can be briefly unavailable. The next scheduled run tries again, so do not notify.
+            Log::warning('CheckHelperImageJob could not fetch versions', ['status' => $response->status()]);
+
+            return;
+        }
+
+        $latest_version = data_get($response->json(), 'coolify.helper.version');
+        $settings = instanceSettings();
+        if (version_compare($latest_version, $settings->helper_version, '>')) {
+            $settings->update(['helper_version' => $latest_version]);
         }
     }
 }
diff --git a/app/Jobs/CheckTransferFinishStepsJob.php b/app/Jobs/CheckTransferFinishStepsJob.php
new file mode 100644
index 0000000000..ebd47f5871
--- /dev/null
+++ b/app/Jobs/CheckTransferFinishStepsJob.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * Checks the open steps of the "Finish the transfer" list in the background, so the page stays fast while
+ * checks call SSH, GitHub, Cloudflare, DNS, and S3. One run per server at a time.
+ */
+class CheckTransferFinishStepsJob implements ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 120;
+
+    public int $uniqueFor = 120;
+
+    public function __construct(public Server $server) {}
+
+    public function uniqueId(): string
+    {
+        return (string) $this->server->id;
+    }
+
+    public function handle(TransferFinishChecklist $checklist): void
+    {
+        $checklist->checkAll($this->server);
+    }
+}
diff --git a/app/Jobs/CleanupGithubRunnerJob.php b/app/Jobs/CleanupGithubRunnerJob.php
index baca8504f0..2caf75f505 100644
--- a/app/Jobs/CleanupGithubRunnerJob.php
+++ b/app/Jobs/CleanupGithubRunnerJob.php
@@ -36,6 +36,14 @@ class CleanupGithubRunnerJob implements ShouldQueue
             return;
         }
 
+        // Another Coolify instance manages a transferred server and its runners: never touch them from here.
+        if ($execution->server?->isTransferredAway()) {
+            Log::info('Skipped GitHub runner cleanup: the server was transferred to another instance', ['execution' => $execution->uuid]);
+            ProvisionGithubRunnerJob::dispatchQueued($execution->github_app_id);
+
+            return;
+        }
+
         if ($execution->server) {
             instant_remote_process(GithubRunnerContainer::cleanupCommands($execution->uuid), $execution->server, false);
         }
diff --git a/app/Jobs/CleanupStaleMultiplexedConnections.php b/app/Jobs/CleanupStaleMultiplexedConnections.php
index 69e151d24f..3162ae9c41 100644
--- a/app/Jobs/CleanupStaleMultiplexedConnections.php
+++ b/app/Jobs/CleanupStaleMultiplexedConnections.php
@@ -28,8 +28,14 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
     /**
      * Kill backgrounded ssh master processes that lost the ControlPath socket
      * race. Such processes are not masters, so ControlPersist never reaps them
-     * and they leak memory until the container restarts. A legitimate master
-     * always owns its socket file; an orphan has none.
+     * and they hold an authenticated session until the container restarts.
+     *
+     * Every `ssh -fN` for a server carries the same ControlPath, so the socket
+     * file existing says nothing about which process owns it. Ownership is read
+     * from the socket itself (`ssh -O check` reports the master pid); every
+     * other process for that ControlPath is an orphan. When the socket file is
+     * missing, no process owns it. When it exists but does not answer, the
+     * owner is unknown and nothing is reaped.
      *
      * Processes younger than the minimum age are skipped: a freshly forked
      * master creates its socket a few milliseconds after starting, so a young
@@ -39,6 +45,7 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
     {
         $muxDir = storage_path('app/ssh/mux');
         $minAge = (int) config('constants.ssh.mux_orphan_min_age');
+        $socketOwners = [];
 
         foreach ($this->listProcesses() as $process) {
             // Backgrounded ssh master: current `ssh -fN` or legacy `ssh -fNM`.
@@ -51,20 +58,44 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
                 continue;
             }
 
-            if ($process['etimes'] >= $minAge
-                && ! file_exists($pathMatch[1])
-                && ! SshMultiplexingHelper::isMuxProcessRetiring($process['pid'], $pathMatch[1])) {
+            $muxSocket = $pathMatch[1];
+            if ($process['etimes'] < $minAge
+                || SshMultiplexingHelper::isMuxProcessRetiring($process['pid'], $muxSocket)) {
+                continue;
+            }
+
+            $socketOwners[$muxSocket] ??= $this->muxSocketOwner($muxSocket);
+            if ($socketOwners[$muxSocket] !== false && $socketOwners[$muxSocket] !== $process['pid']) {
                 $this->reapOrphan('ssh', $process);
             }
         }
     }
 
+    /**
+     * Pid of the master that owns a mux socket. Returns null when the socket
+     * file does not exist, and false when it exists but its owner is unknown.
+     */
+    private function muxSocketOwner(string $muxSocket): string|false|null
+    {
+        if (! file_exists($muxSocket)) {
+            return null;
+        }
+
+        $check = Process::run('timeout 10 ssh -O check -o ControlPath='.escapeshellarg($muxSocket).' localhost');
+
+        return preg_match('/pid=(\d+)/', $check->output().$check->errorOutput(), $matches)
+            ? $matches[1]
+            : false;
+    }
+
     /**
      * Kill orphaned `cloudflared access ssh` proxy processes. Each is spawned
      * as the SSH ProxyCommand transport for a Cloudflare Tunnel server and must
      * die with its parent ssh. When that ssh is killed or orphaned (e.g. a lost
      * mux master), the cloudflared process can leak and accumulate. A legitimate
-     * proxy always has a live ssh parent; one without is safe to reap.
+     * proxy always has a live ssh at the other end of its stdin pipe. Its parent
+     * is not enough: `ssh -f` forks after connecting, so the proxy of a live
+     * master is reparented away from ssh.
      *
      * Processes younger than the minimum age are skipped so a proxy whose parent
      * ssh is still starting up, or a transient `ssh -O check` proxy mid-exit, is
@@ -84,22 +115,49 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
         }
 
         foreach ($processes as $process) {
-            // `cloudflared access ssh`, never the `cloudflared tunnel` daemon.
-            if (! str_contains($process['args'], 'cloudflared access ssh')) {
+            // `cloudflared access ssh`, never the `cloudflared tunnel` daemon, nor
+            // an ssh whose ProxyCommand option contains the same words.
+            if (isset($sshPids[$process['pid']]) || ! str_contains($process['args'], 'cloudflared access ssh')) {
                 continue;
             }
 
-            // Orphaned when no live ssh process is its parent.
-            if ($process['etimes'] >= $minAge && ! isset($sshPids[$process['ppid']])) {
+            if ($process['etimes'] >= $minAge
+                && ! isset($sshPids[$process['ppid']])
+                && ! $this->stdinPipeHeldByAny($process['pid'], array_keys($sshPids))) {
                 $this->reapOrphan('cloudflared', $process);
             }
         }
     }
 
     /**
-     * Reap a detected orphan process. When orphan reaping is disabled (the
-     * default), the orphan is only logged — a dry-run mode that lets operators
-     * verify what would be killed before enabling it for real.
+     * Whether one of the given processes holds the other end of a process's
+     * stdin pipe. An unreadable stdin counts as held, so it is never reaped.
+     *
+     * @param  list<int|string>  $holderPids
+     */
+    private function stdinPipeHeldByAny(string $pid, array $holderPids): bool
+    {
+        $stdin = @readlink("/proc/{$pid}/fd/0");
+        if ($stdin === false || ! str_starts_with($stdin, 'pipe:')) {
+            return true;
+        }
+
+        foreach ($holderPids as $holderPid) {
+            foreach (glob("/proc/{$holderPid}/fd/*") ?: [] as $fd) {
+                if (@readlink($fd) === $stdin) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Reap a detected orphan process. When orphan reaping is disabled
+     * (SSH_MUX_ORPHAN_REAP_ENABLED=false, the default), the orphan is only
+     * logged — a dry-run mode that lets operators verify what would be killed
+     * before enabling it for real.
      *
      * @param  array{pid: string, ppid: string, etimes: int, args: string}  $process
      */
@@ -115,7 +173,10 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
             return;
         }
 
-        Process::run('kill '.escapeshellarg($process['pid']));
+        // SIGKILL ssh: a former master unlinks its ControlPath on SIGTERM, even
+        // when a newer master owns that path now.
+        $signal = $kind === 'ssh' ? 'kill -9 ' : 'kill ';
+        Process::run($signal.escapeshellarg($process['pid']));
         Log::info("Killed orphaned {$kind} process", [
             'pid' => $process['pid'],
             'etimes' => $process['etimes'],
@@ -195,8 +256,9 @@ class CleanupStaleMultiplexedConnections implements ShouldQueue
 
     /**
      * Close and delete a stale mux socket file. When orphan reaping is disabled
-     * (the default), the file is only logged — a dry-run mode that lets operators
-     * verify what would be removed before enabling it for real.
+     * (SSH_MUX_ORPHAN_REAP_ENABLED=false, the default), the file is only logged —
+     * a dry-run mode that lets operators verify what would be removed before
+     * enabling it for real.
      */
     private function removeMultiplexFile(string $muxFile, string $reason): void
     {
diff --git a/app/Jobs/DeleteFileDownloadJob.php b/app/Jobs/DeleteFileDownloadJob.php
new file mode 100644
index 0000000000..598a2c2041
--- /dev/null
+++ b/app/Jobs/DeleteFileDownloadJob.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\S3Storage;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+
+/**
+ * Deletes a file browser download from S3 when its link expires. The bucket
+ * lifecycle rule removes anything this job misses after one day.
+ */
+class DeleteFileDownloadJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable;
+
+    public function __construct(
+        public int $s3StorageId,
+        public string $key,
+    ) {}
+
+    public function handle(FileDownloadStorageService $downloads): void
+    {
+        $storage = S3Storage::find($this->s3StorageId);
+        if ($storage && str_starts_with($this->key, FileDownloadStorageService::PREFIX)) {
+            $downloads->delete($storage, $this->key);
+        }
+    }
+}
diff --git a/app/Jobs/DeleteResourceJob.php b/app/Jobs/DeleteResourceJob.php
index d5e8aaf4ff..4749891550 100644
--- a/app/Jobs/DeleteResourceJob.php
+++ b/app/Jobs/DeleteResourceJob.php
@@ -56,7 +56,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        if ($this->deleteFromCoolifyOnly && $this->resource instanceof Service) {
+        if ($this->deleteFromCoolifyOnly) {
             // No remote calls on this path: remove only the schedule records, so the scheduler does
             // not keep running backups of volumes that no longer exist in Coolify.
             $this->volumeBackupSchedules()->each->delete();
diff --git a/app/Jobs/DockerCleanupJob.php b/app/Jobs/DockerCleanupJob.php
index ed430a600c..146f751b23 100644
--- a/app/Jobs/DockerCleanupJob.php
+++ b/app/Jobs/DockerCleanupJob.php
@@ -41,6 +41,8 @@ class DockerCleanupJob implements ShouldBeEncrypted, ShouldQueue
 
     public ?DockerCleanupExecution $execution_log = null;
 
+    public const INTERRUPTED_MESSAGE = 'Docker cleanup was interrupted: its worker stopped before the cleanup finished.';
+
     /**
      * Shares the per-server lock with queued CleanupDocker runs, so two cleanups never run on
      * one server at once. A scheduled run that finds the lock held marks its occurrence
@@ -232,6 +234,40 @@ class DockerCleanupJob implements ShouldBeEncrypted, ShouldQueue
         return $jobUuid ? 'docker-cleanup-execution:'.$jobUuid : null;
     }
 
+    /**
+     * Fails running executions that are older than the server lock. The worker kills a cleanup at the
+     * job timeout, which is shorter than the lock, so such a run lost its worker before failed() ran
+     * (for example a killed container) and would otherwise stay running.
+     */
+    public static function failInterruptedExecutions(): void
+    {
+        $executions = DockerCleanupExecution::query()
+            ->with('server.team')
+            ->where('status', 'running')
+            ->whereNull('finished_at')
+            ->where('created_at', '<', now()->subSeconds(CleanupDocker::overlapLockExpiresAfter()))
+            ->get();
+
+        foreach ($executions as $execution) {
+            $updated = DockerCleanupExecution::query()
+                ->whereKey($execution->id)
+                ->where('status', 'running')
+                ->whereNull('finished_at')
+                ->update([
+                    'status' => 'failed',
+                    'message' => self::INTERRUPTED_MESSAGE,
+                    'finished_at' => Carbon::now()->toImmutable(),
+                ]);
+
+            if ($updated === 0) {
+                continue;
+            }
+
+            event(new DockerCleanupDone($execution->refresh()));
+            $execution->server?->team?->notify(new DockerCleanupFailed($execution->server, 'Docker cleanup job failed with the following error: '.self::INTERRUPTED_MESSAGE));
+        }
+    }
+
     public function failed(?\Throwable $exception): void
     {
         if ($this->occurrenceUuid) {
diff --git a/app/Jobs/MigrateServerToInstanceJob.php b/app/Jobs/MigrateServerToInstanceJob.php
new file mode 100644
index 0000000000..cba109fb04
--- /dev/null
+++ b/app/Jobs/MigrateServerToInstanceJob.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use App\Services\ServerTransfer\ServerTransferMigrator;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Throwable;
+
+/**
+ * Moves a server to another Coolify instance outside the web request, because a large import can take
+ * longer than the nginx request timeout. The job payload is encrypted because it holds the target token.
+ */
+class MigrateServerToInstanceJob implements ShouldBeEncrypted, ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = ServerTransferMigrator::MIGRATION_TIMEOUT_SECONDS;
+
+    public function __construct(
+        public Server $server,
+        public string $targetUrl,
+        public string $targetToken,
+    ) {
+        $this->onQueue('high');
+    }
+
+    public function uniqueId(): string
+    {
+        return (string) $this->server->id;
+    }
+
+    public function handle(ServerTransferMigrator $migrator): void
+    {
+        try {
+            $result = $migrator->migrate($this->server, $this->targetUrl, $this->targetToken);
+            $migrator->recordMigration($this->server, 'succeeded', [
+                'export_id' => $result['export_id'],
+                'warnings' => $result['warnings'],
+                'checklist' => $result['checklist'],
+                'target_server_url' => $result['target_server_url'] ?? null,
+            ]);
+        } catch (Throwable $e) {
+            $migrator->recordMigration($this->server, 'failed', ['error' => $e->getMessage()]);
+        }
+    }
+
+    /**
+     * The worker stopped the job, for example at its timeout. The target can manage the server already,
+     * so the migrator asks the target before it records the result.
+     */
+    public function failed(?Throwable $exception): void
+    {
+        app(ServerTransferMigrator::class)->recordStoppedMigration(
+            $this->server,
+            $this->targetUrl,
+            $this->targetToken,
+            $exception?->getMessage() ?: 'The transfer job stopped before it finished.',
+        );
+    }
+}
diff --git a/app/Jobs/PrepareFileDownloadJob.php b/app/Jobs/PrepareFileDownloadJob.php
new file mode 100644
index 0000000000..b36d5ccd96
--- /dev/null
+++ b/app/Jobs/PrepareFileDownloadJob.php
@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Uploads a download from the managed server to the instance download S3
+ * storage and stores a presigned link for the Livewire component to open.
+ * The source is a path in $container, or a file on the server host (for
+ * example a backup) when $container is null.
+ */
+class PrepareFileDownloadJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable;
+
+    public int $tries = 1;
+
+    public int $timeout = 3700;
+
+    public function __construct(
+        public string $downloadId,
+        public int $userId,
+        public int $serverId,
+        public ?string $container,
+        public string $path,
+        public bool $isDir,
+        public string $downloadName,
+        public int $s3StorageId,
+    ) {}
+
+    public static function cacheKey(string $downloadId): string
+    {
+        return 'file-browser-s3-download:'.$downloadId;
+    }
+
+    public function handle(FileDownloadStorageService $downloads): void
+    {
+        try {
+            $storage = S3Storage::query()->whereTeamId(0)->where('is_usable', true)->find($this->s3StorageId);
+            if (! $storage) {
+                throw new \RuntimeException('The file download storage is not available.');
+            }
+            $server = Server::findOrFail($this->serverId);
+
+            $key = FileDownloadStorageService::newObjectKey();
+            // Queue the delete first, so a partial upload is removed as well.
+            DeleteFileDownloadJob::dispatch($storage->id, $key)->delay(now()->addHours(FileDownloadStorageService::OBJECT_TTL_HOURS));
+
+            $upload = $downloads->uploadUrl($storage, $key, $this->downloadName);
+            if ($this->container === null) {
+                instant_remote_process([FileDownloadStorageService::buildHostFileUploadCommand($this->path, $upload['url'], $upload['headers'])], $server, timeout: 3600);
+            } else {
+                (new ContainerFilesystemService($server, $this->container))->uploadToS3($this->path, $this->isDir, $upload['url'], $upload['headers']);
+            }
+
+            $this->store(['status' => 'ready', 'url' => $downloads->downloadUrl($storage, $key)]);
+        } catch (\Throwable $e) {
+            // The message can contain the S3 endpoint or a presigned URL; keep it in the log only.
+            Log::warning('S3 download failed', ['download_id' => $this->downloadId, 'error' => $e->getMessage()]);
+            $this->store(['status' => 'failed', 'message' => 'Download failed. The file could not be uploaded to the download storage. Try again, or ask your administrator to check the storage settings.']);
+        }
+    }
+
+    /**
+     * @param  array<string, string>  $result
+     */
+    private function store(array $result): void
+    {
+        Cache::put(self::cacheKey($this->downloadId), ['user_id' => $this->userId, ...$result], now()->addMinutes(FileDownloadStorageService::LINK_TTL_MINUTES));
+    }
+}
diff --git a/app/Jobs/ProcessGithubPullRequestWebhook.php b/app/Jobs/ProcessGithubPullRequestWebhook.php
index 362ad0a2d8..1602b576a2 100644
--- a/app/Jobs/ProcessGithubPullRequestWebhook.php
+++ b/app/Jobs/ProcessGithubPullRequestWebhook.php
@@ -14,6 +14,7 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
 use Throwable;
 
 class ProcessGithubPullRequestWebhook implements ShouldBeEncrypted, ShouldQueue
@@ -37,7 +38,6 @@ class ProcessGithubPullRequestWebhook implements ShouldBeEncrypted, ShouldQueue
         public ?string $beforeSha,
         public ?string $afterSha,
         public string $commitSha,
-        public ?string $authorAssociation,
         public string $fullName,
         public bool $isForkPullRequest = false,
     ) {
@@ -109,39 +109,46 @@ class ProcessGithubPullRequestWebhook implements ShouldBeEncrypted, ShouldQueue
             return;
         }
 
-        // Check if PR deployments from public contributors are restricted
-        if (! $application->settings->is_pr_deployments_public_enabled) {
-            // Fork PRs carry untrusted code from a repository outside our control.
-            // GitHub's author_association cannot be trusted to gate these (it grants
-            // CONTRIBUTOR to anyone who has merely opened an issue/PR before), so fork
-            // PRs are never deployed automatically when public previews are off.
-            if ($this->isForkPullRequest) {
-                return;
-            }
+        // Fork PRs carry untrusted code, so they deploy only when public previews are on.
+        // Same-repository branches can only be pushed by users with write access.
+        if ($this->isForkPullRequest && ! $application->settings->is_pr_deployments_public_enabled) {
+            Log::info('Skipped GitHub pull request preview deployment from a fork because public PR deployments are disabled.', [
+                'application_uuid' => $application->uuid,
+                'pull_request_id' => $this->pullRequestId,
+                'action' => $this->action,
+            ]);
 
-            // Same-repo (non-fork) branch PRs require push access to the base repo,
-            // so only trusted associations are allowed to trigger a deployment.
-            $trustedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR'];
-            if (! in_array($this->authorAssociation, $trustedAssociations)) {
-                return;
-            }
+            return;
         }
 
-        // Get changed files for watch path filtering
-        $changed_files = collect();
+        // Get changed files for watch path filtering (null means the full list is unknown)
+        $changed_files = [];
 
         if ($this->action === 'synchronize' && $this->beforeSha && $this->afterSha) {
             // For synchronize events, get files changed between before and after commits
-            $changed_files = collect(getGithubCommitRangeFiles($githubApp, $owner, $repo, $this->beforeSha, $this->afterSha));
+            $changed_files = getGithubCommitRangeFiles($githubApp, $owner, $repo, $this->beforeSha, $this->afterSha);
         } elseif ($this->action === 'opened' || $this->action === 'reopened') {
             // For opened/reopened events, get all files in the PR
-            $changed_files = collect(getGithubPullRequestFiles($githubApp, $owner, $repo, $this->pullRequestId));
+            $changed_files = getGithubPullRequestFiles($githubApp, $owner, $repo, $this->pullRequestId);
         }
 
         // Apply watch path filtering
-        $is_watch_path_triggered = $application->isWatchPathsTriggered($changed_files);
-        if (! $is_watch_path_triggered && ! blank($application->watch_paths)) {
-            return;
+        if (! blank($application->watch_paths)) {
+            $logContext = [
+                'application_uuid' => $application->uuid,
+                'pull_request_id' => $this->pullRequestId,
+                'action' => $this->action,
+            ];
+
+            if (is_null($changed_files)) {
+                Log::warning('Could not get the full list of changed files from GitHub. Deploying the pull request preview without the watch paths check.', $logContext);
+            } elseif (! $application->isWatchPathsTriggered(collect($changed_files))) {
+                Log::info('Skipped GitHub pull request preview deployment because no changed file matches the watch paths.', $logContext + [
+                    'changed_files_count' => count($changed_files),
+                ]);
+
+                return;
+            }
         }
 
         // Create ApplicationPreview if not exists
diff --git a/app/Jobs/ProvisionGithubRunnerJob.php b/app/Jobs/ProvisionGithubRunnerJob.php
index e4415a81c1..ae9e5e15e7 100644
--- a/app/Jobs/ProvisionGithubRunnerJob.php
+++ b/app/Jobs/ProvisionGithubRunnerJob.php
@@ -85,7 +85,8 @@ class ProvisionGithubRunnerJob implements ShouldBeEncrypted, ShouldQueue
             if ($this->stopIfFinished($execution)) {
                 return;
             }
-            instant_remote_process($container->startCommands($runner['encoded_jit_config']), $server);
+            // stopIfFinished() reloaded the server, so a transfer that just finished stops the start command.
+            instant_remote_process($container->startCommands($runner['encoded_jit_config']), $execution->server);
 
             if ($this->stopIfFinished($execution)) {
                 return;
@@ -159,11 +160,15 @@ class ProvisionGithubRunnerJob implements ShouldBeEncrypted, ShouldQueue
             return true;
         }
 
+        // Reloads the server too: a transfer to another instance can finish while this job runs.
         $execution->refresh();
-        if ($execution->isActive()) {
+        if ($execution->isActive() && ! $execution->server?->isTransferredAway()) {
             return false;
         }
 
+        if ($execution->isActive()) {
+            $execution->finish(GithubRunnerStatus::Cancelled, 'The server was transferred to another Coolify instance.');
+        }
         CleanupGithubRunnerJob::dispatch($execution->id);
 
         return true;
diff --git a/app/Jobs/PullTemplatesFromCDN.php b/app/Jobs/PullTemplatesFromCDN.php
index ec09285e1e..2125581f50 100644
--- a/app/Jobs/PullTemplatesFromCDN.php
+++ b/app/Jobs/PullTemplatesFromCDN.php
@@ -44,13 +44,11 @@ class PullTemplatesFromCDN implements ShouldBeEncrypted, ShouldQueue
                     'status' => $response->status(),
                     'body' => str($response->body())->limit(500)->toString(),
                 ]);
-                send_internal_notification('PullTemplatesAndVersions failed with: '.$response->status().' '.$response->body());
             }
         } catch (\Throwable $e) {
             Log::error('PullTemplatesFromCDN exception', [
                 'message' => $e->getMessage(),
             ]);
-            send_internal_notification('PullTemplatesAndVersions failed with: '.$e->getMessage());
         }
     }
 }
diff --git a/app/Jobs/ScheduledJobManager.php b/app/Jobs/ScheduledJobManager.php
index c218a53652..7e137dadaa 100644
--- a/app/Jobs/ScheduledJobManager.php
+++ b/app/Jobs/ScheduledJobManager.php
@@ -191,6 +191,7 @@ class ScheduledJobManager implements ShouldQueue
         // Process Docker cleanups - don't let failures stop the job manager
         try {
             if ($this->includes('docker-cleanups')) {
+                DockerCleanupJob::failInterruptedExecutions();
                 $this->processDockerCleanups();
             }
         } catch (\Throwable $e) {
diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index 56c5bb7821..765e6f89d2 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -85,6 +85,17 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
         $this->executionUuid = new_public_id();
     }
 
+    /**
+     * The lock outlives the worker timeout, so a run killed at the timeout still blocks a new run
+     * while its remote command can still be running.
+     */
+    public function middleware(): array
+    {
+        $expireAfter = ($this->task->timeout ?? 300) + 300;
+
+        return [ScheduledJobDeliveryService::withoutOverlapping('scheduled-task-'.$this->task->id, $this->occurrenceUuid)->expireAfter($expireAfter)->dontRelease()];
+    }
+
     private function initializeExecutionContext(): void
     {
         $this->task->loadMissing([
diff --git a/app/Jobs/ServerConnectionCheckJob.php b/app/Jobs/ServerConnectionCheckJob.php
index ab8d56a98a..841e915b78 100644
--- a/app/Jobs/ServerConnectionCheckJob.php
+++ b/app/Jobs/ServerConnectionCheckJob.php
@@ -5,6 +5,7 @@ namespace App\Jobs;
 use App\Events\ServerReachabilityChanged;
 use App\Helpers\SshMultiplexingHelper;
 use App\Models\Server;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -44,6 +45,9 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
 
     private ?string $connectionError = null;
 
+    /** Owner marker that the SSH probe read from the host; empty when the host has none. */
+    private ?string $ownerMarker = null;
+
     public function __construct(
         public Server $server,
         public bool $disableMux = true
@@ -108,6 +112,10 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
                 return;
             }
 
+            if ($this->releasedToAnotherInstance()) {
+                return;
+            }
+
             // Server is reachable, check if Docker is available
             $isUsable = $this->checkDockerAvailability();
 
@@ -218,9 +226,11 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
     {
         try {
             $process = Process::timeout(self::SSH_TIMEOUT_SECONDS)
-                ->run($this->sshCommand('ls -la /', disableMultiplexing: true));
+                ->run($this->sshCommand(self::probeCommand(), disableMultiplexing: true));
             if ($process->exitCode() !== 0) {
                 $this->connectionError = 'ssh exit '.$process->exitCode().': '.Str::limit(trim($process->errorOutput()), 300);
+            } else {
+                $this->ownerMarker = trim($process->output());
             }
 
             return $process->exitCode() === 0;
@@ -235,6 +245,25 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * The SSH probe also reads the owner marker, so the marker check needs no extra SSH connection.
+     * The remote shell runs with `set -e` and most servers have no marker, so a missing file must not fail the probe.
+     */
+    public static function probeCommand(): string
+    {
+        return 'cat '.ServerTransferClaimer::OWNER_MARKER_PATH.' 2>/dev/null || true; ls -la / > /dev/null';
+    }
+
+    /**
+     * After a transfer, another instance can claim this server. Its owner marker on the host is the only
+     * record that both instances share, so this instance stops managing the server when the marker names
+     * another claim.
+     */
+    private function releasedToAnotherInstance(): bool
+    {
+        return app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server, $this->ownerMarker);
+    }
+
     private function checkDockerAvailability(): bool
     {
         try {
diff --git a/app/Jobs/UpdateCoolifyJob.php b/app/Jobs/UpdateCoolifyJob.php
index f0e43cbc0a..e2310f0bee 100644
--- a/app/Jobs/UpdateCoolifyJob.php
+++ b/app/Jobs/UpdateCoolifyJob.php
@@ -44,8 +44,7 @@ class UpdateCoolifyJob implements ShouldBeEncrypted, ShouldQueue
             Log::info('Starting Coolify update process...');
             UpdateCoolify::run(false); // false means it's not a manual update
 
-            $settings->update(['new_version_available' => false]);
-            Log::info('Coolify update completed successfully.');
+            Log::info('Coolify upgrade script started. Result: /data/coolify/source/.upgrade-status, log: /data/coolify/source/upgrade-*.log.');
         } catch (\Throwable $e) {
             Log::error('UpdateCoolifyJob failed: '.$e->getMessage());
             // Consider implementing a notification to administrators
diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index 9c36f67e53..6439942e1a 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -99,8 +99,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 ? 'docker volume inspect '.escapeshellarg($source).' >/dev/null'
                 : 'test -d '.escapeshellarg($source);
 
-            $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
-            $archiveScript = "compressor=\$({$compressorCommand}); tar -I \"\$compressor\" -cf - -C /volume .";
+            $archiveScript = self::archiveScript($compressionCpuPercentage);
             if ($streamToS3) {
                 $this->execution->update(['local_storage_deleted' => true]);
                 $archiveCommand = $this->streamToS3Command($destinations->first(), $archiveScript, $backupLocation, $source, $containerName, $image);
@@ -303,6 +302,17 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         ));
     }
 
+    /**
+     * GNU tar exits with 1 when a file changes while it is read (for example, an app that writes to the volume
+     * during a live backup). The archive is still valid, so only exit codes above 1 fail the backup.
+     */
+    public static function archiveScript(int $compressionCpuPercentage): string
+    {
+        $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
+
+        return "compressor=\$({$compressorCommand}); { tar -I \"\$compressor\" -cf - -C /volume . || { status=\$?; [ \$status -eq 1 ] || exit \$status; }; }";
+    }
+
     /**
      * Redact the key and secret of every S3 destination of the backup from text that is stored or sent in notifications.
      */
@@ -323,12 +333,15 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
     }
 
     /**
+     * Containers can exit and be removed (e.g. `--rm` backup helpers) between `docker ps` and
+     * `docker inspect`. Skip those, but still fail when an existing container cannot be inspected.
+     *
      * @return array<int, string>
      */
     private function containersUsingVolume(string $source, Server $server): array
     {
         $output = instant_remote_process(
-            ["containers=\$(docker ps -q) || exit 1; for container in \$containers; do paused=\$(docker inspect --format '{{.State.Paused}}' \"\$container\") || exit 1; [ \"\$paused\" = true ] && continue; mounts=\$(docker inspect --format '{{range .Mounts}}{{println .Source}}{{println .Name}}{{end}}' \"\$container\") || exit 1; if printf '%s\\n' \"\$mounts\" | grep -Fqx -- ".escapeshellarg($source).'; then echo "$container"; fi; done'],
+            ["containers=\$(docker ps -q) || exit 1; for container in \$containers; do mounts=\$(docker inspect --format '{{if not .State.Paused}}{{range .Mounts}}{{println .Source}}{{println .Name}}{{end}}{{end}}' \"\$container\" 2>/dev/null) || { remaining=\$(docker ps -aq --filter \"id=\$container\") || exit 1; [ -z \"\$remaining\" ] && continue; docker inspect \"\$container\" >/dev/null; exit 1; }; if printf '%s\\n' \"\$mounts\" | grep -Fqx -- ".escapeshellarg($source).'; then echo "$container"; fi; done'],
             $server,
             disableMultiplexing: true,
         );
@@ -449,9 +462,13 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             ->implode(' ');
         $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
         $destination = 'temporary/'.$s3->bucket.$backupLocation;
+        // `mc pipe --quiet` panics in recent mc releases, so keep its progress bar out of the error output instead.
+        // Each progress frame starts with "\r", so printing the last field per line keeps only the final frame and real errors.
+        $mcPipeLog = '/tmp/mc-pipe.log';
         $streamScript = 'set -o pipefail; mc alias set'.$resolveOptions.' temporary '
             .escapeshellarg($s3->endpoint).' '.escapeshellarg($s3->key).' '.escapeshellarg($s3->secret)
-            .' >/dev/null && ('.$archiveScript.' | mc pipe --quiet'.$resolveOptions.' '.escapeshellarg($destination).' >/dev/null)'
+            .' >/dev/null && ('.$archiveScript.' | mc pipe'.$resolveOptions.' '.escapeshellarg($destination).' >/dev/null 2>'.$mcPipeLog
+            .' || { status=$?; awk -F '.escapeshellarg('\r').' '.escapeshellarg('{ print $NF }').' '.$mcPipeLog.' >&2; exit $status; })'
             .' && mc stat --json'.$resolveOptions.' '.escapeshellarg($destination)
             .' | sed -n '.escapeshellarg('s/.*"size":\([0-9][0-9]*\).*/\1/p');
 
diff --git a/app/Listeners/CloudflareTunnelChangedNotification.php b/app/Listeners/CloudflareTunnelChangedNotification.php
index 34e713f954..3cc44c2f82 100644
--- a/app/Listeners/CloudflareTunnelChangedNotification.php
+++ b/app/Listeners/CloudflareTunnelChangedNotification.php
@@ -26,7 +26,7 @@ class CloudflareTunnelChangedNotification
 
         for ($i = 1; $i <= $attempts; $i++) {
             \Log::debug("Cloudflare health check attempt {$i}/{$attempts}", ['server_id' => $server_id]);
-            $result = instant_remote_process_with_timeout(['docker inspect coolify-cloudflared | jq -e ".[0].State.Health.Status == \"healthy\""'], $this->server, false, 10);
+            $result = instant_remote_process_with_timeout(['docker inspect coolify-cloudflared | jq -e ".[0].State.Health.Status == \"healthy\""'], $this->server, false);
 
             if (blank($result)) {
                 \Log::debug("Cloudflare Tunnels container not found on attempt {$i}", ['server_id' => $server_id]);
diff --git a/app/Livewire/Analytics.php b/app/Livewire/Analytics.php
index e4400f58ec..007618501c 100644
--- a/app/Livewire/Analytics.php
+++ b/app/Livewire/Analytics.php
@@ -109,7 +109,7 @@ class Analytics extends Component
     private const MAX_LEADERBOARD_APPS = 200;
 
     /** @var array<int, string> */
-    protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
+    protected array $breakdownDimensions = ['country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
 
     /**
      * Per-request cache of Sentinel key => display metadata, so resolving a name/domain/link
diff --git a/app/Livewire/Concerns/BuildsTrafficChartPayload.php b/app/Livewire/Concerns/BuildsTrafficChartPayload.php
index eb57c855fb..d1c16672be 100644
--- a/app/Livewire/Concerns/BuildsTrafficChartPayload.php
+++ b/app/Livewire/Concerns/BuildsTrafficChartPayload.php
@@ -4,7 +4,7 @@ namespace App\Livewire\Concerns;
 
 /**
  * Shared derivations for the traffic chart payload: per-bucket sparkline series,
- * the device-donut labels/series, and the globe's per-country marker data. Consumed
+ * the device-donut labels/series, and the globe's marker data. Consumed
  * by both the global and per-application analytics components, which expose
  * `$series` (status buckets) and `$breakdowns` (dimension rows).
  */
@@ -77,22 +77,13 @@ trait BuildsTrafficChartPayload
     }
 
     /**
-     * Per-country marker data for the globe: [{code, requests}] over known ISO-A2 rows.
+     * Marker data for the globe: country markers and city markers, one set for each view.
      *
-     * @return array<int, array{code: string, requests: int}>
+     * @return array{countries: array<int, array{code: string, requests: int}>, cities: array<int, array{lat: float, lon: float, requests: int}>}
      */
     protected function geoMarkers(): array
     {
-        $out = [];
-        foreach (($this->breakdowns['country'] ?? []) as $row) {
-            $code = strtoupper((string) ($row['value'] ?? ''));
-            $requests = (int) ($row['requests'] ?? 0);
-            if (preg_match('/^[A-Z]{2}$/', $code) && $requests > 0) {
-                $out[] = ['code' => $code, 'requests' => $requests];
-            }
-        }
-
-        return $out;
+        return trafficGeoMarkers($this->breakdowns['country'] ?? [], trafficCityRows($this->breakdowns['city'] ?? []));
     }
 
     /**
diff --git a/app/Livewire/Concerns/ManagesDatabaseBackup.php b/app/Livewire/Concerns/ManagesDatabaseBackup.php
new file mode 100644
index 0000000000..64eaffa1a1
--- /dev/null
+++ b/app/Livewire/Concerns/ManagesDatabaseBackup.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Jobs\DatabaseBackupJob;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
+use Illuminate\Http\RedirectResponse;
+use Livewire\Features\SupportRedirects\Redirector;
+
+trait ManagesDatabaseBackup
+{
+    /**
+     * Turn the backup schedule on or off and return the new state.
+     */
+    protected function toggleDatabaseBackup(ScheduledDatabaseBackup $backup): bool
+    {
+        $this->authorize('manageBackups', $backup->database);
+
+        $backup->enabled = ! $backup->enabled;
+        $changedFields = auditChangedFields($backup);
+        $backup->save();
+
+        $database = $backup->database;
+        auditLog('ui.database.backup_schedule_updated', [
+            'team_id' => $database?->team()?->id,
+            'database_uuid' => $database?->uuid,
+            'database_name' => $database?->name,
+            'backup_uuid' => $backup->uuid,
+            'changed_fields' => $changedFields,
+        ]);
+        $this->dispatch('success', $backup->enabled ? 'Backup enabled.' : 'Backup disabled.');
+
+        return $backup->enabled;
+    }
+
+    /**
+     * Queue a backup run now and redirect to the executions page of the backup.
+     */
+    protected function queueDatabaseBackup(ScheduledDatabaseBackup $backup): Redirector|RedirectResponse|null
+    {
+        $this->authorize('manageBackups', $backup->database);
+
+        $database = $backup->database->refresh();
+        if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+            $this->dispatch('error', 'The database must be running to start a backup.');
+
+            return null;
+        }
+
+        DatabaseBackupJob::dispatch($backup);
+        auditLog('ui.database.backup_started', [
+            'team_id' => $database->team()?->id,
+            'database_uuid' => $database->uuid,
+            'database_name' => $database->name,
+            'backup_uuid' => $backup->uuid,
+        ]);
+        $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+
+        if ($database instanceof ServiceDatabase) {
+            return redirect()->route('project.service.database.backup.executions', [
+                'project_uuid' => $database->service->project()->uuid,
+                'environment_uuid' => $database->service->environment->uuid,
+                'service_uuid' => $database->service->uuid,
+                'stack_service_uuid' => $database->uuid,
+                'backup_uuid' => $backup->uuid,
+            ]);
+        }
+
+        // Instance databases (e.g. coolify-db) have no project/environment.
+        // Stay on the current page (settings.backup) instead of redirecting.
+        $project = $database->project();
+        $environment = $database->environment;
+        if (! $project || ! $environment) {
+            return null;
+        }
+
+        return redirect()->route('project.database.backup.executions', [
+            'project_uuid' => $project->uuid,
+            'environment_uuid' => $environment->uuid,
+            'database_uuid' => $database->uuid,
+            'backup_uuid' => $backup->uuid,
+        ]);
+    }
+}
diff --git a/app/Livewire/Concerns/RemembersCanvasView.php b/app/Livewire/Concerns/RemembersCanvasView.php
index d8bad86d4d..4d7e4f29d8 100644
--- a/app/Livewire/Concerns/RemembersCanvasView.php
+++ b/app/Livewire/Concerns/RemembersCanvasView.php
@@ -13,7 +13,7 @@ use Livewire\Attributes\Renderless;
  */
 trait RemembersCanvasView
 {
-    private const array CANVAS_VIEW_PAGES = ['servers', 'server_resources', 'projects', 'project', 'environment', 'tags', 'team_variables', 'project_variables', 'environment_variables', 'server_variables'];
+    private const array CANVAS_VIEW_PAGES = ['servers', 'server_resources', 'projects', 'project', 'environment', 'tags', 'team_variables', 'project_variables', 'environment_variables', 'server_variables', 'dashboard', 'dashboard_projects', 'dashboard_servers'];
 
     private const array LIST_VIEWS = ['table', 'grid', 'list'];
 
@@ -60,9 +60,13 @@ trait RemembersCanvasView
      */
     protected function listView(string $page, string $default): string
     {
-        $view = request()->query('view') ?? request()->cookie($this->viewCookieName($page));
+        foreach ([request()->query('view'), request()->cookie($this->viewCookieName($page))] as $view) {
+            if (in_array($view, ['table', 'grid'], true)) {
+                return $view;
+            }
+        }
 
-        return in_array($view, ['table', 'grid'], true) ? $view : $default;
+        return $default;
     }
 
     private function viewCookieName(string $page): string
diff --git a/app/Livewire/Dashboard.php b/app/Livewire/Dashboard.php
index 2fc2553512..aa32fe6770 100644
--- a/app/Livewire/Dashboard.php
+++ b/app/Livewire/Dashboard.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire;
 
+use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
@@ -11,6 +12,8 @@ use Livewire\Component;
 
 class Dashboard extends Component
 {
+    use RemembersCanvasView;
+
     public Collection $projects;
 
     public Collection $servers;
@@ -19,6 +22,12 @@ class Dashboard extends Component
 
     public function mount()
     {
+        if ($this->prefersCanvasView('dashboard')) {
+            $this->redirectRoute('dashboard.canvas', navigate: true);
+
+            return;
+        }
+
         $this->privateKeys = PrivateKey::ownedByCurrentTeamCached();
         $this->servers = Server::ownedByCurrentTeamCached();
         $this->projects = Project::ownedByCurrentTeam()
diff --git a/app/Livewire/Dashboard/Canvas.php b/app/Livewire/Dashboard/Canvas.php
new file mode 100644
index 0000000000..8aba6c5f54
--- /dev/null
+++ b/app/Livewire/Dashboard/Canvas.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Livewire\Dashboard;
+
+use App\Livewire\Concerns\RemembersCanvasView;
+use Illuminate\Contracts\View\View;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+/**
+ * Dashboard as a canvas: every server of the team with its resources and their running deployments.
+ * The page is a shell: resources/js/environment-canvas.js renders it from
+ * Api\ServerCanvasController::dashboard at /canvas/api with the browser session.
+ */
+class Canvas extends Component
+{
+    use RemembersCanvasView;
+
+    /** The team that owned the page at mount; the canvas API calls use it, not the session team. */
+    #[Locked]
+    public int $teamId;
+
+    public function mount(): void
+    {
+        $this->teamId = currentTeam()->id;
+        $this->rememberView('dashboard', 'canvas');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.dashboard.canvas')->layout('layouts.app', ['fullBleed' => true]);
+    }
+}
diff --git a/app/Livewire/Dashboard/ServerMetricsChart.php b/app/Livewire/Dashboard/ServerMetricsChart.php
index fce9460064..83748052ce 100644
--- a/app/Livewire/Dashboard/ServerMetricsChart.php
+++ b/app/Livewire/Dashboard/ServerMetricsChart.php
@@ -4,14 +4,23 @@ namespace App\Livewire\Dashboard;
 
 use App\Models\Server;
 use Illuminate\Contracts\View\View;
+use Livewire\Attributes\Isolate;
 use Livewire\Component;
 
+/**
+ * Each chart sends its own request, so one slow server does not delay the charts of the other servers.
+ */
+#[Isolate]
 class ServerMetricsChart extends Component
 {
     public Server $server;
 
     public function loadData(): void
     {
+        if (! $this->server->isFunctional()) {
+            return;
+        }
+
         try {
             $this->dispatch("dashboard-server-metrics-{$this->server->uuid}", [
                 'cpu' => $this->server->getCpuMetrics(10),
diff --git a/app/Livewire/DeploymentsIndicator.php b/app/Livewire/DeploymentsIndicator.php
index e6b68a62b7..190da1a097 100644
--- a/app/Livewire/DeploymentsIndicator.php
+++ b/app/Livewire/DeploymentsIndicator.php
@@ -5,14 +5,26 @@ namespace App\Livewire;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Server;
 use Livewire\Attributes\Computed;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class DeploymentsIndicator extends Component
 {
     /**
-     * Where the indicator is rendered: 'sidebar' (desktop sidebar footer) or 'mobile' (mobile top bar).
+     * Where the indicator is rendered: 'topbar' (desktop top bar) or 'mobile' (mobile top bar).
      */
-    public string $variant = 'sidebar';
+    public string $variant = 'topbar';
+
+    /**
+     * The application on the current page. Its heading has its own "Deploying…" indicator.
+     */
+    #[Locked]
+    public ?string $currentApplicationUuid = null;
+
+    public function mount(): void
+    {
+        $this->currentApplicationUuid = request()->route('application_uuid');
+    }
 
     #[Computed]
     public function deployments()
@@ -41,6 +53,16 @@ class DeploymentsIndicator extends Component
         return $this->deployments->count();
     }
 
+    /**
+     * Hide the counter when it would only repeat the current page's "Deploying…" indicator.
+     */
+    #[Computed]
+    public function isOnlyCurrentApplicationDeploying(): bool
+    {
+        return $this->currentApplicationUuid !== null
+            && $this->deployments->every(fn ($deployment) => $deployment->application?->uuid === $this->currentApplicationUuid);
+    }
+
     public function render()
     {
         return view('livewire.deployments-indicator');
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index e887abed9e..05b295b88b 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -20,10 +20,10 @@ class Show extends Component
     #[Validate(['string', 'required'])]
     public string $name;
 
-    #[Validate(['string', 'required', 'max:255', 'regex:/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/'])]
+    #[Locked]
     public string $network;
 
-    #[Validate(['string', 'required'])]
+    #[Locked]
     public string $serverIp;
 
     public function mount(string $destination_uuid)
@@ -49,8 +49,6 @@ class Show extends Component
         if ($toModel) {
             $this->validate();
             $this->destination->name = $this->name;
-            $this->destination->network = $this->network;
-            $this->destination->server->ip = $this->serverIp;
             $changedFields = auditChangedFields($this->destination);
             $this->destination->save();
             if ($changedFields !== []) {
diff --git a/app/Livewire/Fleet/Metrics.php b/app/Livewire/Fleet/Metrics.php
index bd9580a8cc..bcf6917499 100644
--- a/app/Livewire/Fleet/Metrics.php
+++ b/app/Livewire/Fleet/Metrics.php
@@ -29,6 +29,9 @@ class Metrics extends Component
     /** @var array<string, string> uuid => name */
     public array $serverOptions = [];
 
+    /** @var array<int, string> Names of the servers where the user can turn metrics on; filled only when no server has metrics. */
+    public array $enableableServers = [];
+
     #[Url(as: 'range')]
     public string $range = '24h';
 
@@ -87,9 +90,13 @@ class Metrics extends Component
     private function refreshServers(): void
     {
         abort_unless(currentTeam() !== null, 403);
-        $this->servers = Server::ownedByCurrentTeam()->get()
+        $teamServers = Server::ownedByCurrentTeam()->get();
+        $this->servers = $teamServers
             ->filter(fn (Server $server) => $server->isMetricsEnabled())
             ->values();
+        $this->enableableServers = $this->servers->isEmpty()
+            ? $this->serversWithoutMetrics($teamServers)->pluck('name')->all()
+            : [];
 
         foreach ($this->servers as $server) {
             $this->authorize('view', $server);
@@ -104,6 +111,65 @@ class Metrics extends Component
         }
     }
 
+    /**
+     * Servers that can report metrics, have them off, are reachable, and that the user can change.
+     * An unreachable server cannot start Sentinel, so it stays out.
+     *
+     * @param  Collection<int, Server>  $teamServers
+     * @return Collection<int, Server>
+     */
+    private function serversWithoutMetrics(Collection $teamServers): Collection
+    {
+        return $teamServers
+            ->filter(fn (Server $server) => ! $server->isMetricsEnabled()
+                && $server->isSentinelEnabled()
+                && auth()->user()->can('update', $server)
+                && $server->isFunctional())
+            ->values();
+    }
+
+    public function enableMetrics(): void
+    {
+        try {
+            abort_unless(currentTeam() !== null, 403);
+            $servers = $this->serversWithoutMetrics(Server::ownedByCurrentTeam()->get());
+            if ($servers->isEmpty()) {
+                return;
+            }
+
+            // One failed server must not stop the others, so each server has its own try.
+            $failed = [];
+            foreach ($servers as $server) {
+                try {
+                    $server->settings->is_metrics_enabled = true;
+                    // Saved quietly: Sentinel is started below, so the settings hook must not start it a second time.
+                    $server->settings->saveQuietly();
+                    auditLog('ui.server.sentinel.updated', [
+                        'team_id' => $server->team_id,
+                        'server_uuid' => $server->uuid,
+                        'server_name' => $server->name,
+                        'changed_fields' => ['is_metrics_enabled'],
+                    ]);
+                    $server->restartSentinel();
+                } catch (\Throwable $e) {
+                    report($e);
+                    $failed[] = $server->name;
+                }
+            }
+
+            $this->loadData();
+            $enabled = $servers->count() - count($failed);
+            if ($enabled > 0) {
+                $this->dispatch('success', 'Metrics enabled on '.$enabled.' '.str('server')->plural($enabled).'. Sentinel is starting, data shows in about one minute.');
+            }
+            if ($failed !== []) {
+                $this->dispatch('error', 'Could not enable metrics on '.implode(', ', $failed).'. Check the server settings and try again.');
+            }
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function updatedServerUuid(): void
     {
         $this->loadData();
diff --git a/app/Livewire/Project/Application/Backup/Index.php b/app/Livewire/Project/Application/Backup/Index.php
index 7ca097db96..e53a3cdf88 100644
--- a/app/Livewire/Project/Application/Backup/Index.php
+++ b/app/Livewire/Project/Application/Backup/Index.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Application\Backup;
 
 use App\Models\Application;
 use App\Models\ScheduledVolumeBackup;
+use App\Traits\ListensToTeamChannel;
 use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -11,6 +12,7 @@ use Livewire\Component;
 class Index extends Component
 {
     use AuthorizesRequests;
+    use ListensToTeamChannel;
 
     public Application $application;
 
@@ -18,7 +20,13 @@ class Index extends Component
 
     public string $search = '';
 
-    protected $listeners = ['refreshVolumeBackups' => '$refresh'];
+    public function getListeners(): array
+    {
+        return [
+            'refreshVolumeBackups' => '$refresh',
+            ...$this->teamChannelListeners(['BackupCreated' => '$refresh']),
+        ];
+    }
 
     public function mount(): void
     {
diff --git a/app/Livewire/Project/Application/Backup/Show.php b/app/Livewire/Project/Application/Backup/Show.php
index 5e10f0c8ac..c07e49852a 100644
--- a/app/Livewire/Project/Application/Backup/Show.php
+++ b/app/Livewire/Project/Application/Backup/Show.php
@@ -40,8 +40,6 @@ class Show extends Component
             ->firstOrFail();
         $this->parameters = get_route_parameters();
         $this->section = match (request()->route()?->getName()) {
-            'project.application.backup.s3' => 's3',
-            'project.application.backup.retention' => 'retention',
             'project.application.backup.executions' => 'executions',
             'project.application.backup.danger' => 'danger',
             default => 'general',
diff --git a/app/Livewire/Project/Database/Backup/Execution.php b/app/Livewire/Project/Database/Backup/Execution.php
index 726ee3b698..c96c7e5217 100644
--- a/app/Livewire/Project/Database/Backup/Execution.php
+++ b/app/Livewire/Project/Database/Backup/Execution.php
@@ -2,12 +2,23 @@
 
 namespace App\Livewire\Project\Database\Backup;
 
+use App\Livewire\Concerns\ManagesDatabaseBackup;
+use App\Livewire\Project\Database\BackupEdit;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use App\Traits\ListensToTeamChannel;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
+use Livewire\Features\SupportRedirects\Redirector;
 
 class Execution extends Component
 {
+    use AuthorizesRequests;
+    use ListensToTeamChannel;
+    use ManagesDatabaseBackup;
+
     public $database;
 
     public ?ScheduledDatabaseBackup $backup;
@@ -20,6 +31,28 @@ class Execution extends Component
 
     public string $section = 'general';
 
+    public function getListeners(): array
+    {
+        // Keep the header backup actions in sync when the database starts/stops.
+        $listeners = [
+            'databaseUpdated' => '$refresh',
+            'backupEnabledChanged' => 'syncBackupEnabled',
+        ];
+
+        $user = Auth::user();
+        if ($user) {
+            $listeners["echo-private:user.{$user->id},DatabaseStatusChanged"] = '$refresh';
+        }
+
+        return [
+            ...$listeners,
+            ...$this->teamChannelListeners([
+                'ServiceChecked' => '$refresh',
+                'ServiceStatusChanged' => '$refresh',
+            ]),
+        ];
+    }
+
     public function mount()
     {
         $backup_uuid = request()->route('backup_uuid');
@@ -50,14 +83,38 @@ class Execution extends Component
             ->get();
         $this->parameters = get_route_parameters();
         $this->section = match (request()->route()?->getName()) {
-            'project.database.backup.s3' => 's3',
-            'project.database.backup.retention' => 'retention',
             'project.database.backup.executions' => 'executions',
             'project.database.backup.danger' => 'danger',
             default => 'general',
         };
     }
 
+    public function backupNow(): Redirector|RedirectResponse|null
+    {
+        try {
+            return $this->queueDatabaseBackup($this->backup);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return null;
+        }
+    }
+
+    public function toggleEnabled(): void
+    {
+        try {
+            $this->toggleDatabaseBackup($this->backup);
+            $this->dispatch('backupEnabledChanged')->to(BackupEdit::class);
+        } catch (\Throwable $e) {
+            $this->dispatch('error', $e->getMessage());
+        }
+    }
+
+    public function syncBackupEnabled(): void
+    {
+        $this->backup->refresh();
+    }
+
     public function render()
     {
         return view('livewire.project.database.backup.execution');
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index a7c49eeb58..97da01715e 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -2,7 +2,8 @@
 
 namespace App\Livewire\Project\Database;
 
-use App\Jobs\DatabaseBackupJob;
+use App\Livewire\Concerns\ManagesDatabaseBackup;
+use App\Livewire\Project\Database\Backup\Execution;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
@@ -21,11 +22,15 @@ class BackupEdit extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use ManagesDatabaseBackup;
 
     public ScheduledDatabaseBackup $backup;
 
     public string $section = 'general';
 
+    /** The page shows the backup actions in the top header bar instead. */
+    public bool $actionsInHeader = false;
+
     #[Locked]
     public $availableS3Storages;
 
@@ -96,7 +101,10 @@ class BackupEdit extends Component
     public function getListeners(): array
     {
         // Keep "Backup Now" in sync when the database starts/stops without a full page refresh.
-        $listeners = ['databaseUpdated' => 'refreshStatus'];
+        $listeners = [
+            'databaseUpdated' => 'refreshStatus',
+            'backupEnabledChanged' => 'syncBackupEnabled',
+        ];
 
         $user = Auth::user();
         if (! $user) {
@@ -107,7 +115,10 @@ class BackupEdit extends Component
 
         return [
             ...$listeners,
-            ...$this->teamChannelListeners(['ServiceChecked' => 'refreshStatus']),
+            ...$this->teamChannelListeners([
+                'ServiceChecked' => 'refreshStatus',
+                'ServiceStatusChanged' => 'refreshStatus',
+            ]),
         ];
     }
 
@@ -127,6 +138,15 @@ class BackupEdit extends Component
         }
     }
 
+    public function hydrate(): void
+    {
+        // Livewire restores a deleted backup as an empty model. Requests that arrive after the delete
+        // (for example status events before the redirect completes) must not render it.
+        if (! $this->backup->exists) {
+            $this->skipRender();
+        }
+    }
+
     public function refreshStatus(): void
     {
         $database = $this->backup->database;
@@ -268,50 +288,9 @@ class BackupEdit extends Component
     public function backupNow()
     {
         try {
-            $this->authorize('manageBackups', $this->backup->database);
+            $this->status = $this->backup->database->refresh()->status;
 
-            $database = $this->backup->database->refresh();
-            $this->status = $database->status;
-            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
-                $this->dispatch('error', 'The database must be running to start a backup.');
-
-                return;
-            }
-
-            DatabaseBackupJob::dispatch($this->backup);
-            $database = $this->backup->database;
-            auditLog('ui.database.backup_started', [
-                'team_id' => $database->team()?->id,
-                'database_uuid' => $database->uuid,
-                'database_name' => $database->name,
-                'backup_uuid' => $this->backup->uuid,
-            ]);
-            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
-
-            if ($database instanceof ServiceDatabase) {
-                return redirect()->route('project.service.database.backup.executions', [
-                    'project_uuid' => $database->service->project()->uuid,
-                    'environment_uuid' => $database->service->environment->uuid,
-                    'service_uuid' => $database->service->uuid,
-                    'stack_service_uuid' => $database->uuid,
-                    'backup_uuid' => $this->backup->uuid,
-                ]);
-            }
-
-            // Instance databases (e.g. coolify-db) have no project/environment.
-            // Stay on the current page (settings.backup) instead of redirecting.
-            $project = $database->project();
-            $environment = $database->environment;
-            if (! $project || ! $environment) {
-                return null;
-            }
-
-            return redirect()->route('project.database.backup.executions', [
-                'project_uuid' => $project->uuid,
-                'environment_uuid' => $environment->uuid,
-                'database_uuid' => $database->uuid,
-                'backup_uuid' => $this->backup->uuid,
-            ]);
+            return $this->queueDatabaseBackup($this->backup);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -332,19 +311,18 @@ class BackupEdit extends Component
     public function toggleEnabled(): void
     {
         try {
-            $this->authorize('manageBackups', $this->backup->database);
-
-            $this->backupEnabled = ! $this->backupEnabled;
-            $this->backup->enabled = $this->backupEnabled;
-            $changedFields = auditChangedFields($this->backup);
-            $this->backup->save();
-            $this->auditBackupScheduleUpdated($changedFields);
-            $this->dispatch('success', $this->backupEnabled ? 'Backup enabled.' : 'Backup disabled.');
+            $this->backupEnabled = $this->toggleDatabaseBackup($this->backup);
+            $this->dispatch('backupEnabledChanged')->to(Execution::class);
         } catch (\Throwable $e) {
             $this->dispatch('error', $e->getMessage());
         }
     }
 
+    public function syncBackupEnabled(): void
+    {
+        $this->backupEnabled = $this->backup->refresh()->enabled;
+    }
+
     public function updatedS3StorageIds(): void
     {
         $this->instantSave();
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index f9d4658688..168076238f 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Project\Database;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use App\Traits\ListensToTeamChannel;
+use App\Traits\PreparesBackupDownloads;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
@@ -13,6 +14,7 @@ class BackupExecutions extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use PreparesBackupDownloads;
 
     public ?ScheduledDatabaseBackup $backup = null;
 
@@ -126,9 +128,25 @@ class BackupExecutions extends Component
         return true;
     }
 
-    public function download_file($exeuctionId)
+    public function download_file($executionId): void
     {
-        return redirect()->route('download.backup', $exeuctionId);
+        try {
+            $this->authorize('manageBackups', $this->database);
+            $execution = $this->backup->executions()->whereKey($executionId)->first();
+            if (! $execution) {
+                $this->dispatch('error', 'Backup execution not found.');
+
+                return;
+            }
+
+            $this->prepareBackupDownload(
+                $execution->local_storage_deleted ? null : $this->server(),
+                $execution->filename,
+                route('download.backup', $execution->id),
+            );
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function refreshBackupExecutions(): void
@@ -223,6 +241,8 @@ class BackupExecutions extends Component
 
     public function render()
     {
-        return view('livewire.project.database.backup-executions');
+        return view('livewire.project.database.backup-executions', [
+            's3Downloads' => $this->s3BackupDownloadsEnabled(),
+        ]);
     }
 }
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index ea8d8f197b..2cd0bfecee 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -122,8 +122,11 @@ class General extends Component
             $this->validate();
             $this->database->name = $this->name;
             $this->database->description = $this->description;
-            $this->database->clickhouse_admin_user = $this->clickhouseAdminUser;
-            $this->database->clickhouse_admin_password = $this->clickhouseAdminPassword;
+            // After the first start the credentials are read-only, so autofilled values must not be saved.
+            if (! $this->database->started_at) {
+                $this->database->clickhouse_admin_user = $this->clickhouseAdminUser;
+                $this->database->clickhouse_admin_password = $this->clickhouseAdminPassword;
+            }
             $this->database->image = $this->image;
             $this->database->ports_mappings = $this->portsMappings;
             $this->database->is_public = $this->isPublic;
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 1505aad781..b3c5bcc945 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -110,7 +110,10 @@ class General extends Component
             $this->validate();
             $this->database->name = $this->name;
             $this->database->description = $this->description;
-            $this->database->dragonfly_password = $this->dragonflyPassword;
+            // After the first start the password is read-only, so autofilled values must not be saved.
+            if (! $this->database->started_at) {
+                $this->database->dragonfly_password = $this->dragonflyPassword;
+            }
             $this->database->image = $this->image;
             $this->database->ports_mappings = $this->portsMappings;
             $this->database->is_public = $this->isPublic;
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index 2ae64f3121..fd84bad209 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -114,7 +114,10 @@ class General extends Component
             $this->database->name = $this->name;
             $this->database->description = $this->description;
             $this->database->keydb_conf = $this->keydbConf;
-            $this->database->keydb_password = $this->keydbPassword;
+            // After the first start the password is read-only, so autofilled values must not be saved.
+            if (! $this->database->started_at) {
+                $this->database->keydb_password = $this->keydbPassword;
+            }
             $this->database->image = $this->image;
             $this->database->ports_mappings = $this->portsMappings;
             $this->database->is_public = $this->isPublic;
diff --git a/app/Livewire/Project/Database/ScheduledBackups.php b/app/Livewire/Project/Database/ScheduledBackups.php
index 2071337b4b..b9da614ea3 100644
--- a/app/Livewire/Project/Database/ScheduledBackups.php
+++ b/app/Livewire/Project/Database/ScheduledBackups.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ServiceDatabase;
+use App\Traits\ListensToTeamChannel;
 use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -10,6 +11,7 @@ use Livewire\Component;
 class ScheduledBackups extends Component
 {
     use AuthorizesRequests;
+    use ListensToTeamChannel;
 
     public $database;
 
@@ -19,7 +21,13 @@ class ScheduledBackups extends Component
 
     public string $custom_type = 'mysql';
 
-    protected $listeners = ['refreshScheduledBackups'];
+    public function getListeners(): array
+    {
+        return [
+            'refreshScheduledBackups',
+            ...$this->teamChannelListeners(['BackupCreated' => '$refresh']),
+        ];
+    }
 
     public function mount(): void
     {
diff --git a/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php b/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
index d55972e97d..5a777d7a59 100644
--- a/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
+++ b/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
@@ -248,6 +248,15 @@ class GithubPrivateRepositoryDeployKey extends Component
             return;
         }
 
+        // Keep ssh:// URLs as-is so a custom SSH port is preserved for deployments.
+        if (str_starts_with($this->repository_url, 'ssh://')) {
+            $this->git_host = parse_url($this->repository_url, PHP_URL_HOST);
+            $this->git_repository = $this->repository_url;
+            $this->git_source = 'other';
+
+            return;
+        }
+
         $this->repository_url_parsed = Url::fromString($this->repository_url);
         $this->git_host = $this->repository_url_parsed->getHost();
         $this->git_repository = $this->repository_url_parsed->getSegment(1).'/'.$this->repository_url_parsed->getSegment(2);
diff --git a/app/Livewire/Project/New/PublicGitRepository.php b/app/Livewire/Project/New/PublicGitRepository.php
index c14c9dcd37..a898204fc2 100644
--- a/app/Livewire/Project/New/PublicGitRepository.php
+++ b/app/Livewire/Project/New/PublicGitRepository.php
@@ -139,7 +139,7 @@ class PublicGitRepository extends Component
                 throw new \RuntimeException('Invalid repository URL: '.$validator->errors()->first('repository_url'));
             }
 
-            $httpsRepositoryUrl = scpStyleGitUrlToHttps($this->repository_url);
+            $httpsRepositoryUrl = sshGitUrlToHttps($this->repository_url);
             if (is_string($httpsRepositoryUrl)) {
                 $this->repository_url = $httpsRepositoryUrl;
             }
diff --git a/app/Livewire/Project/New/Select.php b/app/Livewire/Project/New/Select.php
index 9986bfa1f5..2549cf5239 100644
--- a/app/Livewire/Project/New/Select.php
+++ b/app/Livewire/Project/New/Select.php
@@ -118,6 +118,7 @@ class Select extends Component
                 'name' => str($serviceKey)->headline(),
                 'docsSlug' => str($serviceKey)->lower()->value(),
                 'templateLastUpdated' => $templateLastUpdatedMap[$serviceKey] ?? null,
+                'website' => $this->serviceWebsiteUrl(data_get($service, 'documentation')),
             ] + service_logo_urls(data_get($service, 'logo')) + (array) $service;
         })->all();
 
@@ -288,6 +289,29 @@ class Select extends Component
         }
     }
 
+    /**
+     * Derive a website link from the documentation URL. Shared hosts keep the
+     * path that identifies the project, so the link does not open the host root.
+     */
+    private function serviceWebsiteUrl(?string $documentation): ?string
+    {
+        $url = parse_url((string) $documentation);
+        if (! in_array($url['scheme'] ?? null, ['http', 'https'], true) || blank($url['host'] ?? null)) {
+            return null;
+        }
+
+        $projectPathSegments = [
+            'github.com' => 2,
+            'gitlab.com' => 2,
+            'codeberg.org' => 2,
+            'hub.docker.com' => 3,
+        ][str($url['host'])->lower()->chopStart('www.')->value()] ?? 0;
+
+        $projectPath = str($url['path'] ?? '')->explode('/')->filter()->take($projectPathSegments)->implode('/');
+
+        return rtrim("{$url['scheme']}://{$url['host']}/{$projectPath}", '/');
+    }
+
     private function serviceTemplatesLastUpdated(): ?string
     {
         $fetchedAt = get_service_templates_fetched_at();
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
index b319f66412..d4b63e4766 100644
--- a/app/Livewire/Project/Service/BackupExecutions.php
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -9,6 +9,7 @@ use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use App\Traits\ListensToTeamChannel;
+use App\Traits\PreparesBackupDownloads;
 use Illuminate\Contracts\View\View;
 use Illuminate\Database\Query\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -20,6 +21,7 @@ class BackupExecutions extends Component
 {
     use AuthorizesRequests;
     use ListensToTeamChannel;
+    use PreparesBackupDownloads;
     use WithPagination;
 
     public Service $service;
@@ -62,6 +64,29 @@ class BackupExecutions extends Component
         $this->executionModalOpen = true;
     }
 
+    public function downloadExecution(string $executionUuid): void
+    {
+        $this->authorize('update', $this->service);
+        $row = $this->executionQuery($executionUuid)->first();
+        abort_unless($row, 404);
+
+        try {
+            if ($row->type === 'database') {
+                $execution = ScheduledDatabaseBackupExecution::query()->with('scheduledDatabaseBackup')->findOrFail($row->id);
+                $server = $execution->scheduledDatabaseBackup->server();
+                $streamUrl = route('download.backup', $execution->id);
+            } else {
+                $execution = ScheduledVolumeBackupExecution::query()->with('scheduledVolumeBackup')->findOrFail($row->id);
+                $server = $execution->scheduledVolumeBackup->server();
+                $streamUrl = route('download.volume-backup', $execution->id);
+            }
+
+            $this->prepareBackupDownload($execution->local_storage_deleted ? null : $server, $execution->filename, $streamUrl);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function closeExecutionModal(): void
     {
         $this->executionModalOpen = false;
@@ -80,6 +105,7 @@ class BackupExecutions extends Component
 
         return view('livewire.project.service.backup-executions', [
             'executions' => $executions,
+            's3Downloads' => $this->s3BackupDownloadsEnabled(),
         ]);
     }
 
@@ -114,11 +140,11 @@ class BackupExecutions extends Component
     private function formatExecutions(Collection $rows): Collection
     {
         $databaseExecutions = ScheduledDatabaseBackupExecution::query()
-            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3', 'scheduledDatabaseBackup.s3Storages'])
+            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3', 'scheduledDatabaseBackup.s3Storages', 's3Replicas'])
             ->whereIn('id', $rows->where('type', 'database')->pluck('id'))
             ->get()->keyBy('id');
         $volumeExecutions = ScheduledVolumeBackupExecution::query()
-            ->with(['scheduledVolumeBackup.backupable.resource', 's3'])
+            ->with(['scheduledVolumeBackup.backupable.resource', 's3', 's3Replicas'])
             ->whereIn('id', $rows->where('type', 'storage')->pluck('id'))
             ->get()->keyBy('id');
 
@@ -156,7 +182,7 @@ class BackupExecutions extends Component
                 'size' => $execution->size,
                 'message' => $execution->message,
                 'filename' => $execution->filename,
-                'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                'download_url' => $execution->status === 'success' && $execution->isDownloadable()
                     ? route($isDatabase ? 'download.backup' : 'download.volume-backup', $execution->id)
                     : null,
             ];
diff --git a/app/Livewire/Project/Service/DatabaseBackups.php b/app/Livewire/Project/Service/DatabaseBackups.php
index 71885094aa..c778572f94 100644
--- a/app/Livewire/Project/Service/DatabaseBackups.php
+++ b/app/Livewire/Project/Service/DatabaseBackups.php
@@ -84,8 +84,6 @@ class DatabaseBackups extends Component
                     ->get();
                 $this->backupParameters = [...$this->parameters, 'backup_uuid' => $this->backup->uuid];
                 $this->section = match (request()->route()?->getName()) {
-                    'project.service.database.backup.s3' => 's3',
-                    'project.service.database.backup.retention' => 'retention',
                     'project.service.database.backup.executions' => 'executions',
                     'project.service.database.backup.danger' => 'danger',
                     default => 'general',
diff --git a/app/Livewire/Project/Service/ResourceCard.php b/app/Livewire/Project/Service/ResourceCard.php
index 22ed772a80..5b67baab01 100644
--- a/app/Livewire/Project/Service/ResourceCard.php
+++ b/app/Livewire/Project/Service/ResourceCard.php
@@ -24,6 +24,7 @@ class ResourceCard extends Component
     public function getListeners(): array
     {
         return $this->teamChannelListeners([
+            'ServiceStatusChanged' => 'refreshResource',
             'ServiceChecked' => 'refreshResource',
         ]);
     }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index 64dbbb8df2..e73bc12216 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -45,6 +45,7 @@ class Index extends Component
             'modalClosed' => 'closeScheduleModal',
             ...$this->teamChannelListeners([
                 'ServiceChecked' => '$refresh',
+                'ServiceStatusChanged' => '$refresh',
                 'BackupCreated' => '$refresh',
             ]),
         ];
diff --git a/app/Livewire/Project/Service/VolumeBackup/Show.php b/app/Livewire/Project/Service/VolumeBackup/Show.php
index 10abeb3bf4..8ca50d458a 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Show.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Show.php
@@ -37,8 +37,6 @@ class Show extends Component
             ->firstOrFail();
         $this->parameters = get_route_parameters();
         $this->section = match (request()->route()?->getName()) {
-            'project.service.volume-backups.s3' => 's3',
-            'project.service.volume-backups.retention' => 'retention',
             'project.service.volume-backups.executions' => 'executions',
             'project.service.volume-backups.danger' => 'danger',
             default => 'general',
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index daad018b2b..736075dc7c 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -57,6 +57,8 @@ class All extends Component
 
     public bool $use_build_secrets = false;
 
+    public bool $include_coolify_default_variables = true;
+
     public bool $redact_all_env_values_in_logs = true;
 
     /**
@@ -111,6 +113,8 @@ class All extends Component
     {
         $this->is_env_sorting_enabled = data_get($this->resource, 'settings.is_env_sorting_enabled', false);
         $this->use_build_secrets = data_get($this->resource, 'settings.use_build_secrets', false);
+        $coolifyDefaultVariablesOwner = $this->resource instanceof Application ? $this->resource->settings : $this->resource;
+        $this->include_coolify_default_variables = data_get($coolifyDefaultVariablesOwner, 'include_coolify_default_variables') !== false;
         if ($this->hasLogRedactionSetting()) {
             $this->redact_all_env_values_in_logs = $this->resource->redactsAllEnvValuesInLogs();
         }
@@ -201,6 +205,25 @@ class All extends Component
         }
     }
 
+    public function saveCoolifyDefaultVariables()
+    {
+        try {
+            $this->authorize('manageEnvironment', $this->resource);
+
+            if ($this->resource instanceof Application) {
+                $this->resource->settings->include_coolify_default_variables = $this->include_coolify_default_variables;
+                $this->saveApplicationSettingsWithAudit($this->resource);
+            } else {
+                $this->resource->include_coolify_default_variables = $this->include_coolify_default_variables;
+                $this->resource->save();
+            }
+            $this->dispatch('success', 'Environment variable settings updated.');
+            $this->dispatch('configurationChanged');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function getEnvironmentVariablesProperty()
     {
         if (! $this->readyToLoad) {
diff --git a/app/Livewire/Project/Shared/ExecuteContainerCommand.php b/app/Livewire/Project/Shared/ExecuteContainerCommand.php
index d8ce2e03fc..a3ddb9dc2e 100644
--- a/app/Livewire/Project/Shared/ExecuteContainerCommand.php
+++ b/app/Livewire/Project/Shared/ExecuteContainerCommand.php
@@ -76,9 +76,6 @@ class ExecuteContainerCommand extends Component
             $this->type = 'service';
             $this->resource = Service::ownedByCurrentTeam()->where('uuid', $this->parameters['service_uuid'])->firstOrFail();
             $this->authorize('view', $this->resource);
-            if (! $this->resource->isRunning()) {
-                $this->containersLoaded = true;
-            }
             if ($this->resource->server->isFunctional()) {
                 $this->servers = $this->servers->push($this->resource->server);
             }
@@ -140,7 +137,7 @@ class ExecuteContainerCommand extends Component
                     }
                 });
                 $this->resource->databases()->get()->each(function ($database) {
-                    if ($database->isRunning()) {
+                    if ($database->isRunning() && $this->resource->server->isTerminalEnabled()) {
                         $this->containers->push([
                             'server' => $this->resource->server,
                             'container' => [
diff --git a/app/Livewire/Project/Shared/FileBrowser.php b/app/Livewire/Project/Shared/FileBrowser.php
new file mode 100644
index 0000000000..09f8f0c6b9
--- /dev/null
+++ b/app/Livewire/Project/Shared/FileBrowser.php
@@ -0,0 +1,545 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Http\Controllers\FileBrowserDownloadController;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Models\Application;
+use App\Models\Server;
+use App\Models\Service;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use App\Support\ValidationPatterns;
+use Illuminate\Contracts\View\View;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
+use Livewire\WithFileUploads;
+
+class FileBrowser extends Component
+{
+    use AuthorizesRequests;
+    use WithFileUploads;
+
+    #[Locked]
+    public Model $resource;
+
+    /** Uploads to S3 hold a queue worker, so each user may only start a few. */
+    private const MAX_PENDING_S3_DOWNLOADS = 3;
+
+    #[Locked]
+    public string $type = '';
+
+    #[Locked]
+    public bool $containerRunning = false;
+
+    #[Locked]
+    public bool $filesLoaded = false;
+
+    #[Locked]
+    public bool $loadFailed = false;
+
+    #[Locked]
+    public ?string $container = null;
+
+    /** @var array<int, string> */
+    #[Locked]
+    public array $availableContainers = [];
+
+    public string $currentPath = '';
+
+    /** @var array<int, array{name:string,type:string,size:int,mtime:int}> */
+    public array $entries = [];
+
+    #[Locked]
+    public ?string $editingPath = null;
+
+    public bool $editorOpen = false;
+
+    public string $editorContent = '';
+
+    public string $editorLanguage = '';
+
+    public ?TemporaryUploadedFile $upload = null;
+
+    /** @var array<int, string> */
+    #[Locked]
+    public array $pendingDownloads = [];
+
+    /** @var array<string, mixed> */
+    public array $parameters = [];
+
+    public function mount(?Model $resource = null): void
+    {
+        $this->parameters = get_route_parameters();
+        $resource = $resource ?? $this->resolveResourceFromRoute();
+
+        // Security gate first, before any server or container resolution.
+        $this->authorize('canAccessTerminal');
+        $this->authorize('view', $resource);
+        abort_unless((int) $resource->environment->project->team_id === (int) auth()->user()->currentTeam()->id, 403);
+
+        $this->resource = $resource;
+        $this->type = $this->resolveType($resource);
+        $this->containerRunning = (bool) $resource->isRunning();
+
+        $this->filesLoaded = ! $this->containerRunning;
+    }
+
+    public function loadFiles(): void
+    {
+        $this->authorizeFileAccess();
+        if ($this->filesLoaded) {
+            return;
+        }
+        $this->loadFailed = false;
+        $this->containerRunning = (bool) $this->resource->isRunning();
+
+        try {
+            $this->availableContainers = $this->containerRunning ? $this->resolveContainers() : [];
+            $this->container = $this->availableContainers[0] ?? null;
+            if (is_null($this->container)) {
+                $this->containerRunning = false;
+            } else {
+                $this->currentPath = $this->service()->defaultRoot();
+                $this->loadEntries();
+            }
+            $this->filesLoaded = true;
+        } catch (\Throwable $e) {
+            $this->container = null;
+            $this->loadFailed = true;
+            handleError($e, $this);
+        }
+    }
+
+    public function selectContainer(string $name): void
+    {
+        $this->guard();
+        if (! in_array($name, $this->availableContainers, true)) {
+            return;
+        }
+        $this->closeEditor();
+        $this->container = $name;
+        $this->currentPath = $this->service()->defaultRoot();
+        $this->loadEntries();
+    }
+
+    public function open(string $name): void
+    {
+        $this->guard();
+        $this->currentPath = $this->childPath($name);
+        $this->loadEntries();
+    }
+
+    public function goTo(string $path): void
+    {
+        $this->guard();
+        if (! str_starts_with($path, '/')) {
+            return;
+        }
+        $this->currentPath = $path === '/' ? '/' : rtrim($path, '/');
+        $this->loadEntries();
+    }
+
+    public function refresh(): void
+    {
+        $this->guard();
+        $this->loadEntries();
+    }
+
+    public function createDirectory(string $name): void
+    {
+        $this->guard();
+        try {
+            $this->service()->makeDirectory($this->childPath($name));
+            $this->loadEntries();
+            $this->dispatch('success', 'Folder created.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function createFile(string $name): void
+    {
+        $this->guard();
+        try {
+            $this->service()->createFile($this->childPath($name));
+            $this->loadEntries();
+            $this->dispatch('success', 'File created.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function chmodEntry(string $name, string $mode): void
+    {
+        $this->guard();
+        try {
+            $this->service()->chmod($this->childPath($name), $mode);
+            $this->loadEntries();
+            $this->dispatch('success', 'Permissions updated.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function renameEntry(string $from, string $newName): void
+    {
+        $this->guard();
+        try {
+            $this->service()->rename($this->childPath($from), $this->childPath($newName));
+            $this->loadEntries();
+            $this->dispatch('success', 'Renamed.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function deleteEntry(string $name): void
+    {
+        $this->guard();
+        try {
+            $this->service()->delete($this->childPath($name));
+            $this->loadEntries();
+            $this->dispatch('success', 'Deleted.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function openEditor(string $name): void
+    {
+        $this->guard();
+        $path = $this->childPath($name);
+        try {
+            // read() guards binary/oversized files internally and throws.
+            $this->editorContent = $this->service()->read($path);
+            $this->editorLanguage = $this->guessLanguage($name);
+            $this->editingPath = $path;
+            $this->editorOpen = true;
+            // Push content + language into the mounted Monaco editor. It lives
+            // behind wire:ignore, so a dispatched event is how it receives them.
+            $this->dispatch('load-file-editor', content: $this->editorContent, language: $this->editorLanguage);
+        } catch (\RuntimeException $e) {
+            $this->dispatch('error', "Can't edit this file - it's binary or larger than 5 MB. Download it instead.");
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function saveEditor(): void
+    {
+        $this->guard();
+        if (is_null($this->editingPath)) {
+            return;
+        }
+        try {
+            $this->service()->write($this->editingPath, $this->editorContent);
+            $this->editingPath = null;
+            $this->editorOpen = false;
+            $this->editorContent = '';
+            $this->loadEntries();
+            $this->dispatch('success', 'Saved.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function closeEditor(): void
+    {
+        $this->editingPath = null;
+        $this->editorOpen = false;
+        $this->editorContent = '';
+    }
+
+    public function uploadFile(): void
+    {
+        $this->guard();
+        $this->validate(['upload' => 'required|file|max:1048576']); // 1 GB (KB units)
+        try {
+            $localTmp = $this->upload->getRealPath();
+            $filename = $this->sanitizeUploadName($this->upload->getClientOriginalName());
+            $this->service()->upload($localTmp, $this->childPath($filename));
+            $this->upload = null;
+            $this->loadEntries();
+            $this->dispatch('success', 'Uploaded.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function download(string $name): void
+    {
+        $this->guard();
+        try {
+            $path = $this->childPath($name);
+            $target = $this->service()->downloadInfo($path);
+            $downloadName = $target['isDir'] ? $name.'.tar.gz' : $name;
+            $s3Storage = FileDownloadStorageService::configuredStorage();
+            $maxSize = $s3Storage ? FileDownloadStorageService::MAX_SIZE : ContainerFilesystemService::MAX_DOWNLOAD_SIZE;
+            if ($target['size'] > $maxSize) {
+                $this->dispatch('error', ($target['isDir'] ? 'This folder' : 'This file').' is larger than '.formatBytes($maxSize).' and cannot be downloaded here. Use the terminal or a volume backup instead.');
+
+                return;
+            }
+
+            if ($s3Storage) {
+                if (count($this->pendingDownloads) >= self::MAX_PENDING_S3_DOWNLOADS
+                    || ! RateLimiter::attempt('file-browser-s3-download:'.auth()->id(), 10, fn () => true, 3600)) {
+                    $this->dispatch('error', 'Too many downloads are in progress. Wait for them to finish, then try again.');
+
+                    return;
+                }
+                $downloadId = (string) Str::uuid();
+                $this->pendingDownloads[] = $downloadId;
+                PrepareFileDownloadJob::dispatch($downloadId, auth()->id(), $this->server()->id, $this->container, $path, $target['isDir'], $downloadName, $s3Storage->id);
+                $this->dispatch('info', 'Preparing '.$downloadName.'. The download starts when it is ready.');
+
+                return;
+            }
+
+            $token = Str::random(64);
+            Cache::put(FileBrowserDownloadController::cacheKey($token), [
+                'user_id' => auth()->id(),
+                'resource_type' => $this->resource::class,
+                'resource_id' => $this->resource->getKey(),
+                'server_id' => $this->server()->id,
+                'container' => $this->container,
+                'path' => $path,
+                'name' => $downloadName,
+                'is_dir' => $target['isDir'],
+            ], FileBrowserDownloadController::TOKEN_TTL_SECONDS);
+
+            $this->redirect(route('project.files.download', $token));
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    /**
+     * Polled while S3 downloads are prepared. Opens each finished link once.
+     */
+    public function checkDownloads(): void
+    {
+        $this->authorizeFileAccess();
+        foreach ($this->pendingDownloads as $index => $downloadId) {
+            $result = Cache::get(PrepareFileDownloadJob::cacheKey($downloadId));
+            if (! is_array($result) || ($result['user_id'] ?? null) !== auth()->id()) {
+                continue;
+            }
+
+            unset($this->pendingDownloads[$index]);
+            Cache::forget(PrepareFileDownloadJob::cacheKey($downloadId));
+            if ($result['status'] === 'ready') {
+                $this->dispatch('open-file-download', url: $result['url']);
+            } else {
+                $this->dispatch('error', $result['message']);
+            }
+        }
+        $this->pendingDownloads = array_values($this->pendingDownloads);
+    }
+
+    /**
+     * Reduce a client-supplied upload name to a single safe basename,
+     * stripping any directory traversal before it reaches the container.
+     */
+    protected function sanitizeUploadName(string $name): string
+    {
+        $name = basename(str_replace('\\', '/', $name));
+        if ($name === '' || preg_match('/^\.+$/', $name) === 1) {
+            throw new \RuntimeException('Invalid file name.');
+        }
+
+        return $name;
+    }
+
+    /**
+     * Map a filename to a Monaco language id for the editor. Falls back to
+     * well-known whole-file names so extension-less files still highlight.
+     */
+    protected function guessLanguage(string $name): string
+    {
+        $extMap = [
+            'js' => 'javascript', 'mjs' => 'javascript', 'cjs' => 'javascript', 'ts' => 'typescript',
+            'json' => 'json', 'php' => 'php', 'py' => 'python', 'rb' => 'ruby', 'go' => 'go',
+            'rs' => 'rust', 'java' => 'java', 'sh' => 'shell', 'bash' => 'shell', 'zsh' => 'shell',
+            'yml' => 'yaml', 'yaml' => 'yaml', 'toml' => 'ini', 'ini' => 'ini', 'env' => 'ini',
+            'conf' => 'ini', 'cnf' => 'ini', 'md' => 'markdown', 'markdown' => 'markdown', 'html' => 'html',
+            'htm' => 'html', 'xml' => 'xml', 'svg' => 'xml', 'css' => 'css', 'scss' => 'scss',
+            'sql' => 'sql', 'dockerfile' => 'dockerfile',
+        ];
+
+        $base = strtolower(basename($name));
+
+        // Whole-name matches for common extension-less/dotfiles.
+        $nameMap = [
+            'dockerfile' => 'dockerfile', 'containerfile' => 'dockerfile',
+            '.gitignore' => 'ini', '.dockerignore' => 'ini', '.editorconfig' => 'ini',
+            '.npmrc' => 'ini', '.gitconfig' => 'ini',
+            '.bashrc' => 'shell', '.bash_profile' => 'shell', '.bash_aliases' => 'shell',
+            '.profile' => 'shell', '.zshrc' => 'shell', '.zprofile' => 'shell',
+        ];
+        if (isset($nameMap[$base])) {
+            return $nameMap[$base];
+        }
+        if ($base === '.env' || str_starts_with($base, '.env.')) {
+            return 'ini';
+        }
+
+        $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
+
+        return $extMap[$ext] ?? '';
+    }
+
+    protected function childPath(string $name): string
+    {
+        if ($name === '' || $name === '.' || $name === '..' || str_contains($name, '/') || str_contains($name, '\\') || str_contains($name, "\0")) {
+            throw new \InvalidArgumentException('Invalid file name.');
+        }
+        validateShellSafePath($name, 'file name');
+
+        return rtrim($this->currentPath, '/').'/'.$name;
+    }
+
+    protected function authorizeFileAccess(): void
+    {
+        $this->authorize('canAccessTerminal');
+        $this->resource->refresh();
+        $this->authorize('view', $this->resource);
+        abort_unless((int) $this->resource->environment->project->team_id === (int) auth()->user()->currentTeam()->id, 403);
+    }
+
+    protected function guard(): void
+    {
+        $this->authorizeFileAccess();
+        $this->type = $this->resolveType($this->resource);
+        $this->containerRunning = (bool) $this->resource->isRunning();
+        $this->availableContainers = $this->containerRunning ? $this->resolveContainers() : [];
+        if (! $this->containerRunning || is_null($this->container) || ! in_array($this->container, $this->availableContainers, true)) {
+            throw new \RuntimeException('Container is not running.');
+        }
+    }
+
+    /**
+     * @return array<int, array{label:string,path:string}>
+     */
+    public function breadcrumbs(): array
+    {
+        $crumbs = [['label' => '/', 'path' => '/']];
+        $accumulated = '';
+        foreach (array_filter(explode('/', $this->currentPath)) as $segment) {
+            $accumulated .= '/'.$segment;
+            $crumbs[] = ['label' => $segment, 'path' => $accumulated];
+        }
+
+        return $crumbs;
+    }
+
+    protected function loadEntries(): void
+    {
+        $entries = $this->service()->list($this->currentPath);
+        $this->entries = array_map(fn ($e) => [
+            'name' => $e->name,
+            'type' => $e->type,
+            'size' => $e->size,
+            'mtime' => $e->mtime,
+            'perms' => $e->perms,
+            'owner' => $e->owner,
+            'group' => $e->group,
+        ], $entries);
+    }
+
+    protected function service(): ContainerFilesystemService
+    {
+        return new ContainerFilesystemService($this->server(), $this->container);
+    }
+
+    protected function server(): Server
+    {
+        return match ($this->type) {
+            'service' => $this->resource->server,
+            default => $this->resource->destination->server,
+        };
+    }
+
+    protected function resolveResourceFromRoute(): Model
+    {
+        $parameters = get_route_parameters();
+        $teamId = data_get(auth()->user()->currentTeam(), 'id');
+
+        if ($uuid = data_get($parameters, 'application_uuid')) {
+            return Application::ownedByCurrentTeam()->where('uuid', $uuid)->firstOrFail();
+        }
+        if ($uuid = data_get($parameters, 'service_uuid')) {
+            return Service::ownedByCurrentTeam()->where('uuid', $uuid)->firstOrFail();
+        }
+        if ($uuid = data_get($parameters, 'database_uuid')) {
+            $resource = getResourceByUuid($uuid, $teamId);
+            if (is_null($resource)) {
+                abort(404);
+            }
+
+            return $resource;
+        }
+
+        abort(404);
+    }
+
+    protected function resolveType(Model $resource): string
+    {
+        return match (true) {
+            $resource instanceof Application => 'application',
+            $resource instanceof Service => 'service',
+            default => 'database',
+        };
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    protected function resolveContainers(): array
+    {
+        if ($this->type === 'service') {
+            $names = [];
+            $this->resource->applications()->get()->each(function ($application) use (&$names) {
+                if ($application->isRunning()) {
+                    $names[] = $application->name.'-'.$this->resource->uuid;
+                }
+            });
+            $this->resource->databases()->get()->each(function ($database) use (&$names) {
+                if ($database->isRunning()) {
+                    $names[] = $database->name.'-'.$this->resource->uuid;
+                }
+            });
+
+            return array_values(array_filter($names, [ValidationPatterns::class, 'isValidContainerName']));
+        }
+
+        if ($this->type === 'application') {
+            $server = $this->server();
+            $names = getCurrentApplicationContainerStatus($server, $this->resource, includePullrequests: false)
+                ->filter(fn ($c) => data_get($c, 'State') === 'running')
+                ->map(fn ($c) => data_get($c, 'Names'))
+                ->filter()
+                ->values()
+                ->all();
+
+            return array_values(array_filter($names, [ValidationPatterns::class, 'isValidContainerName']));
+        }
+
+        // Standalone database: the container name is the resource uuid.
+        $name = $this->resource->uuid;
+
+        return ValidationPatterns::isValidContainerName($name) ? [$name] : [];
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.shared.file-browser');
+    }
+}
diff --git a/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php b/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
index d936333a92..02f1718ede 100644
--- a/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
+++ b/app/Livewire/Project/Shared/ResourceTrafficAnalytics.php
@@ -65,7 +65,7 @@ abstract class ResourceTrafficAnalytics extends Component
     public array $series = [];
 
     /** @var array<int, string> */
-    protected array $breakdownDimensions = ['country', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
+    protected array $breakdownDimensions = ['country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'cache', 'status', 'agent', 'ip', 'useragent'];
 
     /**
      * Name of the public model property and lazy-load parameter ('application' / 'service').
diff --git a/app/Livewire/Project/Shared/ScheduledTask/All.php b/app/Livewire/Project/Shared/ScheduledTask/All.php
index b58e4f97a9..124c907210 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/All.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/All.php
@@ -2,13 +2,18 @@
 
 namespace App\Livewire\Project\Shared\ScheduledTask;
 
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\On;
+use Livewire\Attributes\Url;
 use Livewire\Component;
 
 class All extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public $resource;
 
@@ -19,6 +24,18 @@ class All extends Component
 
     public ?string $variables = null;
 
+    #[Url(as: 'task_uuid', except: '')]
+    public string $taskUuid = '';
+
+    public bool $taskModalOpen = false;
+
+    public function getListeners(): array
+    {
+        return [
+            'modalClosed' => 'closeTask',
+        ];
+    }
+
     public function mount()
     {
         $this->parameters = get_route_parameters();
@@ -34,6 +51,30 @@ class All extends Component
                 $this->containerNames = collect([]);
             }
         }
+
+        if ($this->taskUuid !== '') {
+            $this->openTask($this->taskUuid);
+        }
+    }
+
+    public function openTask(string $taskUuid): void
+    {
+        $this->authorize('view', $this->resource);
+        $this->taskUuid = $this->resource->scheduled_tasks()->where('uuid', $taskUuid)->firstOrFail()->uuid;
+        $this->taskModalOpen = true;
+    }
+
+    public function closeTask(): void
+    {
+        $this->taskUuid = '';
+        $this->taskModalOpen = false;
+        $this->resource->refresh();
+    }
+
+    #[On('scheduledTaskDeleted')]
+    public function taskDeleted(): void
+    {
+        $this->closeTask();
     }
 
     #[On('refreshTasks')]
@@ -41,4 +82,13 @@ class All extends Component
     {
         $this->resource->refresh();
     }
+
+    public function render(): View
+    {
+        return view('livewire.project.shared.scheduled-task.all', [
+            'selectedTask' => $this->taskUuid === ''
+                ? null
+                : $this->resource->scheduled_tasks()->where('uuid', $this->taskUuid)->first(),
+        ]);
+    }
 }
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Executions.php b/app/Livewire/Project/Shared/ScheduledTask/Executions.php
index 76e0735ff4..f7e5ca1d1f 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Executions.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Executions.php
@@ -6,6 +6,7 @@ use App\Models\ScheduledTask;
 use App\Traits\ListensToTeamChannel;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
+use Livewire\Attributes\Computed;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
@@ -13,9 +14,6 @@ class Executions extends Component
 {
     use ListensToTeamChannel;
 
-    #[Locked]
-    public ScheduledTask $task;
-
     #[Locked]
     public int $taskId;
 
@@ -48,11 +46,11 @@ class Executions extends Component
     {
         try {
             $this->taskId = $taskId;
-            $this->task = ScheduledTask::where('team_id', Auth::user()->currentTeam()->id)->findOrFail($taskId);
-            $this->executions = $this->task->executions()->take(20)->get();
-            $this->serverTimezone = data_get($this->task, 'application.destination.server.settings.server_timezone');
+            $task = ScheduledTask::where('team_id', Auth::user()->currentTeam()->id)->findOrFail($taskId);
+            $this->executions = $task->executions()->take(20)->get();
+            $this->serverTimezone = data_get($task, 'application.destination.server.settings.server_timezone');
             if (! $this->serverTimezone) {
-                $this->serverTimezone = data_get($this->task, 'service.destination.server.settings.server_timezone');
+                $this->serverTimezone = data_get($task, 'service.destination.server.settings.server_timezone');
             }
             if (! $this->serverTimezone) {
                 $this->serverTimezone = 'UTC';
@@ -62,8 +60,22 @@ class Executions extends Component
         }
     }
 
+    /**
+     * Load the task on each request instead of storing it as a model property. A stored model fails
+     * with a 404 when the poll runs after the task is deleted and before the page navigates away.
+     */
+    #[Computed]
+    public function task(): ?ScheduledTask
+    {
+        return ScheduledTask::find($this->taskId);
+    }
+
     public function refreshExecutions(): void
     {
+        if (! $this->task) {
+            return;
+        }
+
         $this->executions = $this->task->executions()->take(20)->get();
         if ($this->selectedKey) {
             $this->selectedExecution = $this->task->executions()->find($this->selectedKey);
@@ -84,7 +96,7 @@ class Executions extends Component
             return;
         }
         $this->selectedKey = $key;
-        $this->selectedExecution = $this->task->executions()->find($key);
+        $this->selectedExecution = $this->task?->executions()->find($key);
         $this->currentPage = 1;
 
         // Start polling if task is running
@@ -157,7 +169,9 @@ class Executions extends Component
      */
     public function canReadOutput(): bool
     {
-        return auth()->user()?->can('update', $this->task->application ?? $this->task->service) ?? false;
+        $resource = $this->task?->application ?? $this->task?->service;
+
+        return $resource && auth()->user()?->can('update', $resource);
     }
 
     public function hasMoreLogs()
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 4419b2e701..5f5689b5de 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -45,46 +45,13 @@ class Show extends Component
     #[Validate(['integer', 'required', 'min:60', 'max:36000'])]
     public $timeout = 300;
 
-    #[Locked]
-    public ?string $application_uuid;
-
-    #[Locked]
-    public ?string $service_uuid;
-
-    #[Locked]
-    public string $task_uuid;
-
-    public function mount()
+    public function mount(Application|Service $resource, ScheduledTask $task): void
     {
-        try {
-            $task_uuid = request()->route('task_uuid');
-            $project_uuid = request()->route('project_uuid');
-            $environment_uuid = request()->route('environment_uuid');
-            $application_uuid = request()->route('application_uuid');
-            $service_uuid = request()->route('service_uuid');
-
-            $this->task_uuid = $task_uuid;
-            if ($application_uuid) {
-                $this->type = 'application';
-                $this->application_uuid = $application_uuid;
-                $this->resource = Application::ownedByCurrentTeam()->where('uuid', $application_uuid)->firstOrFail();
-            } elseif ($service_uuid) {
-                $this->type = 'service';
-                $this->service_uuid = $service_uuid;
-                $this->resource = Service::ownedByCurrentTeamCached()->where('uuid', $service_uuid)->firstOrFail();
-            }
-            $this->parameters = [
-                'environment_uuid' => $environment_uuid,
-                'project_uuid' => $project_uuid,
-                'application_uuid' => $application_uuid,
-                'service_uuid' => $service_uuid,
-            ];
-
-            $this->task = $this->resource->scheduled_tasks()->where('uuid', $task_uuid)->firstOrFail();
-            $this->syncData();
-        } catch (\Exception $e) {
-            return handleError($e);
-        }
+        $this->resource = $resource;
+        $this->type = $resource->type();
+        $this->parameters = get_route_parameters();
+        $this->task = $resource->scheduled_tasks()->whereKey($task->id)->firstOrFail();
+        $this->syncData();
     }
 
     /**
@@ -178,12 +145,11 @@ class Show extends Component
             $this->authorize('delete', $this->task);
             $this->task->delete();
             auditLog('ui.scheduled_task.deleted', $this->taskAuditContext());
+            $this->dispatch('success', 'Scheduled task deleted.');
+            $this->dispatch('scheduledTaskDeleted')->to(All::class);
 
-            if ($this->type === 'application') {
-                return redirectRoute($this, 'project.application.scheduled-tasks.show', $this->parameters);
-            } else {
-                return redirectRoute($this, 'project.service.scheduled-tasks.show', $this->parameters);
-            }
+            // Without true, the confirmation modal refreshes this deleted task.
+            return true;
         } catch (\Exception $e) {
             return handleError($e);
         }
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index 083585fee6..bfa122d0e2 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -11,6 +11,8 @@ use App\Models\LocalPersistentVolume;
 use App\Models\S3Storage;
 use App\Models\ScheduledVolumeBackup;
 use App\Models\Service;
+use App\Traits\ListensToTeamChannel;
+use App\Traits\PreparesBackupDownloads;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\RedirectResponse;
@@ -24,6 +26,8 @@ use Throwable;
 class VolumeBackups extends Component
 {
     use AuthorizesRequests;
+    use ListensToTeamChannel;
+    use PreparesBackupDownloads;
     use WithPagination;
 
     public LocalPersistentVolume|LocalFileVolume $storage;
@@ -34,6 +38,9 @@ class VolumeBackups extends Component
 
     public string $section = 'general';
 
+    /** The page shows the backup actions in the top header bar instead. */
+    public bool $actionsInHeader = false;
+
     public string $frequency = 'daily';
 
     public bool $enabled = false;
@@ -67,6 +74,15 @@ class VolumeBackups extends Component
 
     public int $perPage = 10;
 
+    public function getListeners(): array
+    {
+        if ($this->section !== 'executions') {
+            return [];
+        }
+
+        return $this->teamChannelListeners(['BackupCreated' => '$refresh']);
+    }
+
     public function updatedPerPage(): void
     {
         $this->perPage = max(1, min(100, $this->perPage));
@@ -329,6 +345,28 @@ class VolumeBackups extends Component
         $this->dispatch('success', 'Backup recovery queued.');
     }
 
+    public function downloadBackup(int $executionId): void
+    {
+        $this->authorize('update', $this->resource);
+
+        $execution = $this->backup?->executions()->whereKey($executionId)->first();
+        if (! $execution) {
+            $this->dispatch('error', 'Backup execution not found.');
+
+            return;
+        }
+
+        try {
+            $this->prepareBackupDownload(
+                $execution->local_storage_deleted ? null : $this->backup->server(),
+                $execution->filename,
+                route('download.volume-backup', $execution->id),
+            );
+        } catch (Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function deleteBackup(int $executionId, string $password, array $selectedActions = []): bool|string
     {
         $this->authorize('update', $this->resource);
@@ -383,6 +421,7 @@ class VolumeBackups extends Component
         return view('livewire.project.shared.storages.volume-backups', [
             'executions' => $executions ?? collect(),
             'latestExecution' => $this->backup?->executions()->first(),
+            's3Downloads' => $this->s3BackupDownloadsEnabled(),
             'deleteScheduleCheckboxes' => [
                 ['id' => 'delete_associated_backups_locally', 'label' => 'Delete all local archives created by this schedule.'],
                 ['id' => 'delete_associated_backups_s3', 'label' => 'Delete all S3 archives created by this schedule.'],
diff --git a/app/Livewire/Project/Shared/Webhooks.php b/app/Livewire/Project/Shared/Webhooks.php
index 172d91fc5e..4a21654838 100644
--- a/app/Livewire/Project/Shared/Webhooks.php
+++ b/app/Livewire/Project/Shared/Webhooks.php
@@ -2,11 +2,14 @@
 
 namespace App\Livewire\Project\Shared;
 
+use App\Models\Application;
+use App\Models\GitlabApp;
 use App\Rules\ManualWebhookSecret;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Str;
 use Illuminate\Validation\ValidationException;
 use Livewire\Component;
+use Spatie\Url\Url;
 
 // Refactored ✅
 class Webhooks extends Component
@@ -25,6 +28,12 @@ class Webhooks extends Component
 
     public ?string $giteaManualWebhook;
 
+    /**
+     * Source-level endpoint for GitLab App sources. GitLab has no app-level webhooks,
+     * so users add this URL to each GitLab project themselves.
+     */
+    public ?string $gitlabAppWebhook = null;
+
     public ?string $githubManualWebhookSecret = null;
 
     public ?string $gitlabManualWebhookSecret = null;
@@ -33,6 +42,14 @@ class Webhooks extends Component
 
     public ?string $giteaManualWebhookSecret = null;
 
+    /**
+     * Stored secret per component property. The unsaved bar compares the fields
+     * with these values, because Livewire syncs unsaved field edits with every request.
+     *
+     * @var array<string, string|null>
+     */
+    public array $savedSecrets = [];
+
     /**
      * Maps each manual webhook provider to its component property and model attribute.
      *
@@ -54,12 +71,17 @@ class Webhooks extends Component
             $this->gitlabManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_gitlab');
             $this->bitbucketManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_bitbucket');
             $this->giteaManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_gitea');
+            $this->syncSavedSecrets();
         }
 
         $this->githubManualWebhook = generateGitManualWebhook($this->resource, 'github');
         $this->gitlabManualWebhook = generateGitManualWebhook($this->resource, 'gitlab');
         $this->bitbucketManualWebhook = generateGitManualWebhook($this->resource, 'bitbucket');
         $this->giteaManualWebhook = generateGitManualWebhook($this->resource, 'gitea');
+
+        if ($this->resource instanceof Application && $this->resource->source instanceof GitlabApp) {
+            $this->gitlabAppWebhook = Url::fromString(base_url()).'/webhooks/source/gitlab/events';
+        }
     }
 
     public function canViewSecrets(): bool
@@ -78,6 +100,7 @@ class Webhooks extends Component
                 'manual_webhook_secret_bitbucket' => $this->bitbucketManualWebhookSecret,
                 'manual_webhook_secret_gitea' => $this->giteaManualWebhookSecret,
             ]);
+            $this->syncSavedSecrets();
             $this->dispatch('success', 'Webhook secrets saved.');
         } catch (ValidationException $e) {
             throw $e;
@@ -87,10 +110,10 @@ class Webhooks extends Component
     }
 
     /**
-     * Return a random secret for the provider's field. The browser fills the field
-     * as an unsaved change, and the user saves it with the form.
+     * Generate a random secret for the provider and save it immediately.
+     * Other unsaved secret edits in the form are kept as they are.
      */
-    public function generateSecret(string $provider): ?string
+    public function generateSecret(string $provider): void
     {
         try {
             $this->authorize('update', $this->resource);
@@ -99,11 +122,21 @@ class Webhooks extends Component
                 throw new \InvalidArgumentException('Unknown webhook provider.');
             }
 
-            return Str::random(40);
+            $field = self::SECRET_FIELDS[$provider];
+            $secret = Str::random(40);
+            $this->resource->update([$field['attribute'] => $secret]);
+            $this->{$field['property']} = $secret;
+            $this->savedSecrets[$field['property']] = $secret;
+            $this->dispatch('success', "New {$field['label']} generated and saved.");
         } catch (\Exception $e) {
             handleError($e, $this);
+        }
+    }
 
-            return null;
+    private function syncSavedSecrets(): void
+    {
+        foreach (self::SECRET_FIELDS as $field) {
+            $this->savedSecrets[$field['property']] = data_get($this->resource, $field['attribute']);
         }
     }
 
diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index bd7189bd24..0a255370e5 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -2,7 +2,6 @@
 
 namespace App\Livewire\Security;
 
-use App\Models\InstanceSettings;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Validation\Rule;
 use Laravel\Sanctum\PersonalAccessToken;
@@ -35,10 +34,6 @@ class ApiTokens extends Component
         365 => '1 year',
     ];
 
-    public $isApiEnabled;
-
-    public $isMcpEnabled;
-
     #[Locked]
     public bool $canUseRootPermissions = false;
 
@@ -58,9 +53,6 @@ class ApiTokens extends Component
 
     public function mount()
     {
-        $settings = InstanceSettings::get();
-        $this->isApiEnabled = $settings->is_api_enabled;
-        $this->isMcpEnabled = $settings->is_mcp_server_enabled;
         $this->canUseRootPermissions = auth()->user()->can('useRootPermissions', PersonalAccessToken::class);
         $this->canUseWritePermissions = auth()->user()->can('useWritePermissions', PersonalAccessToken::class);
         $this->canUseDeployPermissions = auth()->user()->can('useDeployPermissions', PersonalAccessToken::class);
diff --git a/app/Livewire/Server/Delete.php b/app/Livewire/Server/Delete.php
index c3539aa282..2b5051c65e 100644
--- a/app/Livewire/Server/Delete.php
+++ b/app/Livewire/Server/Delete.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Server;
 use App\Actions\Server\DeleteServer;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Server;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -46,6 +47,16 @@ class Delete extends Component
             $this->delete_from_hostinger = in_array('delete_from_hostinger', $selectedActions);
             $this->force_delete_resources = in_array('force_delete_resources', $selectedActions);
         }
+        // Another Coolify instance manages a transferred server. This instance deletes only its own records:
+        // never the VM, and never the containers that the other instance runs.
+        $isArchive = $this->server->isTransferredAway();
+        if ($isArchive) {
+            $this->delete_from_hetzner = false;
+            $this->delete_from_vultr = false;
+            $this->delete_from_digitalocean = false;
+            $this->delete_from_hostinger = false;
+            $this->force_delete_resources = true;
+        }
         try {
             $this->authorize('delete', $this->server);
             if ($this->server->is_coolify_host) {
@@ -59,9 +70,12 @@ class Delete extends Component
                 return;
             }
 
+            if ($isArchive) {
+                app(ServerTransferClaimer::class)->forgetDnsRecords($this->server);
+            }
             if ($this->force_delete_resources) {
                 foreach ($this->server->definedResources() as $resource) {
-                    DeleteResourceJob::dispatch($resource);
+                    DeleteResourceJob::dispatch($resource, deleteFromCoolifyOnly: $isArchive);
                 }
             }
 
@@ -90,7 +104,7 @@ class Delete extends Component
     {
         $checkboxes = [];
 
-        if ($this->server->hasDefinedResources()) {
+        if ($this->server->hasDefinedResources() && ! $this->server->isTransferredAway()) {
             $resourceCount = $this->server->definedResources()->count();
             $checkboxes[] = [
                 'id' => 'force_delete_resources',
@@ -99,7 +113,9 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->hetzner_server_id) {
+        $canDeleteFromProvider = ! $this->server->isTransferredAway();
+
+        if ($canDeleteFromProvider && $this->server->hetzner_server_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_hetzner',
                 'label' => 'Also delete server from Hetzner Cloud',
@@ -107,7 +123,7 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->vultr_instance_id) {
+        if ($canDeleteFromProvider && $this->server->vultr_instance_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_vultr',
                 'label' => 'Also delete server from Vultr',
@@ -115,7 +131,7 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->digitalocean_droplet_id) {
+        if ($canDeleteFromProvider && $this->server->digitalocean_droplet_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_digitalocean',
                 'label' => 'Also delete droplet from DigitalOcean',
@@ -123,7 +139,7 @@ class Delete extends Component
             ];
         }
 
-        if ($this->server->hostinger_virtual_machine_id) {
+        if ($canDeleteFromProvider && $this->server->hostinger_virtual_machine_id) {
             $checkboxes[] = [
                 'id' => 'delete_from_hostinger',
                 'label' => 'Also delete VPS from Hostinger (at the end of the paid period)',
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index 4cb59e1996..ff5751ed2a 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -395,43 +395,46 @@ class Show extends Component
         }
     }
 
-    public function toggleManagement(ServerTransferClaimer $claimer): void
+    /**
+     * Take back a server that was transferred to another instance.
+     */
+    public function enableManagement(ServerTransferClaimer $claimer): void
     {
-        abort_unless(isDev(), 404);
         $this->authorize('update', $this->server);
 
-        if ($this->server->isLocalhost()) {
-            $this->dispatch('error', 'The Coolify host cannot be transferred.');
-
+        if ($this->server->isLocalhost() || ! $this->server->isTransferredAway()) {
             return;
         }
 
-        if ($this->server->isTransferredAway() && $this->server->team->serverOverflow()) {
+        if ($this->server->team->serverOverflow()) {
             $this->dispatch('error', 'Your team is over its server limit. Upgrade your subscription or remove a server first.');
 
             return;
         }
 
-        if ($this->server->isTransferredAway()) {
+        try {
             $claimer->claim($this->server);
-            $event = 'ui.server.management_enabled';
-            $message = 'This Coolify instance now manages the server.';
-        } else {
-            $claimer->markTransferred($this->server, managementDisabled: true);
-            $event = 'ui.server.management_disabled';
-            $message = 'Server automations are disabled on this Coolify instance.';
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return;
         }
 
+        $claimer->restoreAfterTakeBack($this->server->refresh());
         $this->server->refresh();
+        // Sentinel must report here. While it reports to the other instance, that instance does not run
+        // the connection check that reads the owner marker and makes it stop managing the server.
+        $this->server->restartSentinel();
         $this->syncData();
+        $this->dispatch('transferFinishStarted')->to(TransferFinish::class);
 
-        auditLog($event, [
+        auditLog('ui.server.management_enabled', [
             'team_id' => $this->server->team_id,
             'server_uuid' => $this->server->uuid,
             'server_name' => $this->server->name,
         ]);
 
-        $this->dispatch('success', $message);
+        $this->dispatch('success', 'This Coolify instance now manages the server.');
     }
 
     public function checkLocalhostConnection()
diff --git a/app/Livewire/Server/Transfer.php b/app/Livewire/Server/Transfer.php
index 8ae349ec3f..22bb6d0685 100644
--- a/app/Livewire/Server/Transfer.php
+++ b/app/Livewire/Server/Transfer.php
@@ -3,8 +3,6 @@
 namespace App\Livewire\Server;
 
 use App\Models\Server;
-use App\Services\ServerTransfer\ServerTransferBundle;
-use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferMigrator;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -21,25 +19,27 @@ class Transfer extends Component
 
     public string $targetToken = '';
 
-    /** Manual transfer */
-    /** Encrypts the downloaded file when filled; empty or whitespace means no encryption. */
-    public ?string $passphrase = null;
-
     public ?string $exportId = null;
 
+    /** Transfer back fields, shown for an archive */
+    public string $managerUrl = '';
+
+    public string $managerToken = '';
+
+    public string $thisInstanceUrl = '';
+
     /** @var list<string> */
     public array $lastWarnings = [];
 
-    public ?string $lastResultJson = null;
-
     public function mount(string $server_uuid): void
     {
-        $this->ensureDevelopmentAvailability();
-
         try {
             $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
-            $this->authorize('view', $this->server);
+            // The transfer exports every credential of the server, so only admins and owners may open it.
+            $this->authorize('update', $this->server);
             $this->exportId = data_get($this->server->server_metadata, 'transfer.export_id');
+            $this->managerUrl = (string) data_get($this->server->server_metadata, 'transfer.target_instance_url', '');
+            $this->thisInstanceUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
         } catch (Throwable $e) {
             handleError($e, $this);
             $this->redirect(route('server.index'), navigate: true);
@@ -51,72 +51,86 @@ class Transfer extends Component
         return (int) $this->server->id === 0;
     }
 
+    /**
+     * State of the queued transfer to another instance, read by the page poll.
+     *
+     * @return array<string, mixed>|null
+     */
+    public function getMigrationProperty(): ?array
+    {
+        $migration = data_get($this->server->server_metadata, 'migration');
+
+        return is_array($migration) ? $migration : null;
+    }
+
+    /**
+     * Manual steps of a finished transfer that the target instance cannot do.
+     *
+     * @return list<string>
+     */
+    public function getPostTransferChecklistProperty(): array
+    {
+        if (data_get($this->migration, 'status') !== 'succeeded') {
+            return [];
+        }
+
+        return array_values(array_filter((array) data_get($this->migration, 'checklist', []), 'is_string'));
+    }
+
+    public function refreshMigration(): void
+    {
+        $this->server->refresh();
+        $this->lastWarnings = array_values((array) data_get($this->migration, 'warnings', $this->lastWarnings));
+    }
+
     public function migrateServer(ServerTransferMigrator $migrator): void
     {
-        $this->ensureDevelopmentAvailability();
-
         try {
             $this->authorize('update', $this->server);
             if ($this->isLocalhost) {
                 throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
             }
 
-            $result = $migrator->migrate(
+            $migrator->start(
                 server: $this->server,
                 targetUrl: $this->targetUrl,
                 targetToken: $this->targetToken,
             );
 
+            auditLog('ui.server.migrate', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'target_url' => $this->targetUrl,
+            ]);
+
             $this->server->refresh();
-            $this->exportId = $result['export_id'] ?? $this->exportId;
-            $this->lastWarnings = array_values((array) data_get($result, 'warnings', []));
-            // Never echo the target token in the result dump.
-            $safe = $result;
-            unset($safe['target_token']);
-            $this->lastResultJson = json_encode($safe, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+            $this->lastWarnings = [];
             $this->targetToken = '';
-            $this->dispatch('success', $result['message'] ?? 'Server transferred.');
+            $this->dispatch('success', 'All checks passed. The transfer started.');
         } catch (Throwable $e) {
+            // A failed check is saved in the transfer log, so show it.
+            $this->server->refresh();
             handleError($e, $this);
         }
     }
 
-    public function exportBundle(ServerTransferExporter $exporter)
+    public function transferBack(ServerTransferMigrator $migrator): void
     {
-        $this->ensureDevelopmentAvailability();
-
         try {
-            $this->authorize('view', $this->server);
-            if ($this->isLocalhost) {
-                throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
-            }
+            $this->authorize('update', $this->server);
+            $migrator->requestTransferBack($this->server, auth()->user(), $this->managerUrl, $this->managerToken, $this->thisInstanceUrl);
 
-            $bundle = $exporter->export($this->server, includeSensitive: true);
-            $this->exportId = data_get($bundle, 'export_id');
-            $this->lastWarnings = array_values((array) data_get($bundle, 'warnings', []));
-            $this->lastResultJson = null;
-
-            $payload = $bundle;
-            $fileName = 'server-transfer-'.$this->server->uuid.'.json';
-            if (filled($this->passphrase)) {
-                $payload = ServerTransferBundle::encryptWithPassphrase($bundle, $this->passphrase);
-                $fileName = 'server-transfer-'.$this->server->uuid.'.encrypted.json';
-            }
-
-            $json = json_encode($payload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
-            if ($json === false) {
-                throw new \RuntimeException('Failed to encode transfer bundle.');
-            }
-
-            $this->dispatch('success', 'Transfer bundle ready for download.');
-
-            return response()->streamDownload(function () use ($json) {
-                echo $json;
-            }, $fileName, [
-                'Content-Type' => 'application/json',
+            auditLog('ui.server.transfer_back', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'from' => $this->managerUrl,
             ]);
+
+            $this->server->refresh();
+            $this->managerToken = '';
+            $this->dispatch('success', 'The other instance started the transfer back.');
         } catch (Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 
@@ -124,9 +138,4 @@ class Transfer extends Component
     {
         return view('livewire.server.transfer');
     }
-
-    private function ensureDevelopmentAvailability(): void
-    {
-        abort_unless(isDev(), 404);
-    }
 }
diff --git a/app/Livewire/Server/TransferFinish.php b/app/Livewire/Server/TransferFinish.php
new file mode 100644
index 0000000000..e60664ed0c
--- /dev/null
+++ b/app/Livewire/Server/TransferFinish.php
@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Livewire\Server;
+
+use App\Jobs\CheckTransferFinishStepsJob;
+use App\Models\Server;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+/**
+ * The "Finish the transfer" list on the server page. A separate component, so its refresh does not re-render the
+ * server form.
+ */
+class TransferFinish extends Component
+{
+    use AuthorizesRequests;
+
+    public Server $server;
+
+    public function getListeners(): array
+    {
+        return [
+            "echo-private:team.{$this->server->team_id},TransferFinishChanged" => 'handleTransferFinishChanged',
+        ];
+    }
+
+    /**
+     * The server page sends this after a take back, which starts a new list.
+     */
+    #[On('transferFinishStarted')]
+    public function reloadServer(): void
+    {
+        $this->server->refresh();
+    }
+
+    /**
+     * A background check, or a user in another tab, changed a step of this list.
+     */
+    public function handleTransferFinishChanged(array $event): void
+    {
+        if (($event['serverUuid'] ?? null) === $this->server->uuid) {
+            $this->server->refresh();
+        }
+    }
+
+    /**
+     * Start the background checks when they are stale. Called when the panel loads and by its poll.
+     */
+    public function refreshSteps(TransferFinishChecklist $checklist): void
+    {
+        $this->server->refresh();
+        if (auth()->user()?->can('update', $this->server)) {
+            $checklist->checkWhenStale($this->server);
+        }
+    }
+
+    public function checkAllNow(): void
+    {
+        $this->authorize('update', $this->server);
+        CheckTransferFinishStepsJob::dispatch($this->server);
+    }
+
+    public function checkStep(TransferFinishChecklist $checklist, string $key): void
+    {
+        $this->authorize('update', $this->server);
+        $checklist->check($this->server, $key);
+    }
+
+    public function fixStep(TransferFinishChecklist $checklist, string $key): void
+    {
+        $this->authorize('update', $this->server);
+        $item = $checklist->fix($this->server, $key);
+        $toast = match ($item['status']) {
+            'ok' => 'success',
+            'pending' => 'info',
+            default => 'error',
+        };
+        $this->dispatch($toast, $item['message'] ?? 'Done.');
+    }
+
+    public function markStepDone(TransferFinishChecklist $checklist, string $key): void
+    {
+        $this->authorize('update', $this->server);
+        $checklist->markDone($this->server, $key);
+    }
+
+    public function finishTransfer(TransferFinishChecklist $checklist): void
+    {
+        $this->authorize('update', $this->server);
+        $skipped = count($checklist->openItems($this->server));
+        $checklist->finish($this->server, auth()->user());
+
+        auditLog('ui.server.transfer_finished', [
+            'team_id' => $this->server->team_id,
+            'server_uuid' => $this->server->uuid,
+            'skipped_steps' => $skipped,
+        ]);
+
+        $this->dispatch('success', 'The transfer is finished.');
+    }
+
+    public function render()
+    {
+        $checklist = app(TransferFinishChecklist::class);
+        $finish = $checklist->isOpen($this->server) ? $checklist->of($this->server) : null;
+        $items = collect($finish['items'] ?? []);
+        $openItems = $items->filter(fn (array $item) => in_array($item['status'], TransferFinishChecklist::OPEN_STATUSES, true));
+
+        return view('livewire.server.transfer-finish', [
+            'checklist' => $checklist,
+            'finish' => $finish,
+            'openGroups' => collect(TransferFinishChecklist::GROUPS)
+                ->map(fn (string $label, string $group) => ['label' => $label, 'items' => $openItems->filter(fn (array $item) => $checklist->groupOf($item) === $group)->values()])
+                ->filter(fn (array $group) => $group['items']->isNotEmpty()),
+            'doneItems' => $items->reject(fn (array $item) => in_array($item['status'], TransferFinishChecklist::OPEN_STATUSES, true))->values(),
+            'openCount' => $openItems->count(),
+            'totalCount' => $items->count(),
+        ]);
+    }
+}
diff --git a/app/Livewire/Server/TransferImport.php b/app/Livewire/Server/TransferImport.php
deleted file mode 100644
index 97bb6c5c7d..0000000000
--- a/app/Livewire/Server/TransferImport.php
+++ /dev/null
@@ -1,150 +0,0 @@
-<?php
-
-namespace App\Livewire\Server;
-
-use App\Models\Server;
-use App\Services\ServerTransfer\ServerTransferBundle;
-use App\Services\ServerTransfer\ServerTransferImporter;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Component;
-use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
-use Livewire\WithFileUploads;
-use Throwable;
-
-class TransferImport extends Component
-{
-    use AuthorizesRequests;
-    use WithFileUploads;
-
-    public string $bundleJson = '';
-
-    public string $passphrase = '';
-
-    public bool $preserveUuids = true;
-
-    public bool $adoptMode = true;
-
-    /** @var TemporaryUploadedFile|null */
-    public $bundleFile = null;
-
-    /** @var array<string, mixed>|null */
-    public ?array $lastResult = null;
-
-    /** @var list<string> */
-    public array $lastWarnings = [];
-
-    public ?string $importedServerUuid = null;
-
-    public function mount(): void
-    {
-        $this->ensureDevelopmentAvailability();
-        $this->authorize('create', Server::class);
-    }
-
-    public function updatedBundleFile(): void
-    {
-        $this->ensureDevelopmentAvailability();
-
-        if (! $this->bundleFile) {
-            return;
-        }
-        try {
-            $contents = $this->bundleFile->get();
-            if (! is_string($contents) || blank($contents)) {
-                throw new \RuntimeException('Uploaded file is empty.');
-            }
-            $this->bundleJson = $contents;
-            $this->dispatch('success', 'Bundle file loaded into the form.');
-        } catch (Throwable $e) {
-            handleError($e, $this);
-        }
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    private function resolveBundle(): array
-    {
-        $raw = trim($this->bundleJson);
-        if ($raw === '') {
-            throw new \RuntimeException('Paste a transfer bundle JSON or upload a file.');
-        }
-
-        $decoded = json_decode($raw, true);
-        if (! is_array($decoded)) {
-            throw new \RuntimeException('Bundle is not valid JSON.');
-        }
-
-        if (data_get($decoded, 'encrypted')) {
-            if (blank($this->passphrase)) {
-                throw new \RuntimeException('Passphrase is required for encrypted bundles.');
-            }
-
-            return ServerTransferBundle::decryptWithPassphrase($decoded, $this->passphrase);
-        }
-
-        return $decoded;
-    }
-
-    public function dryRun(ServerTransferImporter $importer): void
-    {
-        $this->ensureDevelopmentAvailability();
-        $this->runImport($importer, dryRun: true);
-    }
-
-    public function importBundle(ServerTransferImporter $importer): void
-    {
-        $this->ensureDevelopmentAvailability();
-        $this->runImport($importer, dryRun: false);
-    }
-
-    private function runImport(ServerTransferImporter $importer, bool $dryRun): void
-    {
-        try {
-            $this->authorize('create', Server::class);
-            $teamId = currentTeam()->id;
-            $bundle = $this->resolveBundle();
-
-            $result = $importer->import(
-                bundle: $bundle,
-                teamId: $teamId,
-                dryRun: $dryRun,
-                preserveUuids: $this->preserveUuids,
-                adoptMode: $this->adoptMode,
-            );
-
-            $this->lastResult = $result;
-            $this->lastWarnings = array_values((array) data_get($result, 'warnings', []));
-            $this->importedServerUuid = $dryRun ? null : data_get($result, 'server_uuid');
-
-            if (! $dryRun) {
-                auditLog('ui.server.imported', [
-                    'team_id' => $teamId,
-                    'server_uuid' => $this->importedServerUuid,
-                    'claimed' => (bool) data_get($result, 'claimed'),
-                    'adopt_mode' => $this->adoptMode,
-                ]);
-            }
-
-            if ($dryRun) {
-                $this->dispatch('success', 'Dry run completed — nothing was written.');
-            } elseif (data_get($result, 'claimed')) {
-                $this->dispatch('success', 'Server imported. This instance now manages it.');
-            } else {
-                $this->dispatch('success', 'Server imported, but management could not be enabled. Check the warnings, then click Enable management on the server page.');
-            }
-        } catch (Throwable $e) {
-            handleError($e, $this);
-        }
-    }
-
-    public function render()
-    {
-        return view('livewire.server.transfer-import');
-    }
-
-    private function ensureDevelopmentAvailability(): void
-    {
-        abort_unless(isDev(), 404);
-    }
-}
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index 28cbc971d2..86060ddd3f 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -6,6 +6,7 @@ use App\Models\InstanceSettings;
 use App\Models\S3Storage;
 use App\Rules\ValidDnsServers;
 use App\Rules\ValidIpOrCidr;
+use App\Services\FileDownloadStorageService;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -63,6 +64,8 @@ class Advanced extends Component
 
     public array $avatar_storage_options = [];
 
+    public string $file_download_storage = 'stream';
+
     public function rules()
     {
         return [
@@ -123,6 +126,9 @@ class Advanced extends Component
                     'label' => $storage->name.' (S3)',
                 ])->all(),
         ];
+        $this->file_download_storage = $this->settings->file_download_s3_storage_id
+            ? 's3:'.$this->settings->file_download_s3_storage_id
+            : 'stream';
     }
 
     public function submit()
@@ -228,6 +234,7 @@ class Advanced extends Component
             $this->settings->webhook_allow_localhost = $this->webhook_allow_localhost;
             $this->settings->image_cdn_url = filled($this->image_cdn_url) ? rtrim($this->image_cdn_url, '/') : null;
             $this->saveAvatarStorageSetting();
+            $this->saveFileDownloadStorageSetting();
             $this->saveAndAudit();
             $this->dispatch('success', 'Settings updated!');
         } catch (\Exception $e) {
@@ -258,6 +265,48 @@ class Advanced extends Component
         $this->settings->avatar_s3_storage_id = $storage->id;
     }
 
+    /**
+     * Selecting a storage adds the auto-delete lifecycle rule to its bucket.
+     * The setting is refused when the bucket is listable by anonymous users
+     * or does not accept the rule.
+     */
+    private function saveFileDownloadStorageSetting(): void
+    {
+        if ($this->file_download_storage === 'stream') {
+            $this->settings->file_download_s3_storage_id = null;
+
+            return;
+        }
+
+        $storageId = (int) str($this->file_download_storage)->after('s3:')->value();
+        if ($storageId === $this->settings->file_download_s3_storage_id) {
+            return;
+        }
+
+        $storage = S3Storage::query()
+            ->whereTeamId(0)
+            ->where('is_usable', true)
+            ->find($storageId);
+
+        if (! $storage || $this->file_download_storage !== 's3:'.$storage->id) {
+            $this->file_download_storage = 'stream';
+            throw new \InvalidArgumentException('The selected file download storage is not available.');
+        }
+
+        try {
+            $downloads = app(FileDownloadStorageService::class);
+            $downloads->ensureBucketIsPrivate($storage);
+            $downloads->ensureLifecycleRule($storage);
+        } catch (\RuntimeException $e) {
+            $this->file_download_storage = $this->settings->file_download_s3_storage_id
+                ? 's3:'.$this->settings->file_download_s3_storage_id
+                : 'stream';
+            throw $e;
+        }
+
+        $this->settings->file_download_s3_storage_id = $storage->id;
+    }
+
     public function clearDomainConnectPrivateKey(): void
     {
         try {
diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index 75826f2d4e..cd047b1f43 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -201,6 +201,31 @@ class Index extends Component
         }
     }
 
+    /**
+     * Look up the public IPs of this host again and save them.
+     */
+    public function detectPublicIps()
+    {
+        try {
+            $this->authorize('update', $this->settings);
+
+            $detected = detect_public_ips();
+            if ($detected === []) {
+                $this->dispatch('error', 'Could not detect a public IP address.');
+
+                return;
+            }
+
+            $this->settings->fill($detected);
+            $this->saveAndAudit();
+            $this->public_ipv4 = $this->settings->public_ipv4;
+            $this->public_ipv6 = $this->settings->public_ipv6;
+            $this->dispatch('success', 'Detected '.implode(' and ', $detected).'.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function buildHelperImage()
     {
         try {
diff --git a/app/Livewire/Settings/Updates.php b/app/Livewire/Settings/Updates.php
index 10b3180640..aba7521dd9 100644
--- a/app/Livewire/Settings/Updates.php
+++ b/app/Livewire/Settings/Updates.php
@@ -130,7 +130,7 @@ class Updates extends Component
             if ($this->is_auto_update_enabled && ! validate_cron_expression($this->auto_update_frequency)) {
                 $this->dispatch('error', 'Invalid Cron / Human expression for Auto Update Frequency.');
                 if (empty($this->auto_update_frequency)) {
-                    $this->auto_update_frequency = '0 0 * * *';
+                    $this->auto_update_frequency = InstanceSettings::randomAutoUpdateFrequency();
                 }
 
                 return;
diff --git a/app/Livewire/SettingsBackup.php b/app/Livewire/SettingsBackup.php
index 0f92b2ad34..d7eaf7d596 100644
--- a/app/Livewire/SettingsBackup.php
+++ b/app/Livewire/SettingsBackup.php
@@ -31,21 +31,9 @@ class SettingsBackup extends Component
     #[Locked]
     public $executions = [];
 
-    #[Validate(['required'])]
-    public string $uuid;
-
-    #[Validate(['required'])]
-    public string $name;
-
     #[Validate(['nullable'])]
     public ?string $description = null;
 
-    #[Validate(['required'])]
-    public string $postgres_user;
-
-    #[Validate(['required'])]
-    public string $postgres_password;
-
     public bool $is_backup_before_update_enabled;
 
     public function mount()
@@ -59,11 +47,7 @@ class SettingsBackup extends Component
         $this->database = StandalonePostgresql::find(0);
         $s3s = S3Storage::whereTeamId(0)->get() ?? [];
         if ($this->database) {
-            $this->uuid = $this->database->uuid;
-            $this->name = $this->database->name;
             $this->description = $this->database->description;
-            $this->postgres_user = $this->database->postgres_user;
-            $this->postgres_password = $this->database->postgres_password;
 
             if ($this->database->status !== 'running') {
                 $this->database->status = 'running';
@@ -127,11 +111,7 @@ class SettingsBackup extends Component
             }
             $this->s3s = S3Storage::whereTeamId(0)->get();
 
-            $this->uuid = $this->database->uuid;
-            $this->name = $this->database->name;
             $this->description = $this->database->description;
-            $this->postgres_user = $this->database->postgres_user;
-            $this->postgres_password = $this->database->postgres_password;
             $this->executions = $this->backup->executions;
 
         } catch (\Exception $e) {
@@ -166,11 +146,9 @@ class SettingsBackup extends Component
             $this->authorize('update', $this->settings);
             $this->validate();
 
+            // Credentials come from the coolify-db container and are display-only, so only the description is saved.
             $this->database->update([
-                'name' => $this->name,
                 'description' => $this->description,
-                'postgres_user' => $this->postgres_user,
-                'postgres_password' => $this->postgres_password,
             ]);
             $this->dispatch('success', 'Backup updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/SharedVariables/Index.php b/app/Livewire/SharedVariables/Index.php
index 61c31e9f83..fe8ccc1802 100644
--- a/app/Livewire/SharedVariables/Index.php
+++ b/app/Livewire/SharedVariables/Index.php
@@ -2,12 +2,17 @@
 
 namespace App\Livewire\SharedVariables;
 
+use App\Services\SharedVariableCanvas;
+use Illuminate\View\View;
 use Livewire\Component;
 
 class Index extends Component
 {
-    public function render()
+    public function render(): View
     {
-        return view('livewire.shared-variables.index');
+        // A "my team" page: the overview of the session team's shared variables (keys and counts only).
+        return view('livewire.shared-variables.index', [
+            'overview' => app(SharedVariableCanvas::class)->overview(currentTeam()),
+        ]);
     }
 }
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 7e0753ad69..ca59577ccb 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -372,14 +372,7 @@ class Change extends Component
 
     public function getGithubAppNameUpdatePath()
     {
-        $name = encodeGithubPathSegment($this->github_app->name);
-        $organization = normalizeGithubOrganization($this->github_app->organization);
-
-        if (filled($organization)) {
-            return rtrim($this->github_app->html_url, '/').'/organizations/'.encodeGithubPathSegment($organization)."/settings/apps/{$name}";
-        }
-
-        return rtrim($this->github_app->html_url, '/')."/settings/apps/{$name}";
+        return $this->github_app->settingsUrl();
     }
 
     public function updateGithubAppName()
diff --git a/app/Livewire/Tags/Show.php b/app/Livewire/Tags/Show.php
index e2f4980d75..01450abe9a 100644
--- a/app/Livewire/Tags/Show.php
+++ b/app/Livewire/Tags/Show.php
@@ -7,6 +7,7 @@ use App\Livewire\Concerns\CreatesTags;
 use App\Livewire\Concerns\RemembersCanvasView;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Tag;
+use App\Services\TagCanvas;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
@@ -41,6 +42,9 @@ class Show extends Component
     #[Locked]
     public ?array $deploymentsPerTagPerServer = null;
 
+    /** The "Connect to resources" modal on small screens, where the tags canvas is not shown. */
+    public bool $connectResourcesOpen = false;
+
     public function mount()
     {
         if (str($this->tagName)->isEmpty() && $this->prefersCanvasView('tags')) {
@@ -123,9 +127,39 @@ class Show extends Component
         }
     }
 
+    public function openConnectResources(): void
+    {
+        $this->connectResourcesOpen = true;
+    }
+
     /**
-     * Creates a tag without resources. Tag resources on the tags canvas or on the resource.
+     * Adds the tag to a resource of the tag's team, or removes it when the resource already has it.
      */
+    public function toggleResource(string $uuid): void
+    {
+        try {
+            $resource = app(TagCanvas::class)->resources($this->tag->team_id)->get($uuid);
+            if (! $resource) {
+                $this->dispatch('error', 'Resource not found.');
+
+                return;
+            }
+            $this->authorize('update', $resource);
+
+            if ($resource->tags->contains('id', $this->tag->id)) {
+                $resource->tags()->detach($this->tag->id);
+            } else {
+                $resource->tags()->attach($this->tag->id);
+            }
+
+            $this->applications = $this->tag->applications()->get();
+            $this->services = $this->tag->services()->get();
+            $this->getDeployments();
+        } catch (\Exception $e) {
+            handleError($e, $this);
+        }
+    }
+
     /**
      * Deletes the tag and removes it from every resource.
      */
@@ -158,6 +192,30 @@ class Show extends Component
                     'resourceCount' => $applicationsCount + $servicesCount,
                 ];
             })->values()->toArray(),
+            'connectableResources' => $this->connectableResources(),
         ]);
     }
+
+    /**
+     * Resources of the tag's team for the "Connect to resources" modal, by "Project / Environment".
+     * Loaded only while the modal is open.
+     *
+     * @return Collection<string, Collection<int, array{uuid: string, name: string, tagged: bool, can_update: bool}>>
+     */
+    private function connectableResources(): Collection
+    {
+        if (! $this->connectResourcesOpen || ! $this->tag) {
+            return collect();
+        }
+
+        return app(TagCanvas::class)->resources($this->tag->team_id)
+            ->groupBy(fn ($resource) => $resource->environment->project->name.' / '.$resource->environment->name)
+            ->sortKeys(SORT_NATURAL | SORT_FLAG_CASE)
+            ->map(fn (Collection $resources) => $resources->map(fn ($resource) => [
+                'uuid' => $resource->uuid,
+                'name' => $resource->name,
+                'tagged' => $resource->tags->contains('id', $this->tag->id),
+                'can_update' => auth()->user()->can('update', $resource),
+            ])->values());
+    }
 }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index fc9085752c..a2dc1d6f62 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -790,7 +790,7 @@ class Application extends BaseModel
 
                     return "{$this->source->html_url}/{$this->git_repository}/tree/{$this->git_branch}{$base_dir}";
                 }
-                $httpsRepository = $this->httpsUrlFromScpStyleGitRepository();
+                $httpsRepository = $this->httpsUrlFromSshGitRepository();
                 if (is_string($httpsRepository)) {
                     if (str($this->git_repository)->contains('bitbucket')) {
                         return "{$httpsRepository}/src/{$this->git_branch}{$base_dir}";
@@ -811,7 +811,7 @@ class Application extends BaseModel
                 if (! is_null($this->source?->html_url) && ! is_null($this->git_repository) && ! is_null($this->git_branch)) {
                     return "{$this->source->html_url}/{$this->git_repository}/settings/hooks";
                 }
-                $httpsRepository = $this->httpsUrlFromScpStyleGitRepository();
+                $httpsRepository = $this->httpsUrlFromSshGitRepository();
                 if (is_string($httpsRepository)) {
                     return "{$httpsRepository}/settings/hooks";
                 }
@@ -828,7 +828,7 @@ class Application extends BaseModel
                 if (! is_null($this->source?->html_url) && ! is_null($this->git_repository) && ! is_null($this->git_branch)) {
                     return "{$this->source->html_url}/{$this->git_repository}/commits/{$this->git_branch}";
                 }
-                $httpsRepository = $this->httpsUrlFromScpStyleGitRepository();
+                $httpsRepository = $this->httpsUrlFromSshGitRepository();
                 if (is_string($httpsRepository)) {
                     return "{$httpsRepository}/commits/{$this->git_branch}";
                 }
@@ -849,11 +849,9 @@ class Application extends BaseModel
         }
 
         $git_repository = $this->git_repository;
-        $httpsRepository = scpStyleGitUrlToHttps($git_repository);
+        $httpsRepository = sshGitUrlToHttps($git_repository);
         if (is_string($httpsRepository)) {
             $git_repository = $httpsRepository;
-        } elseif (str($this->git_repository)->startsWith('ssh://')) {
-            $git_repository = 'https://'.parse_url($git_repository, PHP_URL_HOST).parse_url($git_repository, PHP_URL_PATH);
         }
 
         if (! filter_var($git_repository, FILTER_VALIDATE_URL) || ! in_array(parse_url($git_repository, PHP_URL_SCHEME), ['http', 'https'], true)) {
@@ -868,9 +866,9 @@ class Application extends BaseModel
         return $url->__toString();
     }
 
-    private function httpsUrlFromScpStyleGitRepository(): ?string
+    private function httpsUrlFromSshGitRepository(): ?string
     {
-        $httpsRepository = scpStyleGitUrlToHttps($this->git_repository);
+        $httpsRepository = sshGitUrlToHttps($this->git_repository);
 
         if (! is_string($httpsRepository)) {
             return null;
@@ -1032,11 +1030,11 @@ class Application extends BaseModel
                     $additional_servers_status = $this->additional_servers->pluck('pivot.status');
                     foreach ($additional_servers_status as $status) {
                         $server_status = str($status)->before(':')->value();
-                        $server_health = str($status)->after(':')->value() ?? 'unhealthy';
+                        $server_health = str($status)->contains(':') ? str($status)->after(':')->value() : null;
                         if ($main_server_status !== $server_status) {
                             $complex_status = 'degraded';
                         }
-                        if ($main_server_health !== $server_health) {
+                        if ($server_health !== null && $main_server_health !== $server_health) {
                             $complex_health = 'unhealthy';
                         }
                     }
@@ -2193,7 +2191,7 @@ class Application extends BaseModel
                             continue;
                         }
                         if ($source->startsWith('.')) {
-                            $source = str($workdir.$source->after('.'));
+                            $source = replaceLocalSource($source, str($workdir));
                         }
                         $mkdirCommand = rawComposeBindMkdirCommand($source->value());
                         if ($mkdirCommand !== null) {
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index 4a0f6d78f0..17b791d733 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -54,10 +54,13 @@ class ApplicationPreview extends BaseModel
 
             if (data_get($preview, 'application.build_pack') === 'dockercompose') {
                 $composeFile = $application->parse(pull_request_id: $preview->pull_request_id);
-                foreach ($preview->generatedComposeVolumeNames($application, collect(data_get($composeFile, 'volumes', []))) as $volumeName) {
+                $volumeNames = $preview->generatedComposeVolumeNames($application, collect(data_get($composeFile, 'volumes', [])));
+                foreach ($volumeNames as $volumeName) {
                     // Docker does not remove a volume that a container still uses, also with -f.
                     instant_remote_process(['docker volume rm -f '.escapeshellarg($volumeName)], $server, false);
                 }
+                // The compose parser stores preview volumes on the application, not on the preview
+                $application->persistentStorages()->whereIn('name', $volumeNames)->delete();
                 $preview->removeComposePreviewNetwork($application, $server);
             } else {
                 // Regular application volume cleanup
diff --git a/app/Models/ApplicationSetting.php b/app/Models/ApplicationSetting.php
index 41249a5201..abe317530f 100644
--- a/app/Models/ApplicationSetting.php
+++ b/app/Models/ApplicationSetting.php
@@ -36,6 +36,7 @@ use OpenApi\Attributes as OA;
         'custom_container_name_prefix' => ['type' => 'string', 'nullable' => true],
         'is_container_label_escape_enabled' => ['type' => 'boolean'],
         'is_env_sorting_enabled' => ['type' => 'boolean'],
+        'include_coolify_default_variables' => ['type' => 'boolean'],
         'is_container_label_readonly_enabled' => ['type' => 'boolean'],
         'is_preserve_repository_enabled' => ['type' => 'boolean'],
         'disable_build_cache' => ['type' => 'boolean'],
@@ -88,6 +89,7 @@ class ApplicationSetting extends Model
         'is_stripprefix_enabled' => 'boolean',
         'connect_to_docker_network' => 'boolean',
         'is_env_sorting_enabled' => 'boolean',
+        'include_coolify_default_variables' => 'boolean',
         'redact_all_env_values_in_logs' => 'boolean',
         'disable_build_cache' => 'boolean',
     ];
@@ -120,6 +122,7 @@ class ApplicationSetting extends Model
         'custom_container_name_prefix',
         'is_container_label_escape_enabled',
         'is_env_sorting_enabled',
+        'include_coolify_default_variables',
         'is_container_label_readonly_enabled',
         'is_preserve_repository_enabled',
         'disable_build_cache',
diff --git a/app/Models/GithubApp.php b/app/Models/GithubApp.php
index 0052232fb1..49e32e0b85 100644
--- a/app/Models/GithubApp.php
+++ b/app/Models/GithubApp.php
@@ -57,6 +57,34 @@ class GithubApp extends BaseModel
         'webhook_secret',
     ];
 
+    /**
+     * Installation token kept in memory, so one job does not request a new token for each GitHub call.
+     *
+     * @var array{credentials: string, token: string, expires_at: int}|null
+     */
+    private ?array $installationTokenInMemory = null;
+
+    public function installationToken(): string
+    {
+        $credentials = implode('|', [$this->api_url, $this->app_id, $this->installation_id, $this->private_key_id]);
+        $cached = $this->installationTokenInMemory;
+
+        if ($cached && $cached['credentials'] === $credentials && $cached['expires_at'] > now()->getTimestamp()) {
+            return $cached['token'];
+        }
+
+        $token = generateGithubToken($this, 'installation');
+
+        // GitHub installation tokens expire after one hour; renew them well before that.
+        $this->installationTokenInMemory = [
+            'credentials' => $credentials,
+            'token' => $token,
+            'expires_at' => now()->addMinutes(50)->getTimestamp(),
+        ];
+
+        return $token;
+    }
+
     protected static function booted(): void
     {
         static::deleting(function (GithubApp $github_app) {
@@ -165,4 +193,19 @@ class GithubApp extends BaseModel
 
         return filled($this->app_id) && filled($this->installation_id);
     }
+
+    /**
+     * The settings page of this App at GitHub.
+     */
+    public function settingsUrl(): string
+    {
+        $name = encodeGithubPathSegment($this->name);
+        $organization = normalizeGithubOrganization($this->organization);
+
+        if (filled($organization)) {
+            return rtrim($this->html_url, '/').'/organizations/'.encodeGithubPathSegment($organization)."/settings/apps/{$name}";
+        }
+
+        return rtrim($this->html_url, '/')."/settings/apps/{$name}";
+    }
 }
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 1d08078176..8726a9f0f6 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -59,6 +59,7 @@ class InstanceSettings extends Model
         'avatar_storage_type',
         'avatar_s3_storage_id',
         'image_cdn_url',
+        'file_download_s3_storage_id',
         'is_dashboard_force_https_enabled',
         'is_passkey_enabled',
     ];
@@ -108,6 +109,12 @@ class InstanceSettings extends Model
 
     protected static function booted(): void
     {
+        static::creating(function ($settings) {
+            if (blank($settings->getAttributes()['auto_update_frequency'] ?? null)) {
+                $settings->auto_update_frequency = self::randomAutoUpdateFrequency();
+            }
+        });
+
         static::created(function () {
             Once::flush();
         });
@@ -125,6 +132,14 @@ class InstanceSettings extends Model
         });
     }
 
+    /**
+     * Daily auto update at a random minute after midnight, so instances do not all pull images from the registry in the same second.
+     */
+    public static function randomAutoUpdateFrequency(): string
+    {
+        return random_int(0, 59).' 0 * * *';
+    }
+
     public function isPasswordRegistrationAllowed(): bool
     {
         if (! $this->is_registration_enabled) {
diff --git a/app/Models/Server.php b/app/Models/Server.php
index fa4c454885..da29b7ac02 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -11,6 +11,7 @@ use App\Enums\ApplicationDeploymentStatus;
 use App\Enums\ProxyTypes;
 use App\Enums\ServerRole;
 use App\Events\ServerReachabilityChanged;
+use App\Helpers\SshMultiplexingHelper;
 use App\Helpers\SslHelper;
 use App\Jobs\CheckAndStartSentinelJob;
 use App\Jobs\CheckTraefikVersionForServerJob;
@@ -189,6 +190,9 @@ class Server extends BaseModel
         static::saved(function ($server) {
             if ($server->wasChanged('private_key_id') || $server->privateKey?->isDirty()) {
                 refresh_server_connection($server->privateKey);
+            } elseif ($server->wasChanged(['user', 'ip', 'port'])) {
+                // An open multiplexed connection keeps the old user and host until it is closed.
+                SshMultiplexingHelper::removeMuxFile($server);
             }
         });
         static::created(function ($server) {
@@ -252,7 +256,13 @@ class Server extends BaseModel
                 $destination->delete();
             });
             // Leftover active runner rows would block deleting the GitHub App.
-            GithubRunnerExecution::deleteAndDeregister(GithubRunnerExecution::query()->where('server_id', $server->id));
+            // The runners of a transferred server now belong to the other instance, so keep them registered at GitHub.
+            $executions = GithubRunnerExecution::query()->where('server_id', $server->id);
+            if ($server->isTransferredAway()) {
+                $executions->delete();
+            } else {
+                GithubRunnerExecution::deleteAndDeregister($executions);
+            }
             $server->githubRunnerConfig()->delete();
             $server->settings()->delete();
             $server->sslCertificates()->delete();
@@ -1376,15 +1386,6 @@ $siteAddress {
         return data_get($this->server_metadata, 'transfer.status') === 'transferred';
     }
 
-    /**
-     * Management was disabled manually on this instance; the server is ready to be transferred.
-     */
-    public function isManagementDisabled(): bool
-    {
-        return $this->isTransferredAway()
-            && (bool) data_get($this->server_metadata, 'transfer.management_disabled', false);
-    }
-
     /**
      * Whether this server may be validated / installed against from this instance.
      */
@@ -2071,25 +2072,34 @@ $siteAddress {
     public function validateOS(): bool|Stringable
     {
         $os_release = instant_remote_process(['cat /etc/os-release'], $this);
-        $releaseLines = collect(explode("\n", $os_release));
-        $collectedData = collect([]);
-        foreach ($releaseLines as $line) {
-            $item = str($line)->trim();
-            $collectedData->put($item->before('=')->value(), $item->after('=')->lower()->replace('"', '')->value());
-        }
-        $ID = data_get($collectedData, 'ID');
-        // $ID_LIKE = data_get($collectedData, 'ID_LIKE');
-        // $VERSION_ID = data_get($collectedData, 'VERSION_ID');
-        $supported = collect(SUPPORTED_OS)->filter(function ($supportedOs) use ($ID) {
-            if (str($supportedOs)->contains($ID)) {
-                return str($ID);
+
+        return self::supportedOsFromOsRelease($os_release);
+    }
+
+    /**
+     * Match /etc/os-release against SUPPORTED_OS: ID first, then each ID_LIKE token (e.g. Manjaro: ID=manjaro, ID_LIKE=arch).
+     */
+    public static function supportedOsFromOsRelease(?string $osRelease): bool|Stringable
+    {
+        $collectedData = collect(explode("\n", (string) $osRelease))
+            ->mapWithKeys(function ($line) {
+                $item = str($line)->trim();
+
+                return [$item->before('=')->value() => $item->after('=')->lower()->replace(['"', "'"], '')->value()];
+            });
+
+        $candidates = collect([data_get($collectedData, 'ID')])
+            ->merge(explode(' ', (string) data_get($collectedData, 'ID_LIKE')))
+            ->filter();
+
+        foreach ($candidates as $candidate) {
+            $supported = collect(SUPPORTED_OS)->filter(fn ($supportedOs) => str($supportedOs)->contains($candidate));
+            if ($supported->count() === 1) {
+                return str($supported->first());
             }
-        });
-        if ($supported->count() === 1) {
-            return str($supported->first());
-        } else {
-            return false;
         }
+
+        return false;
     }
 
     public function gatherServerMetadata(): ?array
@@ -2128,7 +2138,13 @@ $siteAddress {
                 'collected_at' => now()->toIso8601String(),
             ];
 
-            $this->update(['server_metadata' => $metadata]);
+            // Merge into the saved row: server_metadata also holds the transfer and migration state.
+            DB::transaction(function () use ($metadata) {
+                $locked = self::query()->lockForUpdate()->findOrFail($this->id);
+                $locked->update(['server_metadata' => array_merge($locked->server_metadata ?? [], $metadata)]);
+                $this->server_metadata = $locked->server_metadata;
+                $this->syncOriginalAttribute('server_metadata');
+            });
 
             try {
                 $detectedDockerVersion = parseDockerEngineVersion($sections['DOCKER'] ?? null);
diff --git a/app/Models/ServerSetting.php b/app/Models/ServerSetting.php
index 706d90c517..c1dfc5bf2b 100644
--- a/app/Models/ServerSetting.php
+++ b/app/Models/ServerSetting.php
@@ -331,7 +331,9 @@ class ServerSetting extends Model
     {
         $url = $this->sentinel_custom_url;
 
-        if ($this->server->isLocalhost() && $url === 'http://host.docker.internal:8000') {
+        // The local Sentinel runs on the coolify network. A host gateway URL leaves that network
+        // through the host INPUT chain, where host firewalls such as UFW drop it.
+        if ($this->server->isLocalhost() && strtolower((string) parse_url((string) $url, PHP_URL_HOST)) === 'host.docker.internal') {
             $url = null;
         }
 
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 1f413491bd..2ebff2ad9c 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -71,6 +71,7 @@ class Service extends BaseModel
     protected $appends = ['server_status', 'status'];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'redact_all_env_values_in_logs' => 'boolean',
     ];
 
@@ -753,7 +754,7 @@ class Service extends BaseModel
                         ]);
                     }
                     $fields->put('Supabase', $data->toArray());
-                case $image->contains('minio'):
+                case $image->contains(['minio', 'pgsty/silo']):
                     $data = collect([]);
                     $console_url = $this->environment_variables()->where('key', 'MINIO_BROWSER_REDIRECT_URL')->first();
                     $s3_api_url = $this->environment_variables()->where('key', 'MINIO_SERVER_URL')->first();
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index 147dab9832..eeaa59c97c 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -74,6 +74,7 @@ class StandaloneClickhouse extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 7de46038c6..23d7131244 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -70,6 +70,7 @@ class StandaloneDragonfly extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 3257a9c108..d2aa105bd3 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -71,6 +71,7 @@ class StandaloneKeydb extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index ea3bc39ce4..be5c464e0d 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -73,6 +73,7 @@ class StandaloneMariadb extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index 41bf67678b..208b5e917a 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -72,6 +72,7 @@ class StandaloneMongodb extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 2593bafa32..68a73ae573 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -74,6 +74,7 @@ class StandaloneMysql extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index 9e6f66c958..7829ab0d0e 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -76,6 +76,7 @@ class StandalonePostgresql extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 7fe86c9974..d3c8004ae3 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -72,6 +72,7 @@ class StandaloneRedis extends BaseModel
     ];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/StandaloneSqlite.php b/app/Models/StandaloneSqlite.php
index e3490c1031..2f6993865c 100644
--- a/app/Models/StandaloneSqlite.php
+++ b/app/Models/StandaloneSqlite.php
@@ -60,6 +60,7 @@ class StandaloneSqlite extends BaseModel
     protected $appends = ['database_type', 'server_status'];
 
     protected $casts = [
+        'include_coolify_default_variables' => 'boolean',
         'health_check_enabled' => 'boolean',
         'health_check_interval' => 'integer',
         'health_check_timeout' => 'integer',
diff --git a/app/Models/User.php b/app/Models/User.php
index 743871fcfc..1257f3c857 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -263,7 +263,7 @@ class User extends Authenticatable implements PasskeyUser, SendsEmail
         return $new_team;
     }
 
-    public function createToken(string $name, array $abilities = ['read'], ?DateTimeInterface $expiresAt = null)
+    public function createToken(string $name, array $abilities = ['read'], ?DateTimeInterface $expiresAt = null, ?int $teamId = null)
     {
         $plainTextToken = sprintf(
             '%s%s%s',
@@ -277,7 +277,7 @@ class User extends Authenticatable implements PasskeyUser, SendsEmail
             'token' => hash('sha256', $plainTextToken),
             'abilities' => $abilities,
             'expires_at' => $expiresAt,
-            'team_id' => session('currentTeam')->id,
+            'team_id' => $teamId ?? session('currentTeam')->id,
         ]);
 
         return new NewAccessToken($token, $token->getKey().'|'.$plainTextToken);
diff --git a/app/Rules/ValidGitRepositoryUrl.php b/app/Rules/ValidGitRepositoryUrl.php
index 9a04409046..8b2d484e54 100644
--- a/app/Rules/ValidGitRepositoryUrl.php
+++ b/app/Rules/ValidGitRepositoryUrl.php
@@ -29,7 +29,7 @@ class ValidGitRepositoryUrl implements ValidationRule
 
         // Brackets are only allowed around an IPv6 host, so check the rest of the URL without it.
         $valueWithoutIpv6Host = preg_replace_callback(
-            '/^((?:https?|git):\/\/|[a-zA-Z0-9._-]+@)\[([0-9A-Fa-f:.]+)\]/',
+            '/^((?:https?|git):\/\/|(?:ssh:\/\/)?[a-zA-Z0-9._-]+@)\[([0-9A-Fa-f:.]+)\]/',
             fn (array $matches): string => filter_var($matches[2], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false ? $matches[1].'ipv6-host' : $matches[0],
             $value,
         );
@@ -96,6 +96,19 @@ class ValidGitRepositoryUrl implements ValidationRule
             if ($scp === null || preg_match('/^(\[[0-9A-Fa-f:.]+\]|[a-zA-Z0-9.-]+)$/', $scp['host']) !== 1 || preg_match('/^[a-zA-Z0-9\-_\/.~]+$/', $scp['path']) !== 1) {
                 $fail('The :attribute is not a valid SSH repository URL.');
 
+                return;
+            }
+        } elseif (str_starts_with($value, 'ssh://')) {
+            if (! $this->allowSSH) {
+                $fail('SSH URLs are not allowed.');
+
+                return;
+            }
+
+            // Validate ssh:// URL format (ssh://user@host[:port]/user/repo.git)
+            if (! preg_match('/^ssh:\/\/[a-zA-Z0-9._-]+@(\[[0-9A-Fa-f:.]+\]|[a-zA-Z0-9.-]+)(:[0-9]{1,5})?\/[a-zA-Z0-9\-_\/.~]+$/', $value)) {
+                $fail('The :attribute is not a valid SSH repository URL.');
+
                 return;
             }
         } elseif (str_starts_with($value, 'http://') || str_starts_with($value, 'https://')) {
@@ -160,7 +173,7 @@ class ValidGitRepositoryUrl implements ValidationRule
                 return;
             }
         } else {
-            $fail('The :attribute must start with https://, http://, git://, or be an SSH URL (user@host:path).');
+            $fail('The :attribute must start with https://, http://, git://, ssh://, or be an SSH URL (user@host:path).');
 
             return;
         }
diff --git a/app/Services/ContainerFilesystemService.php b/app/Services/ContainerFilesystemService.php
new file mode 100644
index 0000000000..e7178ed765
--- /dev/null
+++ b/app/Services/ContainerFilesystemService.php
@@ -0,0 +1,426 @@
+<?php
+
+namespace App\Services;
+
+use App\Data\FileEntry;
+use App\Helpers\SshMultiplexingHelper;
+use App\Models\LocalFileVolume;
+use App\Models\Server;
+use Illuminate\Support\Str;
+
+class ContainerFilesystemService
+{
+    /**
+     * Inline `echo <base64> | base64 -d` writes travel as a single execve
+     * argument, capped at ~128 KiB by MAX_ARG_STRLEN. base64 inflates by 4/3,
+     * so keep inline content below that limit with room for command quoting.
+     */
+    private const MAX_INLINE_WRITE_SIZE = 64 * 1024;
+
+    /** Largest file, or uncompressed folder, the file browser may download. */
+    public const MAX_DOWNLOAD_SIZE = 1024 * 1024 * 1024;
+
+    public function __construct(
+        private Server $server,
+        private string $container,
+    ) {}
+
+    public function buildListCommand(string $path): string
+    {
+        $escapedPath = $this->escapePath($path, 'list path');
+
+        // Emit the whole directory through batched stat calls (one for most folders)
+        // instead of a per-entry loop. %F is the human file type ("directory",
+        // "symbolic link", "regular file"), mapped to a token by parseListing.
+        // Fields: type<TAB>size<TAB>mtime<TAB>perms<TAB>owner<TAB>group<TAB>name.
+        // A real tab is embedded in the format because stat's -c does NOT expand
+        // a backslash \t escape (unlike printf) - it would emit the literal text.
+        // POSIX `find ... -prune -exec {} +` lists hidden files without recursing
+        // and batches names, so a huge directory cannot overflow the argument
+        // limit like a `* .*` glob would. Names arrive as ./name; parseListing
+        // strips that prefix. Names containing a tab/newline are skipped (v1 scope).
+        $tab = "\t";
+        $format = '%F'.$tab.'%s'.$tab.'%Y'.$tab.'%a'.$tab.'%U'.$tab.'%G'.$tab.'%n';
+        $inner = 'cd '.$escapedPath.' 2>/dev/null || exit 0; '
+            .'find . ! -name . -prune -exec stat -c "'.$format.'" -- {} + 2>/dev/null';
+
+        return $this->dockerExecShell($inner);
+    }
+
+    /**
+     * @return array<int, FileEntry>
+     */
+    public function list(string $path): array
+    {
+        $raw = instant_remote_process([$this->buildListCommand($path)], $this->server, throwError: false);
+
+        return $this->parseListing($raw);
+    }
+
+    /**
+     * Read an editable text file in a single SSH round trip.
+     *
+     * The remote command folds the size cap, binary probe and base64 read into
+     * one docker exec: it prints TOOBIG or BINARY for a rejected file, otherwise
+     * an "OK\n" header followed by the base64 payload (empty for a 0-byte file,
+     * which is valid editable text). base64 keeps exact bytes safe from the
+     * trailing-whitespace trim in instant_remote_process.
+     *
+     * @throws \RuntimeException when the file is binary or larger than the cap
+     */
+    public function read(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'read path');
+        $max = LocalFileVolume::MAX_CONTENT_SIZE;
+
+        $cmd = '[ -f '.$escaped.' ] && [ -r '.$escaped.' ] || exit 1; '
+            .'sz=$(stat -Lc %s -- '.$escaped.') || exit 1; '
+            .'if [ "$sz" -gt '.$max.' ]; then echo TOOBIG; exit 0; fi; '
+            .'if [ -s '.$escaped.' ] && ! grep -qI \'\' -- '.$escaped.'; then echo BINARY; exit 0; fi; '
+            .'echo OK; base64 -- '.$escaped.' || exit 1';
+
+        $raw = (string) instant_remote_process(
+            [$this->dockerExecShell($cmd)],
+            $this->server,
+        );
+
+        $newline = strpos($raw, "\n");
+        $status = $newline === false ? trim($raw) : substr($raw, 0, $newline);
+        if ($status === 'TOOBIG' || $status === 'BINARY') {
+            throw new \RuntimeException('File is not editable (binary or too large).');
+        }
+
+        $payload = $newline === false ? '' : substr($raw, $newline + 1);
+
+        $content = base64_decode(trim($payload), true);
+        if ($status !== 'OK' || $content === false || strlen($content) > $max) {
+            throw new \RuntimeException('Could not read file.');
+        }
+
+        return $content;
+    }
+
+    public function buildWriteCommand(string $path, string $content): string
+    {
+        $escaped = $this->escapePath($path, 'write path');
+        $b64 = base64_encode($content);
+
+        return $this->dockerExecShell("echo {$b64} | base64 -d > {$escaped}");
+    }
+
+    public function buildMkdirCommand(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'mkdir path');
+
+        return $this->dockerExecShell("mkdir -p -- {$escaped}");
+    }
+
+    public function buildCreateFileCommand(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'create file path');
+
+        // Create only if absent so an existing file is never truncated.
+        return $this->dockerExecShell("[ -e {$escaped} ] || : > {$escaped}");
+    }
+
+    public function buildChmodCommand(string $path, string $mode): string
+    {
+        $mode = $this->normalizeMode($mode);
+        $escaped = $this->escapePath($path, 'chmod path');
+
+        return $this->dockerExecShell("chmod {$mode} -- {$escaped}");
+    }
+
+    public function buildRenameCommand(string $from, string $to): string
+    {
+        $escapedFrom = $this->escapePath($from, 'rename source');
+        $escapedTo = $this->escapePath($to, 'rename target');
+
+        return $this->dockerExecShell("mv -- {$escapedFrom} {$escapedTo}");
+    }
+
+    public function buildDeleteCommand(string $path): string
+    {
+        $escaped = $this->escapePath($path, 'delete path');
+
+        return $this->dockerExecShell("rm -rf -- {$escaped}");
+    }
+
+    public function write(string $path, string $content): void
+    {
+        if (strlen($content) > self::MAX_INLINE_WRITE_SIZE) {
+            $this->writeViaUpload($path, $content);
+
+            return;
+        }
+        instant_remote_process([$this->buildWriteCommand($path, $content)], $this->server);
+    }
+
+    /**
+     * Write content too large for a single shell argument by staging it to a
+     * local temp file and reusing the docker cp upload path.
+     */
+    protected function writeViaUpload(string $path, string $content): void
+    {
+        validateShellSafePath($path, 'write path');
+        $localTmp = storage_path('app/tmp/'.Str::random(16));
+        @mkdir(dirname($localTmp), 0755, true);
+        file_put_contents($localTmp, $content);
+        try {
+            $this->upload($localTmp, $path);
+        } finally {
+            @unlink($localTmp);
+        }
+    }
+
+    public function makeDirectory(string $path): void
+    {
+        instant_remote_process([$this->buildMkdirCommand($path)], $this->server);
+    }
+
+    public function createFile(string $path): void
+    {
+        instant_remote_process([$this->buildCreateFileCommand($path)], $this->server);
+    }
+
+    public function chmod(string $path, string $mode): void
+    {
+        instant_remote_process([$this->buildChmodCommand($path, $mode)], $this->server);
+    }
+
+    protected function normalizeMode(string $mode): string
+    {
+        $mode = trim($mode);
+        if (! preg_match('/^[0-7]{3,4}$/', $mode)) {
+            throw new \InvalidArgumentException('Invalid permission mode. Use octal like 644 or 0755.');
+        }
+
+        return $mode;
+    }
+
+    public function rename(string $from, string $to): void
+    {
+        instant_remote_process([$this->buildRenameCommand($from, $to)], $this->server);
+    }
+
+    public function delete(string $path): void
+    {
+        instant_remote_process([$this->buildDeleteCommand($path)], $this->server);
+    }
+
+    public function defaultRoot(): string
+    {
+        $escapedContainer = escapeshellarg($this->container);
+        $workingDir = instant_remote_process(
+            ["docker inspect --format '{{.Config.WorkingDir}}' {$escapedContainer}"],
+            $this->server,
+            throwError: false,
+        );
+
+        $workingDir = trim((string) $workingDir);
+
+        return $workingDir !== '' ? $workingDir : '/';
+    }
+
+    /**
+     * @return array<int, FileEntry>
+     */
+    public function parseListing(?string $raw): array
+    {
+        if (blank($raw)) {
+            return [];
+        }
+
+        $entries = [];
+        foreach (explode("\n", trim($raw)) as $line) {
+            if ($line === '') {
+                continue;
+            }
+            $parts = explode("\t", $line, 7);
+            $owner = '';
+            $group = '';
+            // Accept the current 7-field format (with owner/group) and the
+            // legacy 5-field (perms) and 4-field formats.
+            if (count($parts) === 7) {
+                [$type, $size, $mtime, $perms, $owner, $group, $name] = $parts;
+            } elseif (count($parts) === 5) {
+                [$type, $size, $mtime, $perms, $name] = $parts;
+            } elseif (count($parts) === 4) {
+                [$type, $size, $mtime, $name] = $parts;
+                $perms = '';
+            } else {
+                continue;
+            }
+            // find prefixes names with ./; a name itself can never contain a slash.
+            if (str_starts_with($name, './')) {
+                $name = substr($name, 2);
+            }
+            if ($name === '' || $name === '.' || $name === '..') {
+                continue;
+            }
+            $entries[] = new FileEntry(
+                $name,
+                $this->normalizeType($type),
+                (int) $size,
+                (int) $mtime,
+                trim($perms),
+                trim($owner),
+                trim($group),
+            );
+        }
+
+        return FileEntry::sort($entries);
+    }
+
+    /**
+     * Map a raw type field to a file/dir/symlink token. Accepts both the
+     * already-tokenized legacy value and stat's human %F string.
+     */
+    protected function normalizeType(string $raw): string
+    {
+        $t = strtolower(trim($raw));
+        if ($t === 'dir' || str_contains($t, 'directory')) {
+            return 'dir';
+        }
+        if ($t === 'symlink' || str_contains($t, 'symbolic link')) {
+            return 'symlink';
+        }
+
+        return 'file';
+    }
+
+    public function upload(string $localTmpPath, string $destPath): void
+    {
+        validateShellSafePath($destPath, 'upload path');
+        $serverTmp = '/tmp/coolify-upload-'.Str::random(16);
+        $escapedServerTmp = escapeshellarg($serverTmp);
+        $escapedContainer = escapeshellarg($this->container);
+        $escapedDest = escapeshellarg($destPath);
+
+        try {
+            instant_scp($localTmpPath, $serverTmp, $this->server);
+            instant_remote_process(
+                ["docker cp {$escapedServerTmp} {$escapedContainer}:{$escapedDest}"],
+                $this->server,
+            );
+        } finally {
+            instant_remote_process(["rm -f {$escapedServerTmp}"], $this->server, throwError: false);
+        }
+    }
+
+    /**
+     * Inspect a download target in one round trip. Folder size is the
+     * uncompressed disk usage, so the archive is never larger than reported.
+     *
+     * @return array{isDir: bool, size: int}
+     *
+     * @throws \RuntimeException when the path does not exist
+     */
+    public function downloadInfo(string $path): array
+    {
+        $escaped = $this->escapePath($path, 'download path');
+        $cmd = 'if [ -d '.$escaped.' ]; then echo "dir $(du -sk '.$escaped.' | cut -f1)"; '
+            .'elif [ -e '.$escaped.' ]; then echo "file $(stat -L -c %s '.$escaped.')"; fi';
+
+        $raw = trim((string) instant_remote_process([$this->dockerExecShell($cmd)], $this->server));
+        [$kind, $size] = array_pad(explode(' ', $raw, 2), 2, '');
+        if (! in_array($kind, ['dir', 'file'], true) || ! ctype_digit($size)) {
+            throw new \RuntimeException('File not found.');
+        }
+
+        return [
+            'isDir' => $kind === 'dir',
+            'size' => $kind === 'dir' ? (int) $size * 1024 : (int) $size,
+        ];
+    }
+
+    public function buildDownloadCommand(string $path, bool $isDir): string
+    {
+        $escaped = $this->escapePath($path, 'download path');
+        $escapedContainer = escapeshellarg($this->container);
+
+        return $isDir
+            ? "docker exec {$escapedContainer} tar czf - -C {$escaped} ."
+            : "docker exec {$escapedContainer} cat -- {$escaped}";
+    }
+
+    /**
+     * Pipe a file, or a folder as .tar.gz, from the container to $write in
+     * chunks. Nothing is stored on the Coolify host or the managed server.
+     *
+     * @param  callable(string): void  $write
+     */
+    public function streamDownload(string $path, bool $isDir, callable $write): void
+    {
+        $command = $this->buildDownloadCommand($path, $isDir);
+        if ($this->server->isNonRoot()) {
+            $command = parseCommandsByLineForSudo(collect([$command]), $this->server)[0];
+        }
+
+        $process = proc_open($this->sshCommand($command), [1 => ['pipe', 'w'], 2 => ['file', '/dev/null', 'w']], $pipes);
+        if (! is_resource($process)) {
+            throw new \RuntimeException('Could not start the download.');
+        }
+
+        try {
+            while (! feof($pipes[1])) {
+                $chunk = fread($pipes[1], 64 * 1024);
+                if ($chunk === false || connection_aborted()) {
+                    break;
+                }
+                if ($chunk !== '') {
+                    $write($chunk);
+                }
+            }
+        } finally {
+            fclose($pipes[1]);
+            proc_terminate($process);
+            proc_close($process);
+        }
+    }
+
+    /**
+     * Stage the file, or the folder as .tar.gz, on the managed server and PUT
+     * it to a presigned S3 URL. S3 needs a Content-Length, so a pipe without a
+     * known size cannot be uploaded directly. The temp file is always removed.
+     *
+     * @param  array<string, string>  $headers
+     */
+    public function buildS3UploadCommand(string $path, bool $isDir, string $url, array $headers): string
+    {
+        $headerArgs = FileDownloadStorageService::curlHeaderArgs($headers);
+        $script = 'tmp=$(mktemp /tmp/coolify-download-XXXXXXXXXX) || exit 1; '
+            .'trap \'rm -f "$tmp"\' EXIT; '
+            .$this->buildDownloadCommand($path, $isDir).' > "$tmp" && '
+            .'curl -fsS --retry 2 '.$headerArgs.' -T "$tmp" '.escapeshellarg($url);
+
+        return 'sh -c '.escapeshellarg($script);
+    }
+
+    /**
+     * @param  array<string, string>  $headers
+     */
+    public function uploadToS3(string $path, bool $isDir, string $url, array $headers): void
+    {
+        instant_remote_process([$this->buildS3UploadCommand($path, $isDir, $url, $headers)], $this->server, timeout: 3600);
+    }
+
+    protected function sshCommand(string $command): string
+    {
+        return SshMultiplexingHelper::generateSshCommand($this->server, $command);
+    }
+
+    protected function escapePath(string $path, string $label): string
+    {
+        validateShellSafePath($path, $label);
+
+        return escapeshellarg($path);
+    }
+
+    protected function dockerExecShell(string $innerShell): string
+    {
+        $escapedContainer = escapeshellarg($this->container);
+
+        return "docker exec {$escapedContainer} sh -c ".escapeshellarg($innerShell);
+    }
+}
diff --git a/app/Services/Dns/CloudflareDnsProvider.php b/app/Services/Dns/CloudflareDnsProvider.php
index d3c57b78b5..9cd21a4fbf 100644
--- a/app/Services/Dns/CloudflareDnsProvider.php
+++ b/app/Services/Dns/CloudflareDnsProvider.php
@@ -330,6 +330,85 @@ class CloudflareDnsProvider
         return $this->forgetDeletedRecord($record, ManagedDnsDeletionResult::Deleted, $resource);
     }
 
+    /**
+     * Takes ownership of a record that another Coolify instance created, after a server transfer. The provider
+     * comment changes from $previousComment to the ownership comment of this instance only when the record still
+     * has the expected type, name, value and comment. Never throws; returns false when the record was not adopted.
+     */
+    public function adoptRecord(ManagedDnsRecord $record, string $previousComment): bool
+    {
+        try {
+            $record->loadMissing(['zone', 'integrationToken']);
+            if ($record->zone === null || $record->integrationToken?->provider !== 'cloudflare') {
+                return false;
+            }
+
+            return $this->hostnameLock->run(
+                (int) $record->integrationToken->team_id,
+                $record->name,
+                fn (): bool => $this->adoptRecordLocked($record, $previousComment),
+            );
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Takes a record back after a take back, when another Coolify instance may have adopted it meanwhile. The
+     * provider comment must be an ownership comment for this record uuid, from this or any other instance.
+     * Never throws; returns false when the record was not taken back.
+     */
+    public function reclaimRecord(ManagedDnsRecord $record): bool
+    {
+        try {
+            $record->loadMissing(['zone', 'integrationToken']);
+            if ($record->zone === null || $record->integrationToken?->provider !== 'cloudflare') {
+                return false;
+            }
+
+            return $this->hostnameLock->run(
+                (int) $record->integrationToken->team_id,
+                $record->name,
+                function () use ($record): bool {
+                    $url = "https://api.cloudflare.com/client/v4/zones/{$record->zone->provider_zone_id}/dns_records/{$record->provider_record_id}";
+                    $comment = $this->client($record->integrationToken)->get($url)->json('result.comment');
+                    $pattern = '/^'.preg_quote(ManagedDnsRecord::OWNERSHIP_COMMENT_PREFIX, '/').' \\S+\\/'.preg_quote($record->uuid, '/').'$/';
+                    if (! is_string($comment) || preg_match($pattern, $comment) !== 1) {
+                        return false;
+                    }
+
+                    return $comment === $record->ownershipComment() || $this->adoptRecordLocked($record, $comment);
+                },
+            );
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    private function adoptRecordLocked(ManagedDnsRecord $record, string $previousComment): bool
+    {
+        $url = "https://api.cloudflare.com/client/v4/zones/{$record->zone->provider_zone_id}/dns_records/{$record->provider_record_id}";
+        $response = $this->client($record->integrationToken)->get($url);
+        $remote = $response->json('result');
+        if (! $response->successful() || ! is_array($remote)) {
+            return false;
+        }
+        if (($remote['type'] ?? null) !== $record->type
+            || strtolower((string) ($remote['name'] ?? '')) !== $record->name
+            || ! DnsRecordHints::sameAddress(is_string($remote['content'] ?? null) ? $remote['content'] : null, $record->content)
+            || ($remote['comment'] ?? null) !== $previousComment) {
+            return false;
+        }
+
+        $patchResponse = $this->client($record->integrationToken)->patch($url, ['comment' => $record->ownershipComment()]);
+        if (! $patchResponse->successful()) {
+            return false;
+        }
+        $this->auditDnsRecord('ownership_adopted', $record->zone, $record->name, null);
+
+        return true;
+    }
+
     private function forgetDeletedRecord(ManagedDnsRecord $record, ManagedDnsDeletionResult $result, ?Model $resource): ManagedDnsDeletionResult
     {
         $record->delete();
diff --git a/app/Services/Dns/ManagedDnsRecordCleanup.php b/app/Services/Dns/ManagedDnsRecordCleanup.php
index d8d02dfd73..59b75a55a6 100644
--- a/app/Services/Dns/ManagedDnsRecordCleanup.php
+++ b/app/Services/Dns/ManagedDnsRecordCleanup.php
@@ -149,6 +149,71 @@ class ManagedDnsRecordCleanup
         return $successful;
     }
 
+    /**
+     * Stops tracking the records of these resources without touching the provider. Used when another Coolify
+     * instance takes over the resources: their records still serve live traffic there. A record that another
+     * resource of this instance still uses keeps that resource's references.
+     *
+     * @param  iterable<int, Model>  $resources
+     */
+    public function forgetResources(iterable $resources): void
+    {
+        $keys = collect($resources)
+            ->flatMap(fn (Model $resource) => $this->resourceKeys($resource->getMorphClass(), $resource->getKey()))
+            ->all();
+        if ($keys === []) {
+            return;
+        }
+
+        $records = ManagedDnsRecord::query()
+            ->whereHas('references', fn (Builder $query) => $this->whereResourceKeys($query, $keys))
+            ->get();
+
+        foreach ($records as $record) {
+            $this->deleteReferences($record, $keys);
+            if (! $record->references()->exists()) {
+                $this->forget($record, 'The resource was transferred to another Coolify instance, which uses the record now.', 'info');
+            }
+        }
+    }
+
+    /**
+     * Keeps the records of resources that another Coolify instance manages now, for a later take back, but marks
+     * them not owned, so this instance never changes or deletes them at the provider. A record that another
+     * resource of this instance also uses only loses the references of these resources.
+     *
+     * @param  iterable<int, Model>  $resources
+     * @return list<int> ids of the records that were owned before
+     */
+    public function parkResources(iterable $resources): array
+    {
+        $keys = collect($resources)
+            ->flatMap(fn (Model $resource) => $this->resourceKeys($resource->getMorphClass(), $resource->getKey()))
+            ->all();
+        if ($keys === []) {
+            return [];
+        }
+
+        $parked = [];
+        $records = ManagedDnsRecord::query()
+            ->whereHas('references', fn (Builder $query) => $this->whereResourceKeys($query, $keys))
+            ->get();
+        foreach ($records as $record) {
+            $sharedWithOthers = $record->references()->whereNot(fn (Builder $query) => $this->whereResourceKeys($query, $keys))->exists();
+            if ($sharedWithOthers) {
+                $this->deleteReferences($record, $keys);
+
+                continue;
+            }
+            if ($record->owned) {
+                $record->update(['owned' => false]);
+                $parked[] = $record->id;
+            }
+        }
+
+        return $parked;
+    }
+
     /**
      * Releases orphaned records: records whose references all point to deleted (or soft-deleted) resources, and
      * records without references that are older than the grace period. Records with a live reference are not touched.
diff --git a/app/Services/EnvironmentCanvas.php b/app/Services/EnvironmentCanvas.php
index ff42ebf6bd..8372af3371 100644
--- a/app/Services/EnvironmentCanvas.php
+++ b/app/Services/EnvironmentCanvas.php
@@ -4,6 +4,7 @@ namespace App\Services;
 
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\Project;
 use App\Models\ResourceLink;
 use App\Models\Server;
 use App\Models\Service;
@@ -22,6 +23,9 @@ class EnvironmentCanvas
 {
     public const MAX_COORDINATE = 100000;
 
+    /** Zone id of the placeholder cards of environments without resources. */
+    public const EMPTY_ZONE = 'empty';
+
     /**
      * Environment relations that hold standalone databases, keyed by relation name.
      */
@@ -108,6 +112,8 @@ class EnvironmentCanvas
                 $servers->put($server->id, $server);
             }
             unset($node['servers']);
+            // Other canvases keep the arrangement saved on the environment canvas inside each environment group.
+            $node['saved'] = $this->filterPositions($resource->environment?->canvas_positions ?? [], [$resource->uuid])[$resource->uuid] ?? null;
 
             return $node;
         })->values();
@@ -146,6 +152,65 @@ class EnvironmentCanvas
         ];
     }
 
+    /**
+     * Zone of the server, project and dashboard canvases for environments without resources (they have no server).
+     *
+     * @return array{id: string, name: string, icon: string}
+     */
+    public function emptyZone(): array
+    {
+        return ['id' => self::EMPTY_ZONE, 'name' => 'Empty environments', 'icon' => 'service'];
+    }
+
+    /**
+     * Zone for the placeholder cards of a project: the zone with most of the project's cards, or `$fallback`
+     * when the project has no cards.
+     *
+     * @param  Collection<int, array<string, mixed>>  $nodes  cards of the canvas
+     * @return callable(Project): string
+     */
+    public function projectZones(Collection $nodes, string $fallback): callable
+    {
+        $zones = $nodes
+            ->filter(fn (array $node) => filled($node['zone']))
+            ->groupBy(fn (array $node) => data_get($node, 'project.uuid'))
+            ->map(fn (Collection $cards) => $cards->countBy('zone')->sortDesc()->keys()->first());
+
+        return fn (Project $project) => $zones->get($project->uuid, $fallback);
+    }
+
+    /**
+     * Placeholder card of an environment without resources, so the grouped canvases still show it.
+     * Without an environment, it stands for a project without environments.
+     * `$canAdd`: the card opens the deploy canvas for the environment instead of the environment page.
+     *
+     * @return array<string, mixed>
+     */
+    public function emptyNode(Project $project, ?Environment $environment, string $zone, string $context, bool $canAdd = false): array
+    {
+        $page = $environment
+            ? route('project.resource.index', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])
+            : route('project.show', ['project_uuid' => $project->uuid]);
+        $add = $canAdd && $environment;
+
+        return [
+            'id' => 'empty:'.($environment?->uuid ?? $project->uuid),
+            'type' => 'empty',
+            'name' => $environment ? 'No resources yet' : 'No environments yet',
+            'subtitle' => $add ? 'Click to add a resource' : 'Open to see this '.($environment ? 'environment' : 'project'),
+            'status' => null,
+            'zone' => $zone,
+            'extra_zones' => [],
+            'urls' => [],
+            'children' => [],
+            'link' => $add ? route('deploy-canvas', ['project' => $project->uuid, 'environment' => $environment->uuid]) : $page,
+            'context' => $context,
+            'context_link' => $page,
+            'project' => ['uuid' => $project->uuid, 'name' => $project->name],
+            'environment' => $environment ? ['uuid' => $environment->uuid, 'name' => $environment->name] : null,
+        ];
+    }
+
     /**
      * Top-level resources of the environment (applications, services, standalone databases), keyed by uuid,
      * with the relations the canvas reads.
@@ -157,19 +222,19 @@ class EnvironmentCanvas
         $project = $environment->project;
         $environment->setRelation('project', $project);
         $applications = $environment->applications()
-            ->with(['destination.server.settings', 'additional_servers.settings', 'persistentStorages'])
+            ->with(['destination.server.settings', 'additional_servers.settings'])
             ->get();
         $services = $environment->services()
             ->with([
                 'server.settings',
                 'destination.server.settings',
-                'applications.persistentStorages',
-                'databases.persistentStorages',
+                'applications',
+                'databases',
             ])
             ->get();
         $databases = collect(self::DATABASE_RELATIONS)
             ->flatMap(fn (string $relation) => $environment->{$relation}()
-                ->with(['destination.server.settings', 'persistentStorages'])
+                ->with(['destination.server.settings'])
                 ->get());
 
         return collect()
@@ -251,7 +316,6 @@ class EnvironmentCanvas
             'kind' => $buildPack,
             'subtitle' => $this->subtitle([self::BUILD_PACK_NAMES[$buildPack] ?? str($buildPack)->headline()->value(), $detail]),
             'children' => [],
-            'volumes' => $application->persistentStorages->pluck('name')->filter()->values()->all(),
             'link' => $application->link(),
             'logo' => resource_logo($application),
             'servers' => collect([$server])->concat($extraServers)->filter()->all(),
@@ -285,12 +349,6 @@ class EnvironmentCanvas
             'kind' => null,
             'subtitle' => $this->subtitle(['Service', $containerCount.' '.str('container')->plural($containerCount)]),
             'children' => $children->all(),
-            'volumes' => $service->applications->concat($service->databases)
-                ->flatMap(fn ($child) => $child->persistentStorages->pluck('name'))
-                ->filter()
-                ->unique()
-                ->values()
-                ->all(),
             'link' => $service->link(),
             'logo' => resource_logo($service),
             'servers' => collect([$server])->filter()->all(),
@@ -316,7 +374,6 @@ class EnvironmentCanvas
             'kind' => $engine,
             'subtitle' => $this->subtitle([self::DATABASE_ENGINE_NAMES[$engine] ?? str($engine)->headline()->value(), $database->image]),
             'children' => [],
-            'volumes' => $database->persistentStorages->pluck('name')->filter()->values()->all(),
             'link' => $database->link(),
             'logo' => resource_logo($database),
             'servers' => collect([$server])->filter()->all(),
diff --git a/app/Services/FileDownloadStorageService.php b/app/Services/FileDownloadStorageService.php
new file mode 100644
index 0000000000..f342873c9c
--- /dev/null
+++ b/app/Services/FileDownloadStorageService.php
@@ -0,0 +1,207 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Rules\SafeWebhookUrl;
+use Aws\S3\Exception\S3Exception;
+use Aws\S3\S3Client;
+use Illuminate\Support\Str;
+use RuntimeException;
+
+/**
+ * Optional S3 path for file browser downloads. The managed server uploads
+ * straight to S3 with a presigned URL and the browser downloads from S3, so
+ * the file never passes through the Coolify host.
+ */
+class FileDownloadStorageService
+{
+    public const PREFIX = 'coolify-file-downloads/';
+
+    public const LIFECYCLE_RULE_ID = 'coolify-file-downloads';
+
+    /**
+     * S3 checks the link time when a download starts, so a download that has
+     * started finishes after the link expires. Nobody can start a new one.
+     */
+    public const LINK_TTL_MINUTES = 15;
+
+    /** An expired object cannot be downloaded, so it can stay until the delete job runs. */
+    public const OBJECT_TTL_HOURS = 6;
+
+    /** A single S3 PUT accepts at most 5 GiB. */
+    public const MAX_SIZE = 5 * 1024 * 1024 * 1024;
+
+    public static function configuredStorage(): ?S3Storage
+    {
+        $storageId = instanceSettings()->file_download_s3_storage_id;
+        if (! $storageId) {
+            return null;
+        }
+
+        return S3Storage::query()->whereTeamId(0)->where('is_usable', true)->find($storageId);
+    }
+
+    public static function newObjectKey(): string
+    {
+        return self::PREFIX.Str::random(48);
+    }
+
+    /**
+     * Add or replace the rule that deletes download objects after one day.
+     * S3 lifecycle rules have a one-day minimum, so this is only a safety net
+     * for the six-hour delete job. Other rules on the bucket are kept.
+     *
+     * @throws RuntimeException when the bucket does not accept the rule
+     */
+    public function ensureLifecycleRule(S3Storage $storage): void
+    {
+        try {
+            $client = $storage->filesystem()->getClient();
+            try {
+                $rules = $client->getBucketLifecycleConfiguration(['Bucket' => $storage->bucket])['Rules'] ?? [];
+            } catch (S3Exception $e) {
+                if ($e->getAwsErrorCode() !== 'NoSuchLifecycleConfiguration') {
+                    throw $e;
+                }
+                $rules = [];
+            }
+
+            $rules = array_values(array_filter($rules, fn (array $rule) => ($rule['ID'] ?? null) !== self::LIFECYCLE_RULE_ID));
+            $rules[] = [
+                'ID' => self::LIFECYCLE_RULE_ID,
+                'Filter' => ['Prefix' => self::PREFIX],
+                'Status' => 'Enabled',
+                'Expiration' => ['Days' => 1],
+            ];
+
+            $client->putBucketLifecycleConfiguration([
+                'Bucket' => $storage->bucket,
+                'LifecycleConfiguration' => ['Rules' => $rules],
+            ]);
+        } catch (\Throwable $e) {
+            throw new RuntimeException('Could not add the auto-delete lifecycle rule to bucket "'.$storage->bucket.'". The S3 provider must support lifecycle rules, and the key must be allowed to change them. Error: '.$e->getMessage(), previous: $e);
+        }
+    }
+
+    /**
+     * Download links are only safe while object keys stay secret. Refuse a
+     * bucket that lets anonymous users list its objects, and an endpoint that
+     * only Coolify can reach (servers upload to it, browsers download from it).
+     *
+     * @throws RuntimeException when the endpoint is internal, unreachable or listable
+     */
+    public function ensureBucketIsPrivate(S3Storage $storage): void
+    {
+        if ($storage->trustedInternalHosts() !== []) {
+            throw new RuntimeException('"'.$storage->name.'" uses an internal Docker host name. Your servers and browsers cannot reach it. Use an S3 endpoint with a public or LAN address.');
+        }
+
+        try {
+            $this->anonymousClient($storage)->listObjectsV2(['Bucket' => $storage->bucket, 'Prefix' => self::PREFIX, 'MaxKeys' => 1]);
+        } catch (S3Exception $e) {
+            if ($e->getResponse() === null && $e->getAwsErrorCode() === null) {
+                throw new RuntimeException('Could not connect to "'.$storage->name.'". Check the endpoint. Your servers and browsers must reach it too. Error: '.$e->getMessage(), previous: $e);
+            }
+
+            return;
+        } catch (\Throwable $e) {
+            throw new RuntimeException('Could not connect to "'.$storage->name.'". Check the endpoint. Your servers and browsers must reach it too. Error: '.$e->getMessage(), previous: $e);
+        }
+
+        throw new RuntimeException('Bucket "'.$storage->bucket.'" allows anonymous listing. Make the bucket private before you use it for file downloads.');
+    }
+
+    protected function anonymousClient(S3Storage $storage): S3Client
+    {
+        return new S3Client([
+            'version' => 'latest',
+            'region' => $storage->region,
+            'endpoint' => $storage->endpoint,
+            'use_path_style_endpoint' => true,
+            'credentials' => false,
+            'retries' => 0,
+            'http' => array_merge(SafeWebhookUrl::httpClientOptions($storage->endpoint, $storage->trustedInternalHosts()), [
+                'connect_timeout' => 15,
+                'timeout' => 15,
+            ]),
+        ]);
+    }
+
+    /**
+     * @return array{url: string, headers: array<string, string>}
+     */
+    public function uploadUrl(S3Storage $storage, string $key, string $downloadName): array
+    {
+        $upload = $storage->filesystem()->temporaryUploadUrl($key, now()->addHour(), [
+            'ContentDisposition' => self::contentDisposition($downloadName),
+        ]);
+
+        return [
+            'url' => $upload['url'],
+            'headers' => collect($upload['headers'])
+                ->map(fn ($value) => is_array($value) ? implode(', ', $value) : (string) $value)
+                ->except(['Host', 'host'])
+                ->all(),
+        ];
+    }
+
+    public function downloadUrl(S3Storage $storage, string $key): string
+    {
+        return $storage->filesystem()->temporaryUrl($key, now()->addMinutes(self::LINK_TTL_MINUTES));
+    }
+
+    public function delete(S3Storage $storage, string $key): void
+    {
+        $storage->filesystem()->delete($key);
+    }
+
+    /**
+     * Size in bytes of a file on the server host (for example a backup), or
+     * null when the file does not exist.
+     */
+    public static function hostFileSize(Server $server, string $path): ?int
+    {
+        $size = trim((string) instant_remote_process([self::buildHostFileSizeCommand($path)], $server));
+
+        return ctype_digit($size) ? (int) $size : null;
+    }
+
+    public static function buildHostFileSizeCommand(string $path): string
+    {
+        validateShellSafePath($path, 'download path');
+        $escaped = escapeshellarg($path);
+
+        return 'sh -c '.escapeshellarg('if [ -f '.$escaped.' ]; then stat -L -c %s '.$escaped.'; fi');
+    }
+
+    /**
+     * PUT a file on the server host to a presigned S3 URL.
+     *
+     * @param  array<string, string>  $headers
+     */
+    public static function buildHostFileUploadCommand(string $path, string $url, array $headers): string
+    {
+        validateShellSafePath($path, 'download path');
+
+        return 'sh -c '.escapeshellarg('curl -fsS --retry 2 '.self::curlHeaderArgs($headers).' -T '.escapeshellarg($path).' '.escapeshellarg($url));
+    }
+
+    /**
+     * @param  array<string, string>  $headers
+     */
+    public static function curlHeaderArgs(array $headers): string
+    {
+        return collect($headers)
+            ->map(fn (string $value, string $name) => '-H '.escapeshellarg("{$name}: {$value}"))
+            ->implode(' ');
+    }
+
+    public static function contentDisposition(string $name): string
+    {
+        $fallback = preg_replace('/[^A-Za-z0-9._-]/', '_', $name) ?: 'download';
+
+        return 'attachment; filename="'.$fallback.'"; filename*=UTF-8\'\''.rawurlencode($name);
+    }
+}
diff --git a/app/Services/ProjectCanvas.php b/app/Services/ProjectCanvas.php
index 20e537a8c4..57619b2e30 100644
--- a/app/Services/ProjectCanvas.php
+++ b/app/Services/ProjectCanvas.php
@@ -6,6 +6,7 @@ use App\Models\Environment;
 use App\Models\Project;
 use App\Models\ResourceLink;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
 
 /**
  * Builds the project canvas: every resource of the project's environments, one zone per server,
@@ -19,13 +20,14 @@ class ProjectCanvas
     /**
      * The canvas of every project of a team: one zone per project, cards grouped by environment.
      *
-     * @return array{title: string, title_link: string, can_edit: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array<string, array{x: int, y: int}>}
+     * @return array{title: string, title_link: string, can_edit: bool, can_move: false, can_move_groups: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
      */
     public function teamPayload(int $teamId, bool $canReadSensitive, bool $canEdit = false): array
     {
         $projects = Project::query()->where('team_id', $teamId)->orderBy('name')->get(['id', 'uuid', 'name', 'team_id']);
         $environments = Environment::query()->whereIn('project_id', $projects->pluck('id'))
-            ->get(['id', 'uuid', 'name', 'project_id', 'canvas_positions']);
+            ->orderBy('id')
+            ->get(['id', 'uuid', 'name', 'project_id']);
         $resources = $this->servers->loadResources($environments->pluck('id'));
         $links = ResourceLink::query()->whereIn('environment_id', $environments->pluck('id'))->orderBy('id')->get();
         $graph = $this->canvas->graph($resources, $links, $canReadSensitive);
@@ -42,6 +44,10 @@ class ProjectCanvas
             'title' => 'Projects',
             'title_link' => route('project.index'),
             'can_edit' => $canEdit,
+            // Environment groups and cards keep their environment canvas arrangement.
+            'can_move' => false,
+            // Admins move groups and cards here; the canvas saves them on their environment canvas.
+            'can_move_groups' => $canEdit,
             // Same grouped layout as the server canvas, with projects as the zones.
             'layout' => 'server',
             'zones' => $projects->map(fn (Project $project) => [
@@ -50,21 +56,20 @@ class ProjectCanvas
                 'icon' => 'projects',
                 'link' => route('project.show', ['project_uuid' => $project->uuid]),
             ])->values()->all(),
-            'nodes' => collect($graph['nodes'])->map(fn (array $node) => [...$node, ...$grouping->get($node['id'])])->values()->all(),
+            'nodes' => collect($graph['nodes'])->map(fn (array $node) => [...$node, ...$grouping->get($node['id'])])
+                ->concat($projects->flatMap(fn (Project $project) => $this->emptyNodes($project, $environments->where('project_id', $project->id), $resources, $project->uuid, $canEdit)))
+                ->values()->all(),
             'links' => $graph['links'],
-            'positions' => $this->canvas->filterPositions(
-                $environments->reduce(fn (array $positions, Environment $environment) => [...$positions, ...($environment->canvas_positions ?? [])], []),
-                $resources->keys()->all(),
-            ),
+            'positions' => [],
         ];
     }
 
     /**
-     * @return array{title: string, title_link: string, can_edit: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array<string, array{x: int, y: int}>}
+     * @return array{title: string, title_link: string, can_edit: bool, can_move: false, can_move_groups: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
      */
     public function payload(Project $project, bool $canReadSensitive, bool $canEdit = false): array
     {
-        $environments = $project->environments()->get(['id', 'uuid', 'name', 'project_id', 'canvas_positions']);
+        $environments = $project->environments()->orderBy('id')->get(['id', 'uuid', 'name', 'project_id']);
         $resources = $this->servers->loadResources($environments->pluck('id'));
         $links = ResourceLink::query()->whereIn('environment_id', $environments->pluck('id'))->orderBy('id')->get();
         $graph = $this->canvas->graph($resources, $links, $canReadSensitive);
@@ -74,25 +79,50 @@ class ProjectCanvas
             'context_link' => route('project.resource.index', ['project_uuid' => $project->uuid, 'environment_uuid' => $resource->environment->uuid]),
             ...$this->owner($resource),
         ]);
+        $nodes = collect($graph['nodes'])->map(fn (array $node) => [...$node, ...$context->get($node['id'])]);
+        // Placeholder cards sit on the server of the project's other environments.
+        $zone = $this->canvas->projectZones($nodes, $graph['zones'][0]['id'] ?? EnvironmentCanvas::EMPTY_ZONE)($project);
+        $empty = $this->emptyNodes($project, $environments, $resources, $zone, $canEdit);
 
         return [
             'title' => $project->name,
             'title_link' => route('project.show', ['project_uuid' => $project->uuid]),
             'can_edit' => $canEdit,
+            'can_move' => false,
+            // Admins move groups and cards here; the canvas saves them on their environment canvas.
+            'can_move_groups' => $canEdit,
             // Groups cards by environment inside each server zone, like the server canvas.
             'layout' => 'server',
-            'zones' => $graph['zones'],
-            'nodes' => collect($graph['nodes'])->map(fn (array $node) => [...$node, ...$context->get($node['id'])])->values()->all(),
+            'zones' => $empty->isNotEmpty() && $zone === EnvironmentCanvas::EMPTY_ZONE ? [...$graph['zones'], $this->canvas->emptyZone()] : $graph['zones'],
+            'nodes' => $nodes->concat($empty)->values()->all(),
             'links' => $graph['links'],
-            'positions' => $this->canvas->filterPositions(
-                $environments->reduce(fn (array $positions, Environment $environment) => [...$positions, ...($environment->canvas_positions ?? [])], []),
-                $resources->keys()->all(),
-            ),
+            'positions' => [],
         ];
     }
 
     /**
-     * Project and environment of a card: the canvas saves moves and links on that environment canvas.
+     * Placeholder cards of the project's environments without resources, or one for the project when it has no environments.
+     *
+     * @param  Collection<int, Environment>  $environments  environments of the project
+     * @param  Collection<string, Model>  $resources
+     * @return Collection<int, array<string, mixed>>
+     */
+    private function emptyNodes(Project $project, Collection $environments, Collection $resources, string $zone, bool $canAdd): Collection
+    {
+        if ($environments->isEmpty()) {
+            return collect([$this->canvas->emptyNode($project, null, $zone, 'No environments')]);
+        }
+
+        $used = $resources->pluck('environment_id')->flip();
+
+        return $environments
+            ->reject(fn (Environment $environment) => $used->has($environment->id))
+            ->map(fn (Environment $environment) => $this->canvas->emptyNode($project, $environment, $zone, $environment->name, $canAdd))
+            ->values();
+    }
+
+    /**
+     * Project and environment of a card: the canvas saves links on that environment canvas.
      *
      * @return array{project: array{uuid: string, name: string}, environment: array{uuid: string, name: string}}
      */
diff --git a/app/Services/ProjectIconStorageService.php b/app/Services/ProjectIconStorageService.php
index b7a381e109..0c6d314816 100644
--- a/app/Services/ProjectIconStorageService.php
+++ b/app/Services/ProjectIconStorageService.php
@@ -9,6 +9,14 @@ use RuntimeException;
 class ProjectIconStorageService extends AvatarStorageService
 {
     public function storeProject(Project $project, UploadedFile $upload): void
+    {
+        $this->storeProjectContents($project, $this->compress($upload));
+    }
+
+    /**
+     * Stores an icon that is already a compressed JPEG, for example one from a server transfer bundle.
+     */
+    public function storeProjectContents(Project $project, string $contents): void
     {
         $settings = instanceSettings();
         $storageType = $settings->avatar_storage_type === 's3' && $settings->avatar_s3_storage_id ? 's3' : 'local';
@@ -16,7 +24,7 @@ class ProjectIconStorageService extends AvatarStorageService
         $disk = $this->disk($storageType, $s3StorageId);
         $path = "project-icons/{$project->uuid}/icon.jpg";
 
-        if (! $disk->put($path, $this->compress($upload))) {
+        if (! $disk->put($path, $contents)) {
             throw new RuntimeException('Unable to store the project icon.');
         }
 
diff --git a/app/Services/ScheduledJobDeliveryService.php b/app/Services/ScheduledJobDeliveryService.php
index 0d5ddd633a..b2dc7446ea 100644
--- a/app/Services/ScheduledJobDeliveryService.php
+++ b/app/Services/ScheduledJobDeliveryService.php
@@ -627,8 +627,8 @@ class ScheduledJobDeliveryService
             return false;
         }
 
-        // An open previous occurrence usually means the previous run is still running. Backup jobs
-        // then skip this one without running it (see withoutOverlapping()).
+        // An open previous occurrence usually means the previous run is still running. Backup and
+        // task jobs then skip this one without running it (see withoutOverlapping()).
         $previousOpen = ScheduledJobDelivery::query()
             ->where('schedule_key', $occurrence->schedule_key)
             ->where('scheduled_for', '<', $occurrence->scheduled_for)
diff --git a/app/Services/SentinelTrafficClient.php b/app/Services/SentinelTrafficClient.php
index 73c2b70556..1c5c28e2d8 100644
--- a/app/Services/SentinelTrafficClient.php
+++ b/app/Services/SentinelTrafficClient.php
@@ -48,7 +48,7 @@ class SentinelTrafficClient
 
     /** @var array<int, string> */
     private const ALLOWED_DIMENSIONS = [
-        'status', 'method', 'country', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot', 'agent', 'ip', 'useragent',
+        'status', 'method', 'country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot', 'agent', 'ip', 'useragent',
     ];
 
     public function __construct(protected Server $server) {}
diff --git a/app/Services/ServerCanvas.php b/app/Services/ServerCanvas.php
index 061bd2ad2c..d822920a54 100644
--- a/app/Services/ServerCanvas.php
+++ b/app/Services/ServerCanvas.php
@@ -2,18 +2,22 @@
 
 namespace App\Services;
 
+use App\Enums\ApplicationDeploymentStatus;
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\ResourceLink;
 use App\Models\Server;
 use App\Models\Service;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
 
 /**
  * Builds the server canvas: one zone per server with every resource of the team on it,
- * in the same shape as the environment canvas. Cards keep the positions and links saved on their environment canvas;
- * admins change them through the environment canvas endpoints of each card.
+ * in the same shape as the environment canvas. Cards and project / environment groups use the positions saved on
+ * their environment canvas (node.saved); admins move whole groups and single cards here, which saves the group's cards on that environment
+ * canvas, and change links through the environment canvas endpoints of each card.
  */
 class ServerCanvas
 {
@@ -21,15 +25,17 @@ class ServerCanvas
 
     /**
      * @param  Collection<int, Server>  $servers  servers of the team to show
-     * @return array{title: string, title_link: ?string, can_edit: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array<string, array{x: int, y: int}>}
+     * @return array{title: string, title_link: ?string, can_edit: bool, can_move: false, can_move_groups: bool, layout: 'server', zones: array<int, array<string, mixed>>, nodes: array<int, array<string, mixed>>, links: array<int, array<string, mixed>>, positions: array{}}
      */
     public function payload(int $teamId, Collection $servers, ?Server $single, bool $canReadSensitive, bool $canEdit = false): array
     {
         $environments = Environment::query()
             ->whereHas('project', fn ($query) => $query->where('team_id', $teamId))
-            ->get(['id', 'canvas_positions']);
-        $resources = $this->loadResources($environments->pluck('id'));
-        $links = ResourceLink::query()->whereIn('environment_id', $environments->pluck('id'))->orderBy('id')->get();
+            ->with('project')
+            ->get(['id', 'uuid', 'name', 'project_id']);
+        $environmentIds = $environments->pluck('id');
+        $resources = $this->loadResources($environmentIds);
+        $links = ResourceLink::query()->whereIn('environment_id', $environmentIds)->orderBy('id')->get();
         $graph = $this->canvas->graph($resources, $links, $canReadSensitive);
 
         $serverUuids = $servers->pluck('uuid')->all();
@@ -52,6 +58,13 @@ class ServerCanvas
             })
             ->values();
         $shown = $nodes->pluck('id')->flip();
+        // Every-server canvases: environments without resources show as placeholder cards next to the other environments of their project.
+        $used = $resources->pluck('environment_id')->flip();
+        $zoneOf = $this->canvas->projectZones($nodes, $serverUuids[0] ?? EnvironmentCanvas::EMPTY_ZONE);
+        $empty = $single ? collect() : $environments
+            ->reject(fn (Environment $environment) => $used->has($environment->id))
+            ->map(fn (Environment $environment) => $this->canvas->emptyNode($environment->project, $environment, $zoneOf($environment->project), $environment->project->name.' / '.$environment->name, $canEdit))
+            ->values();
 
         return [
             'title' => $single ? $single->name : 'Servers',
@@ -59,16 +72,123 @@ class ServerCanvas
             // Unmanaged containers need a command on the server, so the canvas loads them after it renders.
             'containers_endpoint' => $single ? '/servers/'.$single->uuid.'/canvas/containers' : null,
             'can_edit' => $canEdit,
+            'can_move' => false,
+            // Admins drag the project / environment group boxes; the canvas saves the moved cards on their environment canvas.
+            'can_move_groups' => $canEdit,
             // Tells the canvas to group cards by project / environment and place linked cards side by side.
             'layout' => 'server',
-            'zones' => $servers->map(fn (Server $server) => $this->canvas->zone($server, $canReadSensitive))->values()->all(),
-            'nodes' => $nodes->all(),
+            'zones' => $servers->map(fn (Server $server) => [...$this->canvas->zone($server, $canReadSensitive), 'details' => $this->details($server)])
+                ->when($empty->contains('zone', EnvironmentCanvas::EMPTY_ZONE), fn (Collection $zones) => $zones->push($this->canvas->emptyZone()))
+                ->values()->all(),
+            'nodes' => $nodes->concat($empty)->all(),
             'links' => collect($graph['links'])->filter(fn (array $link) => $shown->has($link['source']) && $shown->has($link['target']))->values()->all(),
-            // Card positions saved on the environment canvases; the canvas keeps their arrangement per project / environment group.
-            'positions' => $this->canvas->filterPositions(
-                $environments->reduce(fn (array $positions, Environment $environment) => [...$positions, ...($environment->canvas_positions ?? [])], []),
-                $nodes->pluck('id')->all(),
-            ),
+            'positions' => [],
+        ];
+    }
+
+    /**
+     * Host facts and proxy of a server for its zone header. Live usage loads after the canvas renders
+     * (usage_endpoint), because it runs a command on the server.
+     *
+     * @return array{os: ?string, arch: ?string, cpus: ?int, memory_bytes: ?int, uptime_since: ?string, proxy: ?array{type: string, status: ?string}, usage_endpoint: ?string}
+     */
+    public function details(Server $server): array
+    {
+        $meta = $server->server_metadata ?? [];
+        $proxyType = $server->proxyType();
+        $live = $server->settings?->is_reachable && $server->settings?->is_metrics_enabled;
+
+        return [
+            'os' => $meta['os'] ?? null,
+            'arch' => $meta['arch'] ?? null,
+            'cpus' => isset($meta['cpus']) ? (int) $meta['cpus'] : null,
+            'memory_bytes' => isset($meta['memory_bytes']) ? (int) $meta['memory_bytes'] : null,
+            'uptime_since' => $meta['uptime_since'] ?? null,
+            'proxy' => $proxyType && $proxyType !== 'NONE' ? ['type' => $proxyType, 'status' => data_get($server->proxy, 'status')] : null,
+            'usage_endpoint' => $live ? '/servers/'.$server->uuid.'/canvas/usage' : null,
+        ];
+    }
+
+    /**
+     * Latest CPU, memory and root disk usage in percent from Sentinel, cached briefly so that
+     * canvas refreshes do not run a command on the server each time. Null values: no data.
+     *
+     * @return array{cpu: ?float, memory: ?float, disk: ?float}
+     */
+    public function usage(Server $server): array
+    {
+        return Cache::remember("server-canvas-usage:{$server->id}", 30, function () use ($server) {
+            $latest = function (callable $read): ?float {
+                try {
+                    $value = data_get(last($read() ?: [null]), 1);
+
+                    return is_numeric($value) ? round((float) $value, 1) : null;
+                } catch (\Throwable) {
+                    return null;
+                }
+            };
+
+            return [
+                'cpu' => $latest(fn () => $server->getCpuMetrics(1)),
+                'memory' => $latest(fn () => $server->getMemoryMetrics(1)),
+                'disk' => $latest(fn () => $server->getDiskMetrics(1)),
+            ];
+        });
+    }
+
+    /**
+     * Dashboard canvas: the server canvas of the team, on each application card its
+     * running or queued deployment (the oldest first, as the deployment queue runs them),
+     * and the list of active and recent deployments.
+     *
+     * @param  Collection<int, Server>  $servers  servers of the team to show
+     * @return array<string, mixed>
+     */
+    public function dashboardPayload(int $teamId, Collection $servers, bool $canReadSensitive, bool $canEdit = false): array
+    {
+        $payload = $this->payload($teamId, $servers, null, $canReadSensitive, $canEdit);
+
+        $columns = ['deployment_uuid', 'application_id', 'application_name', 'status', 'deployment_url', 'pull_request_id', 'server_name', 'created_at', 'finished_at'];
+        $query = fn () => ApplicationDeploymentQueue::query()->whereIn('server_id', $servers->pluck('id'));
+        $activeStatuses = [ApplicationDeploymentStatus::IN_PROGRESS->value, ApplicationDeploymentStatus::QUEUED->value];
+        $active = $query()->whereIn('status', $activeStatuses)->orderBy('status')->orderBy('id')->get($columns);
+        $recent = $query()->whereNotIn('status', $activeStatuses)->orderByDesc('id')->limit(8)->get($columns);
+        $applicationUuids = Application::query()
+            ->whereIn('id', $active->concat($recent)->pluck('application_id')->unique())
+            ->pluck('uuid', 'id');
+        $uuidOf = fn (ApplicationDeploymentQueue $deployment) => $applicationUuids->get((int) $deployment->application_id);
+        $summary = fn (ApplicationDeploymentQueue $deployment) => [
+            'status' => $deployment->status,
+            'link' => $deployment->deployment_url,
+            'pull_request_id' => (int) $deployment->pull_request_id ?: null,
+        ];
+        $byUuid = $active
+            ->filter($uuidOf)
+            ->unique('application_id')
+            ->mapWithKeys(fn (ApplicationDeploymentQueue $deployment) => [$uuidOf($deployment) => $summary($deployment)]);
+
+        return [
+            ...$payload,
+            'title' => 'Dashboard',
+            'title_link' => route('dashboard'),
+            'nodes' => collect($payload['nodes'])
+                ->map(fn (array $node) => $node['type'] === 'application' && $byUuid->has($node['id'])
+                    ? [...$node, 'deployment' => $byUuid->get($node['id'])]
+                    : $node)
+                ->all(),
+            // The deployment panel: running and queued deployments first, then the latest finished ones.
+            'deployments' => $active->concat($recent)
+                ->map(fn (ApplicationDeploymentQueue $deployment) => [
+                    'id' => $deployment->deployment_uuid,
+                    'application' => $uuidOf($deployment),
+                    'name' => $deployment->application_name,
+                    'server' => $deployment->server_name,
+                    'created_at' => $deployment->created_at?->toIso8601String(),
+                    'finished_at' => $deployment->finished_at?->toIso8601String(),
+                    ...$summary($deployment),
+                ])
+                ->values()
+                ->all(),
         ];
     }
 
@@ -101,7 +221,6 @@ class ServerCanvas
                     'urls' => [],
                     'subtitle' => (string) data_get($container, 'Image'),
                     'children' => [],
-                    'volumes' => [],
                     'link' => route('server.resources', ['server_uuid' => $server->uuid]),
                     'context' => 'Unmanaged containers',
                     'context_link' => route('server.resources', ['server_uuid' => $server->uuid]),
@@ -120,21 +239,21 @@ class ServerCanvas
     public function loadResources(Collection $environmentIds): Collection
     {
         $applications = Application::query()->whereIn('environment_id', $environmentIds)
-            ->with(['environment.project', 'destination.server.settings', 'additional_servers.settings', 'persistentStorages'])
+            ->with(['environment.project', 'destination.server.settings', 'additional_servers.settings'])
             ->get();
         $services = Service::query()->whereIn('environment_id', $environmentIds)
             ->with([
                 'environment.project',
                 'server.settings',
                 'destination.server.settings',
-                'applications.persistentStorages',
-                'databases.persistentStorages',
+                'applications',
+                'databases',
             ])
             ->get();
         $databases = collect(EnvironmentCanvas::DATABASE_RELATIONS)
             ->flatMap(fn (string $relation) => (new Environment)->{$relation}()->getRelated()->newQuery()
                 ->whereIn('environment_id', $environmentIds)
-                ->with(['environment.project', 'destination.server.settings', 'persistentStorages'])
+                ->with(['environment.project', 'destination.server.settings'])
                 ->get());
 
         return collect()->concat($applications)->concat($services)->concat($databases)->keyBy('uuid');
diff --git a/app/Services/ServerTransfer/ServerTransferBundle.php b/app/Services/ServerTransfer/ServerTransferBundle.php
index 692842d085..aa5936d14e 100644
--- a/app/Services/ServerTransfer/ServerTransferBundle.php
+++ b/app/Services/ServerTransfer/ServerTransferBundle.php
@@ -2,16 +2,12 @@
 
 namespace App\Services\ServerTransfer;
 
-use Illuminate\Support\Facades\Crypt;
 use Illuminate\Validation\ValidationException;
-use RuntimeException;
 
 class ServerTransferBundle
 {
     public const SCHEMA_VERSION = 1;
 
-    public const MAILBOX_DIR = '/data/coolify/exports';
-
     /**
      * @param  array<string, mixed>  $payload
      */
@@ -19,6 +15,7 @@ class ServerTransferBundle
     {
         return array_merge([
             'schema_version' => self::SCHEMA_VERSION,
+            'coolify_version' => config('constants.coolify.version'),
             'exported_at' => now()->toIso8601String(),
             'export_id' => new_public_id(),
         ], $payload);
@@ -39,6 +36,14 @@ class ServerTransferBundle
             $errors[] = 'Unsupported schema_version '.$bundle['schema_version'].'. Expected '.self::SCHEMA_VERSION.'.';
         }
 
+        $bundleVersion = data_get($bundle, 'coolify_version');
+        $instanceVersion = (string) config('constants.coolify.version');
+        if (! is_string($bundleVersion) || $bundleVersion === '') {
+            $errors[] = 'Missing coolify_version. Export the server again with Coolify '.$instanceVersion.' or newer.';
+        } elseif (version_compare($bundleVersion, $instanceVersion, '>')) {
+            $errors[] = "This bundle was exported from Coolify {$bundleVersion}. Upgrade this instance (Coolify {$instanceVersion}) to {$bundleVersion} or newer before you import it.";
+        }
+
         if (! isset($bundle['export_id']) || ! is_string($bundle['export_id']) || $bundle['export_id'] === '') {
             $errors[] = 'Missing export_id.';
         }
@@ -90,90 +95,4 @@ class ServerTransferBundle
             ]);
         }
     }
-
-    /**
-     * Encrypt an entire bundle for mailbox/API transport with a user passphrase.
-     *
-     * @param  array<string, mixed>  $bundle
-     * @return array{encrypted: true, schema_version: int, payload: string}
-     */
-    public static function encryptWithPassphrase(array $bundle, string $passphrase): array
-    {
-        if ($passphrase === '') {
-            throw new RuntimeException('Passphrase must not be empty.');
-        }
-
-        $json = json_encode($bundle, JSON_THROW_ON_ERROR);
-        $key = hash('sha256', $passphrase, true);
-        $iv = random_bytes(16);
-        $cipher = openssl_encrypt($json, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
-        if ($cipher === false) {
-            throw new RuntimeException('Failed to encrypt transfer bundle.');
-        }
-
-        $mac = hash_hmac('sha256', $iv.$cipher, $key);
-
-        return [
-            'encrypted' => true,
-            'schema_version' => self::SCHEMA_VERSION,
-            'payload' => base64_encode($iv.$mac.$cipher),
-        ];
-    }
-
-    /**
-     * @param  array<string, mixed>  $encrypted
-     * @return array<string, mixed>
-     */
-    public static function decryptWithPassphrase(array $encrypted, string $passphrase): array
-    {
-        if (! data_get($encrypted, 'encrypted')) {
-            throw new RuntimeException('Bundle is not encrypted.');
-        }
-
-        $raw = base64_decode((string) data_get($encrypted, 'payload'), true);
-        if ($raw === false || strlen($raw) < 48) {
-            throw new RuntimeException('Invalid encrypted payload.');
-        }
-
-        $key = hash('sha256', $passphrase, true);
-        $iv = substr($raw, 0, 16);
-        $mac = substr($raw, 16, 64);
-        $cipher = substr($raw, 80);
-        $expectedMac = hash_hmac('sha256', $iv.$cipher, $key);
-        if (! hash_equals($expectedMac, $mac)) {
-            throw new RuntimeException('Invalid passphrase or corrupted bundle.');
-        }
-
-        $json = openssl_decrypt($cipher, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
-        if ($json === false) {
-            throw new RuntimeException('Failed to decrypt transfer bundle.');
-        }
-
-        /** @var array<string, mixed> $bundle */
-        $bundle = json_decode($json, true, 512, JSON_THROW_ON_ERROR);
-
-        return $bundle;
-    }
-
-    /**
-     * Optionally re-seal secrets with Laravel's app key for intermediate storage.
-     * Prefer passphrase encryption for cross-instance transfers.
-     *
-     * @param  array<string, mixed>  $bundle
-     */
-    public static function sealWithAppKey(array $bundle): string
-    {
-        return Crypt::encryptString(json_encode($bundle, JSON_THROW_ON_ERROR));
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    public static function unsealWithAppKey(string $sealed): array
-    {
-        /** @var array<string, mixed> $bundle */
-        $bundle = json_decode(Crypt::decryptString($sealed), true, 512, JSON_THROW_ON_ERROR);
-
-        return $bundle;
-    }
 }
diff --git a/app/Services/ServerTransfer/ServerTransferClaimer.php b/app/Services/ServerTransfer/ServerTransferClaimer.php
index 593bdd91ed..f479b1fb49 100644
--- a/app/Services/ServerTransfer/ServerTransferClaimer.php
+++ b/app/Services/ServerTransfer/ServerTransferClaimer.php
@@ -2,7 +2,16 @@
 
 namespace App\Services\ServerTransfer;
 
+use App\Enums\GithubRunnerStatus;
+use App\Jobs\DeleteResourceJob;
+use App\Models\GithubRunnerExecution;
+use App\Models\ManagedDnsRecord;
 use App\Models\Server;
+use App\Notifications\Internal\GeneralNotification;
+use App\Services\Dns\CloudflareDnsProvider;
+use App\Services\Dns\ManagedDnsRecordCleanup;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 use RuntimeException;
@@ -10,11 +19,20 @@ use Throwable;
 
 class ServerTransferClaimer
 {
+    /**
+     * The managed host records which claim owns it. Both instances can reach the host, so it is the one
+     * place where an instance can learn that another instance took the server over.
+     */
+    public const OWNER_MARKER_DIR = '/data/coolify/transfer';
+
+    public const OWNER_MARKER_PATH = self::OWNER_MARKER_DIR.'/owner.json';
+
     /**
      * Take management of a server on this Coolify instance and bind Sentinel to it.
      *
      * Database ownership (metadata + Sentinel settings) is committed in one transaction so a
-     * mid-flight failure rolls back.
+     * mid-flight failure rolls back. The owner marker on the host is written last in that
+     * transaction: if the host cannot be reached, the claim fails and nothing changes here.
      *
      * @return array{
      *     server_uuid: string,
@@ -36,6 +54,7 @@ class ServerTransferClaimer
         $exportId = data_get($server->server_metadata, 'transfer.export_id');
 
         $claim = [
+            'claim_id' => new_public_id(),
             'instance_url' => $instanceUrl,
             'server_uuid' => $server->uuid,
             'team_id' => $server->team_id,
@@ -47,13 +66,16 @@ class ServerTransferClaimer
         return DB::transaction(function () use ($server, $claim, $instanceUrl) {
             $server = Server::query()->with('settings')->lockForUpdate()->findOrFail($server->id);
 
+            // A disabled server refuses SSH, so the owner marker could not be written.
+            if ($server->team->serverOverflow()) {
+                throw new RuntimeException('Your team is over its server limit. Upgrade your subscription or remove a server first.');
+            }
+
             if ($server->settings) {
                 $server->settings->sentinel_custom_url = $instanceUrl;
                 $server->settings->ensureValidSentinelToken();
                 $server->settings->is_sentinel_enabled = true;
-                if (! $server->team->serverOverflow()) {
-                    $server->settings->force_disabled = false;
-                }
+                $server->settings->force_disabled = false;
                 $server->settings->save();
             }
 
@@ -66,6 +88,8 @@ class ServerTransferClaimer
             $server->server_metadata = $metadata;
             $server->save();
 
+            $this->writeOwnerMarker($server, $claim);
+
             return [
                 'server_uuid' => $server->uuid,
                 'claim' => $claim,
@@ -81,18 +105,15 @@ class ServerTransferClaimer
      * All database writes run in one transaction so partial disable state cannot stick on failure.
      * Local SSH key cache cleanup runs after commit (filesystem; not transactional).
      *
-     * $managementDisabled marks a manual "Disable management" action: the server is not moved yet,
-     * only ready to be transferred to another instance.
-     *
      * @return array{server_uuid: string, message: string}
      */
-    public function markTransferred(Server $server, ?string $exportId = null, ?string $targetInstanceUrl = null, bool $managementDisabled = false): array
+    public function markTransferred(Server $server, ?string $exportId = null, ?string $targetInstanceUrl = null): array
     {
         if ($server->id === 0) {
             throw new RuntimeException('Cannot transfer the Coolify host itself.');
         }
 
-        $result = DB::transaction(function () use ($server, $exportId, $targetInstanceUrl, $managementDisabled) {
+        $result = DB::transaction(function () use ($server, $exportId, $targetInstanceUrl) {
             $server = Server::query()->with('settings')->lockForUpdate()->findOrFail($server->id);
 
             if ($server->settings) {
@@ -107,8 +128,15 @@ class ServerTransferClaimer
                 'export_id' => $exportId ?? data_get($metadata, 'transfer.export_id'),
                 'target_instance_url' => $targetInstanceUrl,
                 'transferred_at' => now()->toIso8601String(),
-                'management_disabled' => $managementDisabled,
             ]);
+            unset($metadata['transfer']['finish'], $metadata['transfer']['taken_back_at']);
+            $server->server_metadata = $metadata;
+            $server->save();
+
+            $this->releaseGithubRunners($server);
+
+            // Kept for a take back. Not owned, so this instance never changes or deletes them at the provider.
+            $metadata['transfer']['parked_dns_record_ids'] = app(ManagedDnsRecordCleanup::class)->parkResources($this->dnsResources($server));
             $server->server_metadata = $metadata;
             $server->save();
 
@@ -123,6 +151,144 @@ class ServerTransferClaimer
         return $result;
     }
 
+    /**
+     * The runners on the server belong to the target now. Queued runners are cancelled. Started runners are marked
+     * finished without removing them at GitHub: their jobs keep running, and deleting the archive here later must
+     * not deregister them. A disabled config also stops new runners for this server from GitHub webhooks.
+     */
+    /**
+     * The other instance serves the hostnames of a transferred server. Without this, deleting the archive here,
+     * or the orphaned-record cleanup after it, would delete live DNS records at the provider.
+     */
+    public function forgetDnsRecords(Server $server): void
+    {
+        app(ManagedDnsRecordCleanup::class)->forgetResources($this->dnsResources($server));
+    }
+
+    /**
+     * Delete the archive of a transferred server with its resources, records only: another instance manages the
+     * host, so nothing runs on the server and nothing changes at a provider.
+     */
+    public function deleteArchive(Server $server): void
+    {
+        if (! $server->isTransferredAway()) {
+            throw new RuntimeException('Only the archive of a transferred server can be deleted this way.');
+        }
+
+        $this->forgetDnsRecords($server);
+        foreach ($server->definedResources() as $resource) {
+            (new DeleteResourceJob($resource, deleteFromCoolifyOnly: true))->handle();
+        }
+        $server->forceDelete();
+    }
+
+    /**
+     * @return Collection<int, Model>
+     */
+    private function dnsResources(Server $server): Collection
+    {
+        return $server->applications()
+            ->concat($server->services()->with('applications')->get()->flatMap->applications);
+    }
+
+    /**
+     * After a take back: own the parked DNS records again where Cloudflare confirms them, then start the steps that
+     * finish the take back (webhooks, runners, records that this instance could not take back). Provider calls run
+     * here, after the claim committed.
+     *
+     * @return list<array<string, mixed>> the steps
+     */
+    public function restoreAfterTakeBack(Server $server): array
+    {
+        $dns = app(CloudflareDnsProvider::class);
+        $parkedIds = (array) data_get($server->server_metadata, 'transfer.parked_dns_record_ids', []);
+        foreach (ManagedDnsRecord::query()->whereIn('id', $parkedIds)->get() as $record) {
+            if ($dns->reclaimRecord($record)) {
+                $record->update(['owned' => true]);
+            }
+        }
+
+        DB::transaction(function () use ($server) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($server->id);
+            $metadata = $locked->server_metadata ?? [];
+            unset($metadata['transfer']['parked_dns_record_ids']);
+            $metadata['transfer']['taken_back_at'] = now()->toIso8601String();
+            $locked->server_metadata = $metadata;
+            $locked->save();
+            $server->server_metadata = $metadata;
+        });
+
+        return app(TransferFinishChecklist::class)->start($server);
+    }
+
+    private function releaseGithubRunners(Server $server): void
+    {
+        $server->githubRunnerConfig()->update(['is_enabled' => false]);
+
+        $message = 'The server was transferred to another Coolify instance. This instance stopped managing its runners.';
+        GithubRunnerExecution::query()
+            ->where('server_id', $server->id)
+            ->whereIn('status', GithubRunnerStatus::active())
+            ->get()
+            ->each(fn (GithubRunnerExecution $execution) => $execution->finish(GithubRunnerStatus::Cancelled, $message));
+    }
+
+    /**
+     * Stop managing a claimed server when its owner marker names a claim of another instance.
+     * A server that was added here without a claim ignores the marker: a marker can be left over on a
+     * host that an old instance deleted, and the next claim overwrites it.
+     *
+     * @return bool true when this instance released the server
+     */
+    public function releaseIfClaimedElsewhere(Server $server, ?string $markerJson): bool
+    {
+        if ($server->id === 0 || data_get($server->server_metadata, 'transfer.status') !== 'claimed') {
+            return false;
+        }
+
+        $marker = json_decode((string) $markerJson, true);
+        $markerClaimId = data_get($marker, 'claim_id');
+        if (! is_string($markerClaimId) || $markerClaimId === '') {
+            return false;
+        }
+
+        if ($markerClaimId === data_get($server->server_metadata, 'transfer.claim.claim_id')) {
+            return false;
+        }
+
+        $owner = data_get($marker, 'instance_url');
+        $owner = is_string($owner) && $owner !== '' ? $owner : null;
+
+        $this->markTransferred($server, targetInstanceUrl: $owner);
+
+        Log::warning('Server is claimed by another Coolify instance; management stopped here', [
+            'server_uuid' => $server->uuid,
+            'owner_instance_url' => $owner,
+        ]);
+        $server->team?->notify(new GeneralNotification(
+            "Server '{$server->name}' is now managed by ".($owner ?? 'another Coolify instance').'. This instance stopped managing it.',
+            success: false,
+        ));
+
+        return true;
+    }
+
+    /**
+     * @param  array<string, mixed>  $claim
+     */
+    private function writeOwnerMarker(Server $server, array $claim): void
+    {
+        $marker = json_encode([
+            'claim_id' => $claim['claim_id'],
+            'instance_url' => $claim['instance_url'],
+            'server_uuid' => $claim['server_uuid'],
+            'claimed_at' => $claim['claimed_at'],
+        ], JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES);
+
+        instant_remote_process(['mkdir -p '.self::OWNER_MARKER_DIR], $server);
+        instant_remote_write_file($server, self::OWNER_MARKER_PATH, $marker);
+    }
+
     /**
      * Best-effort local SSH mux/key cleanup after transfer (filesystem; not part of DB rollback).
      * forceDisableServer is idempotent for force_disabled and also clears cached SSH key material.
@@ -139,51 +305,4 @@ class ServerTransferClaimer
             ]);
         }
     }
-
-    /**
-     * Write export bundle to the managed host mailbox (air-gapped transfer).
-     *
-     * @param  array<string, mixed>  $bundle
-     * @return array{path: string, written: bool}
-     */
-    public function writeMailbox(Server $server, array $bundle, ?string $passphrase = null): array
-    {
-        ServerTransferBundle::assertValid($bundle);
-
-        $exportId = (string) data_get($bundle, 'export_id', new_public_id());
-        $filename = "server-transfer-{$exportId}.coolify.json";
-        $path = ServerTransferBundle::MAILBOX_DIR.'/'.$filename;
-
-        $payload = $passphrase
-            ? ServerTransferBundle::encryptWithPassphrase($bundle, $passphrase)
-            : $bundle;
-
-        $json = json_encode($payload, JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES);
-        $b64 = base64_encode($json);
-
-        $written = false;
-        try {
-            instant_remote_process([
-                'mkdir -p '.escapeshellarg(ServerTransferBundle::MAILBOX_DIR),
-                // tee, not a redirect: the SSH user's shell opens a redirect, and a non-root user cannot enter /data/coolify.
-                'echo '.escapeshellarg($b64).' | base64 -d | tee '.escapeshellarg($path).' > /dev/null',
-                'chmod 600 '.escapeshellarg($path),
-                'chown 9999:root '.escapeshellarg($path).' || true',
-            ], $server, true);
-            $written = true;
-        } catch (Throwable $e) {
-            Log::warning('Failed to write server transfer mailbox', [
-                'server_uuid' => $server->uuid,
-                'error' => $e->getMessage(),
-            ]);
-            if (! app()->runningUnitTests()) {
-                throw $e;
-            }
-        }
-
-        return [
-            'path' => $path,
-            'written' => $written,
-        ];
-    }
 }
diff --git a/app/Services/ServerTransfer/ServerTransferCoverage.php b/app/Services/ServerTransfer/ServerTransferCoverage.php
new file mode 100644
index 0000000000..168ffae7c0
--- /dev/null
+++ b/app/Services/ServerTransfer/ServerTransferCoverage.php
@@ -0,0 +1,347 @@
+<?php
+
+namespace App\Services\ServerTransfer;
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\ApplicationSetting;
+use App\Models\AuditEvent;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\DatabaseBackupS3Replica;
+use App\Models\DiscordNotificationSettings;
+use App\Models\DnsProviderZone;
+use App\Models\DockerCleanupExecution;
+use App\Models\EmailNotificationSettings;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
+use App\Models\ManagedDnsRecordReference;
+use App\Models\NotificationThrottle;
+use App\Models\OauthIdentity;
+use App\Models\OauthSetting;
+use App\Models\PersonalAccessToken;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\ProjectSetting;
+use App\Models\PushoverNotificationSettings;
+use App\Models\ResourceLink;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledJobDelivery;
+use App\Models\ScheduledJobState;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledTaskExecution;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\ServerSetting;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\SlackNotificationSettings;
+use App\Models\SslCertificate;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\StandaloneSqlite;
+use App\Models\Subscription;
+use App\Models\SwarmDocker;
+use App\Models\Tag;
+use App\Models\Team;
+use App\Models\TeamInvitation;
+use App\Models\TelegramNotificationSettings;
+use App\Models\User;
+use App\Models\UserChangelogRead;
+use App\Models\VolumeBackupS3Replica;
+use App\Models\WebhookNotificationSettings;
+
+/**
+ * The decision for every model and every column: does a server transfer move it to the other instance?
+ *
+ * ServerTransferCoverageTest exports a server that has a record of every transferred model and fails when
+ * a model is not listed here, or when a column of a transferred table is neither in the bundle nor in
+ * NOT_EXPORTED_COLUMNS. So a new model or column gets a transfer decision when it is added.
+ */
+final class ServerTransferCoverage
+{
+    /**
+     * Transferred models and where their records are in the bundle. `*` matches every list item. When a
+     * record has an `attributes` object, its keys also count. `model` limits a path to one database class.
+     *
+     * @var array<class-string, list<string>>
+     */
+    public const TRANSFERRED = [
+        Server::class => ['server'],
+        ServerSetting::class => ['server.settings'],
+        PrivateKey::class => ['private_key', 'private_keys.*'],
+        StandaloneDocker::class => ['destinations.*'],
+        SwarmDocker::class => ['destinations.*'],
+        CloudProviderToken::class => ['cloud_provider_tokens.*'],
+        IntegrationToken::class => ['integration_tokens.*'],
+        DnsProviderZone::class => ['dns_zones.*'],
+        ManagedDnsRecord::class => ['managed_dns_records.*'],
+        ManagedDnsRecordReference::class => ['managed_dns_records.*.references.*'],
+        SecretManagerLink::class => [
+            'projects.*.environments.*.applications.*.secret_manager_link',
+            'projects.*.environments.*.databases.*.secret_manager_link',
+            'projects.*.environments.*.services.*.secret_manager_link',
+        ],
+        SslCertificate::class => ['ssl_certificates.*'],
+        GithubApp::class => ['github_apps.*'],
+        GithubRunnerConfig::class => ['github_runner_config'],
+        GitlabApp::class => ['gitlab_apps.*'],
+        S3Storage::class => ['s3_storages.*'],
+        Project::class => ['projects.*'],
+        Environment::class => ['projects.*.environments.*'],
+        ResourceLink::class => ['projects.*.environments.*.resource_links.*'],
+        SharedEnvironmentVariable::class => [
+            'shared_environment_variables.server.*',
+            'shared_environment_variables.team.*',
+            'projects.*.shared_environment_variables.*',
+            'projects.*.environments.*.shared_environment_variables.*',
+        ],
+        Application::class => ['projects.*.environments.*.applications.*'],
+        ApplicationSetting::class => ['projects.*.environments.*.applications.*.settings'],
+        ApplicationPreview::class => ['projects.*.environments.*.applications.*.previews.*'],
+        EnvironmentVariable::class => [
+            'projects.*.environments.*.applications.*.environment_variables.*',
+            'projects.*.environments.*.applications.*.environment_variables_preview.*',
+            'projects.*.environments.*.databases.*.environment_variables.*',
+            'projects.*.environments.*.services.*.environment_variables.*',
+        ],
+        LocalPersistentVolume::class => [
+            'projects.*.environments.*.applications.*.persistent_storages.*',
+            'projects.*.environments.*.databases.*.persistent_storages.*',
+        ],
+        LocalFileVolume::class => [
+            'projects.*.environments.*.applications.*.file_storages.*',
+            'projects.*.environments.*.databases.*.file_storages.*',
+        ],
+        ScheduledTask::class => [
+            'projects.*.environments.*.applications.*.scheduled_tasks.*',
+            'projects.*.environments.*.services.*.scheduled_tasks.*',
+        ],
+        Tag::class => [
+            'projects.*.environments.*.applications.*.tags.*',
+            'projects.*.environments.*.databases.*.tags.*',
+            'projects.*.environments.*.services.*.tags.*',
+        ],
+        ScheduledDatabaseBackup::class => ['projects.*.environments.*.databases.*.scheduled_backups.*'],
+        ScheduledVolumeBackup::class => ['volume_backups.*'],
+        Service::class => ['projects.*.environments.*.services.*'],
+        ServiceApplication::class => ['projects.*.environments.*.services.*.applications.*'],
+        ServiceDatabase::class => ['projects.*.environments.*.services.*.databases.*'],
+        StandalonePostgresql::class => ['projects.*.environments.*.databases.*'],
+        StandaloneMysql::class => ['projects.*.environments.*.databases.*'],
+        StandaloneMariadb::class => ['projects.*.environments.*.databases.*'],
+        StandaloneMongodb::class => ['projects.*.environments.*.databases.*'],
+        StandaloneRedis::class => ['projects.*.environments.*.databases.*'],
+        StandaloneKeydb::class => ['projects.*.environments.*.databases.*'],
+        StandaloneDragonfly::class => ['projects.*.environments.*.databases.*'],
+        StandaloneClickhouse::class => ['projects.*.environments.*.databases.*'],
+        StandaloneSqlite::class => ['projects.*.environments.*.databases.*'],
+    ];
+
+    private const LINKED = 'The bundle links the record by UUID or by its place in the bundle; the target sets its own ID.';
+
+    private const TEAM = 'The target imports into one of its own teams.';
+
+    private const RUNTIME = 'Runtime state: the target sets it again when it manages the server.';
+
+    /**
+     * Columns of transferred models that are not in the bundle under their own name, with the reason.
+     * Columns in ALWAYS_NOT_EXPORTED are left out of every model.
+     *
+     * @var array<class-string, array<string, string>>
+     */
+    public const NOT_EXPORTED_COLUMNS = [
+        Server::class => [
+            'team_id' => self::TEAM, 'private_key_id' => self::LINKED, 'cloud_provider_token_id' => self::LINKED,
+            'unreachable_count' => self::RUNTIME, 'high_disk_usage_notification_sent' => self::RUNTIME,
+            'log_drain_notification_sent' => self::RUNTIME, 'validation_logs' => self::RUNTIME,
+            'sentinel_updated_at' => self::RUNTIME, 'sentinel_waiting_since' => self::RUNTIME, 'ip_previous' => self::RUNTIME,
+            'is_validating' => self::RUNTIME, 'detected_traefik_version' => self::RUNTIME, 'traefik_outdated_info' => self::RUNTIME,
+            'hetzner_server_status' => self::RUNTIME, 'vultr_instance_status' => self::RUNTIME,
+            'digitalocean_droplet_status' => self::RUNTIME, 'hostinger_virtual_machine_status' => self::RUNTIME,
+            'server_metadata' => 'Facts about the host and the transfer state of the source; the target collects its own.',
+        ],
+        ServerSetting::class => [
+            'server_id' => self::LINKED, 'is_reachable' => self::RUNTIME, 'is_usable' => self::RUNTIME, 'force_disabled' => self::RUNTIME,
+            'is_sentinel_enabled' => 'The target enables Sentinel when it claims the server.',
+            'is_sentinel_debug_enabled' => 'The target enables Sentinel when it claims the server.',
+            'sentinel_token' => 'The target makes a new Sentinel token when it claims the server.',
+            'sentinel_custom_url' => 'The target sets its own URL when it claims the server.',
+            'cloudflare_tunnel_integration_token_id' => 'Exported as cloudflare_tunnel_integration_token_uuid. '.self::LINKED,
+        ],
+        PrivateKey::class => ['team_id' => self::TEAM],
+        StandaloneDocker::class => ['server_id' => self::LINKED],
+        SwarmDocker::class => ['server_id' => self::LINKED],
+        CloudProviderToken::class => ['team_id' => self::TEAM],
+        IntegrationToken::class => ['team_id' => self::TEAM],
+        DnsProviderZone::class => ['integration_token_id' => self::LINKED],
+        ManagedDnsRecord::class => ['team_id' => self::TEAM, 'integration_token_id' => self::LINKED, 'dns_provider_zone_id' => self::LINKED],
+        ManagedDnsRecordReference::class => [
+            'managed_dns_record_id' => 'The reference is part of its record in the bundle.',
+            'resource_type' => self::LINKED, 'resource_id' => self::LINKED,
+        ],
+        SecretManagerLink::class => ['resourceable_type' => self::LINKED, 'resourceable_id' => self::LINKED, 'integration_token_id' => self::LINKED],
+        SslCertificate::class => ['server_id' => self::LINKED, 'resource_type' => self::LINKED, 'resource_id' => self::LINKED],
+        GithubApp::class => ['team_id' => self::TEAM, 'private_key_id' => self::LINKED],
+        GithubRunnerConfig::class => [
+            'server_id' => self::LINKED,
+            'github_app_id' => 'Exported as github_app_uuid. '.self::LINKED,
+        ],
+        GitlabApp::class => ['team_id' => self::TEAM, 'private_key_id' => self::LINKED],
+        S3Storage::class => ['team_id' => self::TEAM, 'unusable_email_sent' => self::RUNTIME],
+        Project::class => [
+            'team_id' => self::TEAM,
+            'icon_path' => 'The icon file is exported as `icon` (base64 content). The target stores it in its own icon storage and sets the path.',
+            'icon_storage_type' => 'The target uses its own default icon storage. See icon_path.',
+            'icon_s3_storage_id' => 'The target uses its own default icon storage. See icon_path.',
+        ],
+        Environment::class => ['project_id' => self::LINKED],
+        ResourceLink::class => [
+            'environment_id' => 'The link is part of its environment in the bundle.',
+            'source_type' => 'Exported as source.kind and source.uuid. '.self::LINKED,
+            'source_id' => 'Exported as source.kind and source.uuid. '.self::LINKED,
+            'target_type' => 'Exported as target.kind and target.uuid. '.self::LINKED,
+            'target_id' => 'Exported as target.kind and target.uuid. '.self::LINKED,
+            'created_by' => 'A user of the source instance; the target leaves it empty.',
+        ],
+        SharedEnvironmentVariable::class => [
+            'type' => 'The scope follows from the place of the variable in the bundle.',
+            'team_id' => self::TEAM, 'project_id' => self::LINKED, 'environment_id' => self::LINKED, 'server_id' => self::LINKED,
+            'version' => 'The Coolify version that created the variable; the target sets its own.',
+        ],
+        Application::class => [
+            'environment_id' => self::LINKED, 'destination_type' => self::LINKED, 'destination_id' => self::LINKED,
+            'source_type' => self::LINKED, 'source_id' => self::LINKED, 'private_key_id' => self::LINKED,
+        ],
+        ApplicationSetting::class => ['application_id' => self::LINKED],
+        ApplicationPreview::class => [
+            'application_id' => self::LINKED, 'last_online_at' => self::RUNTIME, 'domain_dns_statuses' => self::RUNTIME,
+            'restart_count' => self::RUNTIME, 'restart_limit_reached' => self::RUNTIME, 'last_restart_at' => self::RUNTIME,
+            'last_restart_type' => self::RUNTIME,
+        ],
+        EnvironmentVariable::class => ['resourceable_type' => self::LINKED, 'resourceable_id' => self::LINKED],
+        LocalPersistentVolume::class => [
+            'resource_type' => self::LINKED, 'resource_id' => self::LINKED, 'standalone_sqlite_id' => self::LINKED,
+            'container_id' => 'Not used: only listed in $fillable.',
+        ],
+        LocalFileVolume::class => ['resource_type' => self::LINKED, 'resource_id' => self::LINKED],
+        ScheduledTask::class => ['team_id' => self::TEAM, 'application_id' => self::LINKED, 'service_id' => self::LINKED],
+        Tag::class => ['team_id' => self::TEAM],
+        ScheduledDatabaseBackup::class => [
+            'team_id' => self::TEAM, 'database_type' => self::LINKED, 'database_id' => self::LINKED, 's3_storage_id' => self::LINKED,
+            'last_execution_at' => 'Execution history of the source.',
+        ],
+        ScheduledVolumeBackup::class => [
+            'team_id' => self::TEAM, 'backupable_type' => self::LINKED, 'backupable_id' => self::LINKED, 's3_storage_id' => self::LINKED,
+        ],
+        Service::class => [
+            'environment_id' => self::LINKED, 'server_id' => self::LINKED, 'destination_type' => self::LINKED, 'destination_id' => self::LINKED,
+        ],
+        ServiceApplication::class => ['service_id' => self::LINKED],
+        ServiceDatabase::class => ['service_id' => self::LINKED],
+        StandalonePostgresql::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneMysql::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneMariadb::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneMongodb::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneRedis::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneKeydb::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneDragonfly::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneClickhouse::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+        ],
+        StandaloneSqlite::class => [
+            'destination_type' => self::LINKED, 'destination_id' => self::LINKED, 'environment_id' => self::LINKED,
+            'config_hash' => 'Calculated again when the target starts the database.',
+            'is_public' => 'Not used: SQLite has no public port.',
+        ],
+    ];
+
+    /**
+     * Created on the target instance for every record.
+     *
+     * @var list<string>
+     */
+    public const ALWAYS_NOT_EXPORTED = ['id', 'created_at', 'updated_at', 'deleted_at'];
+
+    /**
+     * Models that a transfer does not move, with the reason.
+     *
+     * @var array<class-string, string>
+     */
+    public const NOT_TRANSFERRED = [
+        Team::class => 'Instance-wide: the target imports into one of its own teams.',
+        User::class => 'Instance-wide: users are not moved with a server.',
+        TeamInvitation::class => 'Team data, not server data.',
+        Subscription::class => 'Billing of the source instance.',
+        InstanceSettings::class => 'Settings of the source instance.',
+        OauthSetting::class => 'Settings of the source instance.',
+        OauthIdentity::class => 'User login data of the source instance.',
+        PersonalAccessToken::class => 'API tokens of the source instance.',
+        UserChangelogRead::class => 'User data of the source instance.',
+        AuditEvent::class => 'Audit log of the source instance.',
+        NotificationThrottle::class => 'Runtime state of the source instance.',
+        ScheduledJobState::class => 'Scheduler state of the source instance.',
+        ScheduledJobDelivery::class => 'Scheduler state of the source instance.',
+        EmailNotificationSettings::class => 'Team notification settings, not server data.',
+        DiscordNotificationSettings::class => 'Team notification settings, not server data.',
+        SlackNotificationSettings::class => 'Team notification settings, not server data.',
+        TelegramNotificationSettings::class => 'Team notification settings, not server data.',
+        PushoverNotificationSettings::class => 'Team notification settings, not server data.',
+        WebhookNotificationSettings::class => 'Team notification settings, not server data.',
+        CloudInitScript::class => 'Team server-creation templates, not server data.',
+        ProjectSetting::class => 'Created with the project on the target; it has no settings of its own yet.',
+        ApplicationDeploymentQueue::class => 'Deployment history.',
+        ScheduledTaskExecution::class => 'Execution history.',
+        ScheduledDatabaseBackupExecution::class => 'Execution history.',
+        ScheduledVolumeBackupExecution::class => 'Execution history.',
+        DatabaseBackupS3Replica::class => 'Backup history.',
+        VolumeBackupS3Replica::class => 'Backup history.',
+        DockerCleanupExecution::class => 'Execution history.',
+        GithubRunnerExecution::class => 'Execution history. The source stops tracking the runners of the server when it is transferred.',
+    ];
+}
diff --git a/app/Services/ServerTransfer/ServerTransferExporter.php b/app/Services/ServerTransfer/ServerTransferExporter.php
index 176aa8d30d..66895c4209 100644
--- a/app/Services/ServerTransfer/ServerTransferExporter.php
+++ b/app/Services/ServerTransfer/ServerTransferExporter.php
@@ -5,12 +5,17 @@ namespace App\Services\ServerTransfer;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\CloudProviderToken;
+use App\Models\DnsProviderZone;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
 use App\Models\GitlabApp;
+use App\Models\IntegrationToken;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
+use App\Models\ManagedDnsRecordReference;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\S3Storage;
@@ -23,14 +28,22 @@ use App\Models\SharedEnvironmentVariable;
 use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
 use App\Models\Tag;
+use App\Services\ProjectIconStorageService;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
 use RuntimeException;
+use Throwable;
 
 class ServerTransferExporter
 {
+    /**
+     * Larger project icons are not put in the bundle. Icons that Coolify stores are small JPEG files.
+     */
+    public const MAX_PROJECT_ICON_BYTES = 2 * 1024 * 1024;
+
     /**
      * Settings that are instance-bound or runtime health state and must not transfer.
      *
@@ -48,6 +61,8 @@ class ServerTransferExporter
         'sentinel_custom_url',
         'is_sentinel_enabled',
         'is_sentinel_debug_enabled',
+        // Exported as cloudflare_tunnel_integration_token_uuid.
+        'cloudflare_tunnel_integration_token_id',
     ];
 
     /**
@@ -86,6 +101,9 @@ class ServerTransferExporter
         if (! $privateKey instanceof PrivateKey) {
             throw new RuntimeException('Server has no private key to export.');
         }
+        if ((int) $privateKey->team_id !== (int) $server->team_id) {
+            throw new RuntimeException('The server private key does not belong to the server team. Select a private key of this team first.');
+        }
 
         if (! $includeSensitive) {
             throw new RuntimeException('Server transfer export requires sensitive data access (read:sensitive).');
@@ -100,15 +118,36 @@ class ServerTransferExporter
         $this->assertNoAdditionalDestinations($server, $applications);
 
         $projectIds = $this->collectProjectIds($applications, $databases, $services);
-        $projects = Project::query()->whereIn('id', $projectIds)->orderBy('name')->get();
+        $projects = Project::query()->where('team_id', $server->team_id)->whereIn('id', $projectIds)->orderBy('name')->get();
+        if ($projects->count() !== collect($projectIds)->unique()->count()) {
+            throw new RuntimeException('Some resources on this server belong to a project of another team. Move them to a project of this team first.');
+        }
 
         $destinationUuidByKey = $this->destinationUuidMap($server);
-        $dependencies = $this->collectDependencies($server, $applications, $databases, $services);
+        $runnerConfig = $server->githubRunnerConfig()->with('githubApp')->first();
+        $dependencies = $this->collectDependencies($server, $applications, $databases, $services, $runnerConfig);
 
         $sourceInstanceUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
-        $warnings = $this->buildWarnings($applications, $dependencies, $sourceInstanceUrl);
-        if ($secretManagerWarning = $this->secretManagerWarning($applications->concat($databases)->concat($services))) {
-            $warnings[] = $secretManagerWarning;
+        $managedDns = $this->collectManagedDnsRecords($server, $applications, $services);
+        $integrationTokens = $this->collectIntegrationTokens($server, $applications->concat($databases)->concat($services), $managedDns['records']);
+
+        $serverSharedEnvVars = $this->exportSharedEnvVars(
+            SharedEnvironmentVariable::query()
+                ->where('type', 'server')
+                ->where('server_id', $server->id)
+                ->get()
+        );
+        $projectWarnings = [];
+        $leftOutLinks = 0;
+        $projectPayloads = $projects->map(function (Project $project) use ($destinationUuidByKey, $applications, $databases, $services, &$projectWarnings, &$leftOutLinks) {
+            return $this->exportProject($project, $destinationUuidByKey, $applications, $databases, $services, $projectWarnings, $leftOutLinks);
+        })->values()->all();
+
+        $warnings = $this->buildWarnings($applications, $dependencies);
+        $warnings = array_merge($warnings, $managedDns['warnings'], $projectWarnings);
+        if ($leftOutLinks > 0) {
+            $warnings[] = $leftOutLinks.' '.Str::plural('link', $leftOutLinks).' between resources on the environment canvas '
+                .($leftOutLinks === 1 ? 'is' : 'are').' not transferred, because one of the linked resources stays on this instance.';
         }
 
         $payload = ServerTransferBundle::wrap([
@@ -117,6 +156,8 @@ class ServerTransferExporter
                 'name' => config('app.name'),
             ],
             'warnings' => $warnings,
+            // Manual steps after the transfer. The source replaces {target_url} with the URL of the target.
+            'post_transfer_checklist' => $this->postTransferChecklist($dependencies, $runnerConfig, $applications),
             // Back-compat: single server key
             'private_key' => $this->exportPrivateKey($privateKey),
             // All keys needed by server, apps, and git sources
@@ -125,21 +166,19 @@ class ServerTransferExporter
             'gitlab_apps' => $dependencies['gitlab_apps']->map(fn (GitlabApp $app) => $this->exportGitlabApp($app))->values()->all(),
             's3_storages' => $dependencies['s3_storages']->map(fn (S3Storage $storage) => $this->exportS3Storage($storage))->values()->all(),
             'cloud_provider_tokens' => $dependencies['cloud_provider_tokens']->map(fn (CloudProviderToken $token) => $this->exportCloudProviderToken($token))->values()->all(),
+            'integration_tokens' => $integrationTokens->map(fn (IntegrationToken $token) => $this->exportIntegrationToken($token))->values()->all(),
+            'dns_zones' => $managedDns['records']->pluck('zone')->unique('id')->map(fn (DnsProviderZone $zone) => $this->exportDnsZone($zone))->values()->all(),
+            'managed_dns_records' => $managedDns['records']->map(fn (ManagedDnsRecord $record) => $this->exportManagedDnsRecord($record, $managedDns['resource_keys']))->values()->all(),
             'ssl_certificates' => $this->exportSslCertificates($server),
             'volume_backups' => $this->exportVolumeBackups($applications, $databases, $services),
             'server' => $this->exportServer($server),
             'destinations' => $this->exportDestinations($server),
+            'github_runner_config' => $runnerConfig ? $this->exportGithubRunnerConfig($runnerConfig) : null,
             'shared_environment_variables' => [
-                'server' => $this->exportSharedEnvVars(
-                    SharedEnvironmentVariable::query()
-                        ->where('type', 'server')
-                        ->where('server_id', $server->id)
-                        ->get()
-                ),
+                'server' => $serverSharedEnvVars,
+                'team' => $this->exportReferencedTeamSharedEnvVars($server->team_id, $serverSharedEnvVars, $projectPayloads),
             ],
-            'projects' => $projects->map(function (Project $project) use ($server, $destinationUuidByKey, $applications, $databases, $services) {
-                return $this->exportProject($project, $server, $destinationUuidByKey, $applications, $databases, $services);
-            })->values()->all(),
+            'projects' => $projectPayloads,
         ]);
 
         return $payload;
@@ -157,47 +196,46 @@ class ServerTransferExporter
      *     cloud_provider_tokens: Collection<int, CloudProviderToken>
      * }
      */
-    private function collectDependencies(Server $server, Collection $applications, Collection $databases, Collection $services): array
+    private function collectDependencies(Server $server, Collection $applications, Collection $databases, Collection $services, ?GithubRunnerConfig $runnerConfig): array
     {
+        $teamId = $server->team_id;
         $privateKeys = collect([$server->privateKey])->filter();
         $githubApps = collect();
         $gitlabApps = collect();
         $s3Ids = collect();
 
+        // System-wide GitHub Apps are instance-owned; do not copy them. The application source and the runner
+        // config still record the App uuid, so the import can re-link to a system-wide App of the target.
+        $collectGithubApp = function (int|string $id) use ($teamId, $githubApps, $privateKeys): void {
+            $gh = $this->findGitSource(GithubApp::class, $id, $teamId);
+            if ($gh && ! $gh->is_system_wide) {
+                $githubApps->push($gh);
+                if ($gh->private_key_id) {
+                    $privateKeys->push($this->findTeamRecord(PrivateKey::class, $gh->private_key_id, $teamId, 'private key'));
+                }
+            }
+        };
+
+        if ($runnerConfig) {
+            $collectGithubApp($runnerConfig->github_app_id);
+        }
+
         foreach ($applications as $application) {
             if ($application->private_key_id) {
-                $key = PrivateKey::find($application->private_key_id);
-                if ($key) {
-                    $privateKeys->push($key);
-                }
+                $privateKeys->push($this->findTeamRecord(PrivateKey::class, $application->private_key_id, $teamId, 'private key'));
             }
 
             if ($application->source_type === GithubApp::class && $application->source_id !== null) {
-                $gh = GithubApp::find($application->source_id);
-                // System-wide GitHub Apps are instance-owned; do not copy them.
-                // Application export still records source.uuid so import can re-link
-                // to an existing system-wide app on the target instance.
-                if ($gh && ! $gh->is_system_wide) {
-                    $githubApps->push($gh);
-                    if ($gh->private_key_id) {
-                        $pk = PrivateKey::find($gh->private_key_id);
-                        if ($pk) {
-                            $privateKeys->push($pk);
-                        }
-                    }
-                }
+                $collectGithubApp($application->source_id);
             }
 
             if ($application->source_type === GitlabApp::class && $application->source_id !== null) {
-                $gl = GitlabApp::find($application->source_id);
+                $gl = $this->findGitSource(GitlabApp::class, $application->source_id, $teamId);
                 // System-wide GitLab Apps are instance-owned; re-link by UUID on import.
                 if ($gl && ! $gl->is_system_wide) {
                     $gitlabApps->push($gl);
                     if ($gl->private_key_id) {
-                        $pk = PrivateKey::find($gl->private_key_id);
-                        if ($pk) {
-                            $privateKeys->push($pk);
-                        }
+                        $privateKeys->push($this->findTeamRecord(PrivateKey::class, $gl->private_key_id, $teamId, 'private key'));
                     }
                 }
             }
@@ -264,37 +302,75 @@ class ServerTransferExporter
 
         $cloudTokens = collect();
         if ($server->cloud_provider_token_id) {
-            $token = CloudProviderToken::find($server->cloud_provider_token_id);
-            if ($token) {
-                $cloudTokens->push($token);
-            }
+            $cloudTokens->push($this->findTeamRecord(CloudProviderToken::class, $server->cloud_provider_token_id, $teamId, 'cloud provider token'));
         }
 
         return [
             'private_keys' => $privateKeys->unique('id')->values(),
             'github_apps' => $githubApps->unique('id')->values(),
             'gitlab_apps' => $gitlabApps->unique('id')->values(),
-            's3_storages' => S3Storage::query()->whereIn('id', $s3Ids->unique()->filter()->all())->get(),
+            's3_storages' => $this->findTeamS3Storages($s3Ids->unique()->filter()->values()->all(), $teamId),
             'cloud_provider_tokens' => $cloudTokens->unique('id')->values(),
         ];
     }
 
+    /**
+     * Load a credential record that must belong to the server team. A record of another team is
+     * never exported, so a broken reference stops the export instead of leaking its secrets.
+     *
+     * @template T of Model
+     *
+     * @param  class-string<T>  $modelClass
+     * @return T
+     */
+    private function findTeamRecord(string $modelClass, int|string $id, int $teamId, string $label): Model
+    {
+        $record = $modelClass::query()->where('team_id', $teamId)->find($id);
+        if (! $record) {
+            throw new RuntimeException("A {$label} used on this server does not belong to the server team. Select a {$label} of this team first.");
+        }
+
+        return $record;
+    }
+
+    /**
+     * System-wide git sources are returned as they are (they are only linked by UUID, never exported).
+     *
+     * @param  class-string<GithubApp|GitlabApp>  $modelClass
+     */
+    private function findGitSource(string $modelClass, int|string $id, int $teamId): GithubApp|GitlabApp|null
+    {
+        $source = $modelClass::find($id);
+        if ($source && ! $source->is_system_wide && (int) $source->team_id !== $teamId) {
+            throw new RuntimeException('A git source used on this server does not belong to the server team. Select a git source of this team first.');
+        }
+
+        return $source;
+    }
+
+    /**
+     * @param  list<int|string>  $ids
+     * @return Collection<int, S3Storage>
+     */
+    private function findTeamS3Storages(array $ids, int $teamId): Collection
+    {
+        $storages = S3Storage::query()->where('team_id', $teamId)->whereIn('id', $ids)->get();
+        if ($storages->count() !== count($ids)) {
+            throw new RuntimeException('An S3 storage used by a backup on this server does not belong to the server team. Select an S3 storage of this team first.');
+        }
+
+        return $storages;
+    }
+
     /**
      * @param  Collection<int, Application>  $applications
      * @param  array<string, mixed>  $dependencies
      * @return list<string>
      */
-    private function buildWarnings(Collection $applications, array $dependencies, string $sourceInstanceUrl): array
+    private function buildWarnings(Collection $applications, array $dependencies): array
     {
         $warnings = [];
 
-        if ($dependencies['github_apps']->isNotEmpty()) {
-            $warnings[] = 'Team-scoped GitHub Apps were exported with credentials (system-wide apps are skipped). After import, update each GitHub App webhook URL (and setup/callback URL if used) to this Coolify instance so push/PR automations keep working. '
-                ."Webhook path: {$sourceInstanceUrl}/webhooks/source/github/events "
-                .'(replace host with the target instance FQDN after import). '
-                .'Also reinstall/refresh the GitHub App installation if installation_id is invalid on the new host.';
-        }
-
         $usesSystemWideGithub = $applications->contains(function (Application $app) {
             if ($app->source_type !== GithubApp::class || $app->source_id === null) {
                 return false;
@@ -319,11 +395,6 @@ class ServerTransferExporter
             $warnings[] = 'Some applications use a system-wide GitLab App, which is not exported. On import, Coolify will re-link to a matching system-wide GitLab App on the target instance (by UUID) if one exists.';
         }
 
-        if ($dependencies['gitlab_apps']->isNotEmpty()) {
-            $warnings[] = 'Team-scoped GitLab Apps/OAuth sources were exported (system-wide apps are skipped). After import, update GitLab webhook URLs to the target Coolify instance '
-                ."({$sourceInstanceUrl}/webhooks/source/gitlab/events — use the new FQDN) and refresh OAuth tokens if needed.";
-        }
-
         if ($dependencies['s3_storages']->isNotEmpty()) {
             $warnings[] = 'S3 storage credentials were exported. Confirm endpoint access from the target instance and that bucket policies still apply.';
         }
@@ -332,24 +403,180 @@ class ServerTransferExporter
     }
 
     /**
-     * Secret manager links point to integration tokens of this instance, which are not exported.
+     * Managed DNS records that only exported resources use. A record that a resource staying on this instance
+     * also uses is not exported: this instance keeps managing it.
      *
-     * @param  Collection<int, Model>  $resources
+     * @param  Collection<int, Application>  $applications
+     * @param  Collection<int, Service>  $services
+     * @return array{
+     *     records: Collection<int, ManagedDnsRecord>,
+     *     resource_keys: array<string, array{kind: string, uuid: string}|null>,
+     *     warnings: list<string>
+     * }
      */
-    private function secretManagerWarning(Collection $resources): ?string
+    private function collectManagedDnsRecords(Server $server, Collection $applications, Collection $services): array
     {
-        $linkedNames = $resources
-            ->filter(fn (Model $resource) => method_exists($resource, 'secretManagerLink') && $resource->secretManagerLink()->exists())
-            ->pluck('name')
-            ->unique()
-            ->values();
-
-        if ($linkedNames->isEmpty()) {
-            return null;
+        // Keyed by "morph type:id". Soft-deleted previews are covered, but their references are not exported.
+        $resourceKeys = [];
+        foreach ($applications as $application) {
+            $resourceKeys[$application->getMorphClass().':'.$application->id] = ['kind' => 'application', 'uuid' => $application->uuid];
+            foreach (ApplicationPreview::withTrashed()->where('application_id', $application->id)->get() as $preview) {
+                $resourceKeys[$preview->getMorphClass().':'.$preview->id] = $preview->trashed() ? null : ['kind' => 'preview', 'uuid' => $preview->uuid];
+            }
+        }
+        foreach ($services as $service) {
+            foreach ($service->applications as $serviceApplication) {
+                $resourceKeys[$serviceApplication->getMorphClass().':'.$serviceApplication->id] = ['kind' => 'service_application', 'uuid' => $serviceApplication->uuid];
+            }
+        }
+        if ($resourceKeys === []) {
+            return ['records' => collect(), 'resource_keys' => [], 'warnings' => []];
         }
 
-        return 'Some resources load environment variables from a secret manager: '.$linkedNames->implode(', ').'. '
-            .'Secret manager tokens and links are not exported. After import, add the integration token on the target instance and link the secret manager source again, or deployments of these resources fail.';
+        $records = ManagedDnsRecord::query()
+            ->whereHas('references', function ($query) use ($resourceKeys) {
+                $query->where(function ($query) use ($resourceKeys) {
+                    foreach (array_keys($resourceKeys) as $key) {
+                        [$type, $id] = explode(':', $key, 2);
+                        $query->orWhere(fn ($query) => $query->where('resource_type', $type)->where('resource_id', $id));
+                    }
+                });
+            })
+            ->with(['references', 'zone.integrationToken', 'integrationToken'])
+            ->orderBy('name')
+            ->get();
+
+        $exported = collect();
+        $warnings = [];
+        foreach ($records as $record) {
+            $teamId = (int) $server->team_id;
+            if ((int) $record->team_id !== $teamId
+                || (int) $record->integrationToken?->team_id !== $teamId
+                || (int) $record->zone?->integrationToken?->team_id !== $teamId) {
+                $warnings[] = "DNS record {$record->name} is not transferred, because its DNS provider token belongs to another team. The target instance does not manage it.";
+
+                continue;
+            }
+            $sharedWithOtherResources = $record->references
+                ->contains(fn (ManagedDnsRecordReference $reference) => ! array_key_exists($reference->resource_type.':'.$reference->resource_id, $resourceKeys));
+            if ($sharedWithOtherResources) {
+                $warnings[] = "DNS record {$record->name} stays managed by this instance, because a resource that is not transferred also uses it. The target instance does not update or delete it.";
+
+                continue;
+            }
+            $hasLiveReference = $record->references
+                ->contains(fn (ManagedDnsRecordReference $reference) => $resourceKeys[$reference->resource_type.':'.$reference->resource_id] !== null);
+            if ($hasLiveReference) {
+                $exported->push($record);
+            }
+        }
+
+        return ['records' => $exported, 'resource_keys' => $resourceKeys, 'warnings' => $warnings];
+    }
+
+    /**
+     * Integration tokens that the exported resources need: secret manager links, managed DNS records, and the
+     * Cloudflare tunnel of the server.
+     *
+     * @param  Collection<int, Model>  $resources
+     * @param  Collection<int, ManagedDnsRecord>  $dnsRecords
+     * @return Collection<int, IntegrationToken>
+     */
+    private function collectIntegrationTokens(Server $server, Collection $resources, Collection $dnsRecords): Collection
+    {
+        $tokenIds = collect([$server->settings?->cloudflare_tunnel_integration_token_id]);
+        foreach ($resources as $resource) {
+            if (method_exists($resource, 'secretManagerLink')) {
+                $tokenIds->push($resource->secretManagerLink()->value('integration_token_id'));
+            }
+        }
+        foreach ($dnsRecords as $record) {
+            $tokenIds->push($record->integration_token_id, $record->zone->integration_token_id);
+        }
+
+        return $tokenIds->filter()->unique()->values()
+            ->map(fn (int|string $id) => $this->findTeamRecord(IntegrationToken::class, $id, (int) $server->team_id, 'integration token'));
+    }
+
+    /**
+     * Manual steps after the transfer. {target_url} stands for the URL of the target instance.
+     *
+     * @param  array{github_apps: Collection<int, GithubApp>, gitlab_apps: Collection<int, GitlabApp>}  $dependencies
+     * @param  Collection<int, Application>  $applications
+     * @return list<string>
+     */
+    private function postTransferChecklist(array $dependencies, ?GithubRunnerConfig $runnerConfig, Collection $applications): array
+    {
+        $steps = [];
+        // A manual webhook is set in the repository itself, so its URL still points to this instance. Every
+        // application has the secrets, so list the git applications that do not deploy through a private App.
+        $manualWebhookApps = $applications
+            ->filter(fn (Application $application) => $application->build_pack !== 'dockerimage' && filled($application->git_repository)
+                && (! $application->source || data_get($application->source, 'is_public') === true))
+            ->pluck('name');
+        if ($manualWebhookApps->isNotEmpty()) {
+            $steps[] = 'If a repository of these applications has a manual webhook to Coolify, change its URL to the target: '
+                .$manualWebhookApps->implode(', ').'. Use {target_url}/webhooks/source/github/events/manual, '
+                .'{target_url}/webhooks/source/gitlab/events/manual, {target_url}/webhooks/source/bitbucket/events/manual, '
+                .'or {target_url}/webhooks/source/gitea/events/manual.';
+        }
+        foreach ($dependencies['github_apps'] as $githubApp) {
+            $steps[] = "On GitHub, open the settings of GitHub App {$githubApp->name}. Set the Webhook URL to {target_url}/webhooks/source/github/events, "
+                .'the Setup URL to {target_url}/webhooks/source/github/install, and the Callback URL to {target_url}/login/github/app.';
+        }
+        foreach ($dependencies['gitlab_apps'] as $gitlabApp) {
+            $steps[] = "In GitLab, open Settings > Webhooks of every project that uses GitLab App {$gitlabApp->name}, and set the webhook URL to {target_url}/webhooks/source/gitlab/events.";
+        }
+        if ($runnerConfig) {
+            $steps[] = 'After the GitHub App sends webhooks to {target_url}, open this server there, check the runner requirements, and enable GitHub runners. '
+                .'Enabling them stops runners that another Coolify instance started on this server.';
+        }
+
+        return $steps;
+    }
+
+    /**
+     * Team variables are exported only when an exported variable references them as {{team.KEY}}.
+     *
+     * @param  list<array<string, mixed>>  $serverVariables
+     * @param  list<array<string, mixed>>  $projects
+     * @return list<array<string, mixed>>
+     */
+    private function exportReferencedTeamSharedEnvVars(int $teamId, array $serverVariables, array $projects): array
+    {
+        $values = collect($serverVariables)->pluck('value');
+        foreach ([
+            '*.shared_environment_variables.*.value',
+            '*.environments.*.shared_environment_variables.*.value',
+            '*.environments.*.applications.*.environment_variables.*.value',
+            '*.environments.*.applications.*.environment_variables_preview.*.value',
+            '*.environments.*.databases.*.environment_variables.*.value',
+            '*.environments.*.services.*.environment_variables.*.value',
+            '*.environments.*.services.*.applications.*.environment_variables.*.value',
+        ] as $path) {
+            $values = $values->merge(data_get($projects, $path, []));
+        }
+
+        $keys = $values
+            ->filter(fn ($value) => is_string($value))
+            ->flatMap(function (string $value) {
+                preg_match_all('/{{\s*team\.(.+?)\s*}}/', $value, $matches);
+
+                return $matches[1];
+            })
+            ->unique()
+            ->values();
+        if ($keys->isEmpty()) {
+            return [];
+        }
+
+        return $this->exportSharedEnvVars(
+            SharedEnvironmentVariable::query()
+                ->where('type', 'team')
+                ->where('team_id', $teamId)
+                ->whereIn('key', $keys)
+                ->get()
+        );
     }
 
     /**
@@ -359,7 +586,7 @@ class ServerTransferExporter
     {
         try {
             $material = $key->private_key;
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             throw new RuntimeException(
                 "Cannot decrypt private key \"{$key->name}\" (uuid={$key->uuid}). "
                 .'This instance APP_KEY does not match the key that encrypted the data '
@@ -395,6 +622,9 @@ class ServerTransferExporter
                 // Read through cast so encrypted fields are plaintext for re-encryption on import.
                 $settingsPayload[$key] = $settings->{$key};
             }
+            $settingsPayload['cloudflare_tunnel_integration_token_uuid'] = $settings->cloudflare_tunnel_integration_token_id
+                ? IntegrationToken::query()->whereKey($settings->cloudflare_tunnel_integration_token_id)->value('uuid')
+                : null;
         }
 
         return [
@@ -402,12 +632,18 @@ class ServerTransferExporter
             'name' => $server->name,
             'description' => $server->description,
             'ip' => (string) $server->ip,
-            'port' => (int) $server->port,
+            'port' => $server->port ?: 22,
             'user' => (string) $server->user,
             'proxy' => $server->proxy?->toArray() ?? [],
             'server_role' => $server->settings->effectiveServerRole()->value,
             'is_build_server' => $server->isBuildServer(),
             'cloud_provider_token_uuid' => $server->cloudProviderToken?->uuid,
+            'hetzner_server_id' => $server->hetzner_server_id,
+            'vultr_instance_id' => $server->vultr_instance_id,
+            'digitalocean_droplet_id' => $server->digitalocean_droplet_id,
+            'hostinger_virtual_machine_id' => $server->hostinger_virtual_machine_id,
+            'proxy_error_page' => $server->proxy_error_page,
+            'swarm_cluster' => $server->swarm_cluster,
             'settings' => $settingsPayload,
         ];
     }
@@ -443,29 +679,37 @@ class ServerTransferExporter
      * @param  Collection<int, Model>  $databases
      * @param  Collection<int, Service>  $services
      * @param  array<string, string>  $destinationUuidByKey
+     * @param  list<string>  $warnings
      * @return array<string, mixed>
      */
     private function exportProject(
         Project $project,
-        Server $server,
         array $destinationUuidByKey,
         Collection $applications,
         Collection $databases,
         Collection $services,
+        array &$warnings,
+        int &$leftOutLinks,
     ): array {
-        $environments = $project->environments()->orderBy('name')->get();
+        // Only environments with a resource of this server. The other environments stay on this instance.
+        $environmentIds = $applications->pluck('environment_id')
+            ->merge($databases->pluck('environment_id'))
+            ->merge($services->pluck('environment_id'))
+            ->unique();
+        $environments = $project->environments()->whereIn('id', $environmentIds)->orderBy('name')->get();
 
         return [
             'uuid' => $project->uuid,
             'name' => $project->name,
             'description' => $project->description,
+            'icon' => $this->exportProjectIcon($project, $warnings),
             'shared_environment_variables' => $this->exportSharedEnvVars(
                 SharedEnvironmentVariable::query()
                     ->where('type', 'project')
                     ->where('project_id', $project->id)
                     ->get()
             ),
-            'environments' => $environments->map(function (Environment $environment) use ($destinationUuidByKey, $applications, $databases, $services) {
+            'environments' => $environments->map(function (Environment $environment) use ($destinationUuidByKey, $applications, $databases, $services, &$leftOutLinks) {
                 $envApps = $applications->where('environment_id', $environment->id)->values();
                 $envDbs = $databases->where('environment_id', $environment->id)->values();
                 $envServices = $services->where('environment_id', $environment->id)->values();
@@ -474,6 +718,10 @@ class ServerTransferExporter
                     'uuid' => $environment->uuid,
                     'name' => $environment->name,
                     'description' => $environment->description,
+                    // Keyed by resource uuid; only the positions of exported resources.
+                    'canvas_positions' => collect($environment->canvas_positions ?? [])
+                        ->only($envApps->pluck('uuid')->merge($envDbs->pluck('uuid'))->merge($envServices->pluck('uuid')))
+                        ->all(),
                     'shared_environment_variables' => $this->exportSharedEnvVars(
                         SharedEnvironmentVariable::query()
                             ->where('type', 'environment')
@@ -483,11 +731,105 @@ class ServerTransferExporter
                     'applications' => $envApps->map(fn (Application $app) => $this->exportApplication($app, $destinationUuidByKey))->all(),
                     'databases' => $envDbs->map(fn (Model $db) => $this->exportDatabase($db, $destinationUuidByKey))->all(),
                     'services' => $envServices->map(fn (Service $service) => $this->exportService($service, $destinationUuidByKey))->all(),
+                    'resource_links' => $this->exportResourceLinks($environment, $envApps, $envDbs, $envServices, $leftOutLinks),
                 ];
             })->values()->all(),
         ];
     }
 
+    /**
+     * The icon file travels in the bundle; the target stores it in its own icon storage.
+     *
+     * @param  list<string>  $warnings
+     * @return array{content_base64: string, extension: string, mime: string}|null
+     */
+    private function exportProjectIcon(Project $project, array &$warnings): ?array
+    {
+        if (blank($project->icon_path)) {
+            return null;
+        }
+
+        try {
+            $contents = app(ProjectIconStorageService::class)->projectContents($project);
+        } catch (Throwable) {
+            $contents = null;
+        }
+        if (! is_string($contents) || $contents === '') {
+            $warnings[] = "The icon of project {$project->name} cannot be read, so it is not transferred. Upload it again on the target instance.";
+
+            return null;
+        }
+        if (strlen($contents) > self::MAX_PROJECT_ICON_BYTES) {
+            $warnings[] = "The icon of project {$project->name} is larger than 2 MB, so it is not transferred. Upload it again on the target instance.";
+
+            return null;
+        }
+
+        return [
+            'content_base64' => base64_encode($contents),
+            'extension' => strtolower(pathinfo($project->icon_path, PATHINFO_EXTENSION)) ?: 'jpg',
+            'mime' => (new \finfo(FILEINFO_MIME_TYPE))->buffer($contents) ?: 'application/octet-stream',
+        ];
+    }
+
+    /**
+     * Canvas links whose two resources are both exported. Each end is the kind and uuid of a resource of the
+     * environment, the same keys that the import uses for its resource maps.
+     *
+     * @param  Collection<int, Application>  $applications
+     * @param  Collection<int, Model>  $databases
+     * @param  Collection<int, Service>  $services
+     * @return list<array{uuid: string, label: string|null, source: array{kind: string, uuid: string}, target: array{kind: string, uuid: string}}>
+     */
+    private function exportResourceLinks(Environment $environment, Collection $applications, Collection $databases, Collection $services, int &$leftOut): array
+    {
+        $ends = collect();
+        foreach (['application' => $applications, 'database' => $databases, 'service' => $services] as $kind => $resources) {
+            foreach ($resources as $resource) {
+                $ends->put($resource->getMorphClass().':'.$resource->getKey(), ['kind' => $kind, 'uuid' => $resource->uuid]);
+            }
+        }
+
+        $out = [];
+        foreach ($environment->resourceLinks()->orderBy('id')->get() as $link) {
+            $source = $ends->get($link->source_type.':'.$link->source_id);
+            $target = $ends->get($link->target_type.':'.$link->target_id);
+            if (! $source || ! $target) {
+                $leftOut++;
+
+                continue;
+            }
+            $out[] = ['uuid' => $link->uuid, 'label' => $link->label, 'source' => $source, 'target' => $target];
+        }
+
+        return $out;
+    }
+
+    /**
+     * The target imports the config disabled. Enabling it there removes the runner containers of the source.
+     *
+     * @return array<string, mixed>
+     */
+    private function exportGithubRunnerConfig(GithubRunnerConfig $config): array
+    {
+        return [
+            'uuid' => $config->uuid,
+            'github_app_uuid' => $config->githubApp?->uuid,
+            'labels' => $config->labels ?? [],
+            'is_enabled' => (bool) $config->is_enabled,
+            'is_dedicated' => (bool) $config->is_dedicated,
+            'allow_pull_requests' => (bool) $config->allow_pull_requests,
+            'max_runners' => $config->max_runners,
+            'docker_mode' => $config->docker_mode?->value,
+            'runner_image' => $config->runner_image,
+            'cpu_limit' => $config->cpu_limit,
+            'memory_limit' => $config->memory_limit,
+            'capacity_wait_timeout' => $config->capacity_wait_timeout,
+            'idle_timeout' => $config->idle_timeout,
+            'job_timeout' => $config->job_timeout,
+        ];
+    }
+
     /**
      * @param  array<string, string>  $destinationUuidByKey
      * @return array<string, mixed>
@@ -530,6 +872,8 @@ class ServerTransferExporter
             'docker_compose',
             'docker_compose_raw',
             'custom_labels',
+            'is_maintenance_enabled',
+            'maintenance_page',
         ] as $hidden) {
             if (in_array($hidden, $columns, true)) {
                 $attrs[$hidden] = $application->{$hidden};
@@ -550,9 +894,9 @@ class ServerTransferExporter
 
         $source = null;
         if ($application->source_type === GithubApp::class && $application->source) {
-            $source = ['type' => 'github_app', 'uuid' => $application->source->uuid];
+            $source = ['type' => 'github_app', 'uuid' => $application->source->uuid, 'system_wide' => (bool) $application->source->is_system_wide];
         } elseif ($application->source_type === GitlabApp::class && $application->source) {
-            $source = ['type' => 'gitlab_app', 'uuid' => $application->source->uuid];
+            $source = ['type' => 'gitlab_app', 'uuid' => $application->source->uuid, 'system_wide' => (bool) $application->source->is_system_wide];
         }
 
         return [
@@ -568,6 +912,7 @@ class ServerTransferExporter
             'scheduled_tasks' => $this->exportScheduledTasks($application->scheduled_tasks()->get()),
             'tags' => $this->exportTags($application->tags),
             'previews' => $this->exportPreviews($application->previews),
+            'secret_manager_link' => $this->exportSecretManagerLink($application),
             'source' => $source,
             'private_key_uuid' => $application->private_key?->uuid,
             'had_git_source' => filled($application->source_id),
@@ -612,6 +957,11 @@ class ServerTransferExporter
             }
         }
 
+        // Not fillable
+        if (in_array('include_coolify_default_variables', $columns, true)) {
+            $attrs['include_coolify_default_variables'] = $database->include_coolify_default_variables;
+        }
+
         $destinationKey = $database->destination_type.':'.$database->destination_id;
 
         return [
@@ -635,6 +985,7 @@ class ServerTransferExporter
             'scheduled_backups' => method_exists($database, 'scheduledBackups')
                 ? $this->exportScheduledBackups($database->scheduledBackups)
                 : [],
+            'secret_manager_link' => $this->exportSecretManagerLink($database),
         ];
     }
 
@@ -668,8 +1019,8 @@ class ServerTransferExporter
             $attrs[$field] = $service->{$field};
         }
 
-        // Hidden compose fields
-        foreach (['docker_compose', 'docker_compose_raw'] as $hidden) {
+        // Hidden compose fields, maintenance mode and the Coolify default variables switch (not fillable)
+        foreach (['docker_compose', 'docker_compose_raw', 'is_maintenance_enabled', 'maintenance_page', 'include_coolify_default_variables'] as $hidden) {
             if (in_array($hidden, $columns, true)) {
                 $attrs[$hidden] = $service->{$hidden};
             }
@@ -685,6 +1036,7 @@ class ServerTransferExporter
             'environment_variables' => $this->exportEnvVars($service->environment_variables()->get()),
             'scheduled_tasks' => $this->exportScheduledTasks($service->scheduled_tasks()->get()),
             'tags' => $this->exportTags($service->tags),
+            'secret_manager_link' => $this->exportSecretManagerLink($service),
             'applications' => $service->applications
                 ->map(fn ($app) => $this->exportServiceApplication($app))
                 ->values()
@@ -861,8 +1213,11 @@ class ServerTransferExporter
                 'is_shared' => (bool) $variable->is_shared,
                 'is_required' => (bool) ($variable->is_required ?? false),
                 'uses_legacy_escaping' => (bool) $variable->uses_legacy_escaping,
+                'preserve_compose_null' => (bool) $variable->preserve_compose_null,
                 'comment' => $variable->comment,
                 'order' => $variable->order,
+                // The Coolify version that created the variable.
+                'version' => $variable->version,
             ];
         }
 
@@ -979,6 +1334,7 @@ class ServerTransferExporter
                 'database_backup_retention_max_storage_s3' => $backup->database_backup_retention_max_storage_s3,
                 'timeout' => $backup->timeout,
                 'disable_local_backup' => (bool) ($backup->disable_local_backup ?? false),
+                'missing_backup_notification_days' => $backup->missing_backup_notification_days,
                 's3_storage_uuid' => $backup->s3?->uuid,
                 's3_storage_uuids' => $backup->selectedS3Storages()->pluck('uuid')->values()->all(),
                 'had_s3_storage' => filled($backup->s3_storage_id),
@@ -1012,6 +1368,10 @@ class ServerTransferExporter
             'metadata' => $app->metadata,
             'pull_requests' => $app->pull_requests,
             'administration' => $app->administration,
+            'organization_self_hosted_runners' => $app->organization_self_hosted_runners,
+            'actions' => $app->actions,
+            'webhook_events' => $app->webhook_events,
+            'runner_group_id' => $app->runner_group_id,
             'private_key_uuid' => $app->privateKey?->uuid,
             'webhook_url_hint' => '/webhooks/source/github/events',
         ];
@@ -1082,6 +1442,85 @@ class ServerTransferExporter
         ];
     }
 
+    /**
+     * The token is read through its cast, so the bundle has it in plaintext like the other credentials.
+     *
+     * @return array<string, mixed>
+     */
+    private function exportIntegrationToken(IntegrationToken $token): array
+    {
+        return [
+            'uuid' => $token->uuid,
+            'provider' => $token->provider,
+            'name' => $token->name,
+            'token' => $token->token,
+            'capabilities' => $token->capabilities,
+            'metadata' => $token->metadata,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function exportDnsZone(DnsProviderZone $zone): array
+    {
+        return [
+            'uuid' => $zone->uuid,
+            'integration_token_uuid' => $zone->integrationToken->uuid,
+            'provider_zone_id' => $zone->provider_zone_id,
+            'name' => $zone->name,
+            'account_id' => $zone->account_id,
+            'account_name' => $zone->account_name,
+        ];
+    }
+
+    /**
+     * The ownership comment proves at the provider that this instance created the record. The target compares it
+     * with the remote comment before it takes ownership.
+     *
+     * @param  array<string, array{kind: string, uuid: string}|null>  $resourceKeys
+     * @return array<string, mixed>
+     */
+    private function exportManagedDnsRecord(ManagedDnsRecord $record, array $resourceKeys): array
+    {
+        return [
+            'uuid' => $record->uuid,
+            'integration_token_uuid' => $record->integrationToken->uuid,
+            'dns_provider_zone_uuid' => $record->zone->uuid,
+            'provider_record_id' => $record->provider_record_id,
+            'type' => $record->type,
+            'name' => $record->name,
+            'content' => $record->content,
+            'owned' => (bool) $record->owned,
+            'ownership_comment' => $record->ownershipComment(),
+            'references' => $record->references
+                ->map(fn (ManagedDnsRecordReference $reference) => $resourceKeys[$reference->resource_type.':'.$reference->resource_id] ?? null)
+                ->filter()
+                ->values()
+                ->all(),
+        ];
+    }
+
+    /**
+     * @return array{uuid: string, integration_token_uuid: string, settings: array<string, mixed>|null}|null
+     */
+    private function exportSecretManagerLink(Model $resource): ?array
+    {
+        if (! method_exists($resource, 'secretManagerLink')) {
+            return null;
+        }
+        $link = $resource->secretManagerLink()->with('integrationToken')->first();
+        if (! $link) {
+            return null;
+        }
+
+        return [
+            'uuid' => $link->uuid,
+            'integration_token_uuid' => $link->integrationToken->uuid,
+            'settings' => $link->settings,
+        ];
+    }
+
     /**
      * @return list<array<string, mixed>>
      */
@@ -1138,6 +1577,8 @@ class ServerTransferExporter
                 'git_type' => $preview->git_type,
                 'docker_compose_domains' => $preview->docker_compose_domains,
                 'docker_registry_image_tag' => $preview->docker_registry_image_tag,
+                'domain_port_overrides' => $preview->domain_port_overrides,
+                'max_restart_count' => $preview->max_restart_count,
                 'persistent_storages' => method_exists($preview, 'persistentStorages')
                     ? $this->exportPersistentStorages($preview->persistentStorages)
                     : [],
@@ -1192,6 +1633,7 @@ class ServerTransferExporter
                         'retention_days_s3' => $backup->retention_days_s3,
                         'retention_max_storage_s3' => $backup->retention_max_storage_s3,
                         'timeout' => $backup->timeout,
+                        'missing_backup_notification_days' => $backup->missing_backup_notification_days,
                         's3_storage_uuid' => $backup->s3?->uuid,
                         's3_storage_uuids' => $backup->selectedS3Storages()->pluck('uuid')->values()->all(),
                         'had_s3_storage' => filled($backup->s3_storage_id),
diff --git a/app/Services/ServerTransfer/ServerTransferImporter.php b/app/Services/ServerTransfer/ServerTransferImporter.php
index 4c175fc8af..053d043d0d 100644
--- a/app/Services/ServerTransfer/ServerTransferImporter.php
+++ b/app/Services/ServerTransfer/ServerTransferImporter.php
@@ -2,22 +2,30 @@
 
 namespace App\Services\ServerTransfer;
 
+use App\Enums\GithubRunnerDockerMode;
 use App\Enums\ServerRole;
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\CloudProviderToken;
+use App\Models\DnsProviderZone;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
 use App\Models\GitlabApp;
+use App\Models\IntegrationToken;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Project;
+use App\Models\ResourceLink;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledTask;
 use App\Models\ScheduledVolumeBackup;
+use App\Models\SecretManagerLink;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -37,9 +45,18 @@ use App\Models\StandaloneSqlite;
 use App\Models\SwarmDocker;
 use App\Models\Tag;
 use App\Models\Team;
+use App\Notifications\Internal\GeneralNotification;
+use App\Rules\DockerImageFormat;
+use App\Rules\ValidServerIp;
+use App\Services\Dns\CloudflareDnsProvider;
+use App\Services\ProjectIconStorageService;
+use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
 use RuntimeException;
 use Throwable;
@@ -76,15 +93,43 @@ class ServerTransferImporter
     /** @var array<string, CloudProviderToken> */
     private array $cloudTokenMap = [];
 
+    /** @var array<string, IntegrationToken> */
+    private array $integrationTokenMap = [];
+
+    /** @var array<string, DnsProviderZone> */
+    private array $dnsZoneMap = [];
+
+    /**
+     * Imported owned DNS records that carry the ownership comment of the source instance. This instance takes
+     * ownership at the provider after the import transaction commits.
+     *
+     * @var list<array{record_id: int, previous_comment: string}>
+     */
+    private array $pendingDnsAdoptions = [];
+
+    /**
+     * Icons of imported projects. They are stored after the import transaction commits, so a storage error
+     * cannot roll back DB rows.
+     *
+     * @var list<array{project: Project, icon: array<string, mixed>}>
+     */
+    private array $pendingProjectIcons = [];
+
     /** @var array<string, LocalPersistentVolume|LocalFileVolume> */
     private array $volumeMap = [];
 
     /** @var array<string, Application> */
     private array $applicationMap = [];
 
+    /** @var array<string, ApplicationPreview> */
+    private array $previewMap = [];
+
     /** @var array<string, Service> */
     private array $serviceMap = [];
 
+    /** @var array<string, ServiceApplication> */
+    private array $serviceApplicationMap = [];
+
     /** @var array<string, Model> */
     private array $databaseMap = [];
 
@@ -95,6 +140,21 @@ class ServerTransferImporter
      */
     private array $pendingSqliteLinks = [];
 
+    /**
+     * Warnings about references of imported resources that this instance cannot resolve.
+     *
+     * @var list<string>
+     */
+    private array $importWarnings = [];
+
+    /**
+     * Applications whose git source needs a check after the transfer: a system-wide source of the source
+     * instance, or a source that this instance does not have.
+     *
+     * @var list<string>
+     */
+    private array $gitSourceApplications = [];
+
     /**
      * @param  array<string, mixed>  $bundle
      * @return array{
@@ -106,7 +166,8 @@ class ServerTransferImporter
      *     preserved_uuids: bool,
      *     export_id: string|null,
      *     claimed: bool,
-     *     claim: array<string, mixed>|null
+     *     claim: array<string, mixed>|null,
+     *     checklist: list<string>
      * }
      */
     public function import(
@@ -117,6 +178,13 @@ class ServerTransferImporter
         bool $adoptMode = true,
     ): array {
         ServerTransferBundle::assertValid($bundle);
+        $this->assertValidServerPayload((array) data_get($bundle, 'server', []));
+
+        if ($adoptMode && ! $preserveUuids) {
+            throw ValidationException::withMessages([
+                'preserve_uuids' => ['Adopt mode keeps the running containers, so it needs the original UUIDs. Import with preserve_uuids=true.'],
+            ]);
+        }
 
         $validation = ServerTransferBundle::validate($bundle);
         $warnings = $validation['warnings'];
@@ -127,27 +195,20 @@ class ServerTransferImporter
         $serverUuid = (string) data_get($bundle, 'server.uuid');
         $serverIp = (string) data_get($bundle, 'server.ip');
 
-        $uuidConflict = Server::withTrashed()->where('uuid', $serverUuid)->exists() && $preserveUuids;
-        $existingIp = Server::where('ip', Server::normalizeIp($serverIp))->first();
-        $ipConflict = $existingIp !== null;
+        // A server that comes back replaces the archived copy that this instance kept from the first transfer.
+        $archive = $preserveUuids ? $this->replaceableArchive($serverUuid, $teamId) : null;
+        $uuidConflict = $archive === null && $preserveUuids && Server::withTrashed()->where('uuid', $serverUuid)->exists();
+        $ipConflict = Server::where('ip', Server::normalizeIp($serverIp))->when($archive, fn ($query) => $query->whereKeyNot($archive->id))->exists();
 
-        if (! $dryRun && $uuidConflict) {
-            throw ValidationException::withMessages([
-                'server.uuid' => ["A server with UUID {$serverUuid} already exists on this instance. Delete/transfer it first, or import with preserve_uuids=false."],
-            ]);
-        }
-
-        if (! $dryRun && $ipConflict) {
-            throw ValidationException::withMessages([
-                'server.ip' => ["A server with IP/domain {$serverIp} already exists (uuid={$existingIp->uuid}). Complete handoff on the source instance first."],
-            ]);
+        if (! $dryRun) {
+            $this->assertCanImport($serverUuid, $serverIp, $teamId, $preserveUuids);
         }
 
         if ($uuidConflict) {
             $warnings[] = "A server with UUID {$serverUuid} already exists on this instance.";
         }
         if ($ipConflict) {
-            $warnings[] = "A server with IP/domain {$serverIp} already exists (uuid={$existingIp->uuid}).";
+            $warnings[] = "A server with IP/domain {$serverIp} already exists on this instance.";
         }
 
         $created = [
@@ -162,6 +223,8 @@ class ServerTransferImporter
             'gitlab_apps' => 0,
             's3_storages' => 0,
             'cloud_provider_tokens' => 0,
+            'integration_tokens' => 0,
+            'managed_dns_records' => 0,
             'ssl_certificates' => 0,
             'volume_backups' => 0,
             'previews' => 0,
@@ -189,18 +252,11 @@ class ServerTransferImporter
             $created['gitlab_apps'] = count(data_get($bundle, 'gitlab_apps', []));
             $created['s3_storages'] = count(data_get($bundle, 's3_storages', []));
             $created['cloud_provider_tokens'] = count(data_get($bundle, 'cloud_provider_tokens', []));
+            $created['integration_tokens'] = count(data_get($bundle, 'integration_tokens', []));
+            $created['managed_dns_records'] = count(data_get($bundle, 'managed_dns_records', []));
             $created['ssl_certificates'] = count(data_get($bundle, 'ssl_certificates', []));
             $created['volume_backups'] = count(data_get($bundle, 'volume_backups', []));
 
-            // Append transfer hints for the target instance FQDN.
-            $targetUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
-            if (count(data_get($bundle, 'github_apps', [])) > 0) {
-                $warnings[] = "After import, set GitHub App webhook URL to {$targetUrl}/webhooks/source/github/events (and update setup/callback URLs in GitHub if needed) so automations work on this instance.";
-            }
-            if (count(data_get($bundle, 'gitlab_apps', [])) > 0) {
-                $warnings[] = "After import, set GitLab webhook URL to {$targetUrl}/webhooks/source/gitlab/events so automations work on this instance.";
-            }
-
             return [
                 'dry_run' => true,
                 'warnings' => $warnings,
@@ -211,10 +267,15 @@ class ServerTransferImporter
                 'export_id' => data_get($bundle, 'export_id'),
                 'claimed' => false,
                 'claim' => null,
+                'checklist' => $this->postTransferChecklist($bundle),
             ];
         }
 
-        $result = DB::transaction(function () use ($bundle, $teamId, $preserveUuids, $adoptMode, $warnings, &$created) {
+        $result = DB::transaction(function () use ($bundle, $teamId, $preserveUuids, $adoptMode, $warnings, $archive, &$created) {
+            // Removed in the same transaction as the import, so a failed import keeps the archive.
+            if ($archive) {
+                app(ServerTransferClaimer::class)->deleteArchive($archive);
+            }
             Team::ensureServerCapacity($teamId);
 
             $this->privateKeyMap = [];
@@ -222,11 +283,19 @@ class ServerTransferImporter
             $this->gitlabAppMap = [];
             $this->s3StorageMap = [];
             $this->cloudTokenMap = [];
+            $this->integrationTokenMap = [];
+            $this->dnsZoneMap = [];
+            $this->pendingDnsAdoptions = [];
+            $this->pendingProjectIcons = [];
             $this->volumeMap = [];
             $this->applicationMap = [];
+            $this->previewMap = [];
             $this->serviceMap = [];
+            $this->serviceApplicationMap = [];
             $this->databaseMap = [];
             $this->pendingSqliteLinks = [];
+            $this->importWarnings = [];
+            $this->gitSourceApplications = [];
 
             // Import shared dependencies first
             $keyPayloads = data_get($bundle, 'private_keys', []);
@@ -276,6 +345,13 @@ class ServerTransferImporter
                 $created['cloud_provider_tokens']++;
             }
 
+            foreach (data_get($bundle, 'integration_tokens', []) as $tokenPayload) {
+                $token = $this->importIntegrationToken($tokenPayload, $teamId, $preserveUuids);
+                $this->integrationTokenMap[(string) data_get($tokenPayload, 'uuid', $token->uuid)] = $token;
+                $this->integrationTokenMap[$token->uuid] = $token;
+                $created['integration_tokens']++;
+            }
+
             $serverKeyUuid = (string) data_get($bundle, 'private_key.uuid', '');
             $privateKey = $this->privateKeyMap[$serverKeyUuid]
                 ?? $this->importPrivateKey(data_get($bundle, 'private_key', []), $teamId, $preserveUuids);
@@ -283,8 +359,10 @@ class ServerTransferImporter
             $server = $this->importServer(data_get($bundle, 'server', []), $privateKey, $teamId, $preserveUuids, $adoptMode);
             $destinationMap = $this->importDestinations(data_get($bundle, 'destinations', []), $server, $preserveUuids);
             $created['destinations'] = count($destinationMap);
+            $this->importGithubRunnerConfig(data_get($bundle, 'github_runner_config'), $server, $teamId, $preserveUuids);
 
             $this->importServerSharedEnvVars(data_get($bundle, 'shared_environment_variables.server', []), $server, $teamId);
+            $this->importTeamSharedEnvVars(data_get($bundle, 'shared_environment_variables.team', []), $teamId);
 
             foreach (data_get($bundle, 'projects', []) as $projectPayload) {
                 $project = $this->importProject($projectPayload, $teamId, $preserveUuids, $created);
@@ -311,21 +389,20 @@ class ServerTransferImporter
                         $this->serviceMap[(string) data_get($servicePayload, 'uuid', $service->uuid)] = $service;
                         $created['services']++;
                     }
+
+                    $this->importCanvasPositions((array) data_get($environmentPayload, 'canvas_positions', []), $environment);
+                    $this->importResourceLinks((array) data_get($environmentPayload, 'resource_links', []), $environment, $preserveUuids);
                 }
             }
 
             $warnings = array_merge($warnings, $this->linkSqliteVolumes());
 
+            $this->importDnsZones(data_get($bundle, 'dns_zones', []), $preserveUuids);
+            $created['managed_dns_records'] = $this->importManagedDnsRecords(data_get($bundle, 'managed_dns_records', []), $teamId, $preserveUuids);
+
             $created['ssl_certificates'] = $this->importSslCertificates(data_get($bundle, 'ssl_certificates', []), $server);
             $created['volume_backups'] = $this->importVolumeBackups(data_get($bundle, 'volume_backups', []), $teamId);
-
-            $targetUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
-            if ($created['github_apps'] > 0) {
-                $warnings[] = "GitHub Apps imported. Update webhook URL to {$targetUrl}/webhooks/source/github/events (and setup/callback URLs in GitHub) so automations work on this instance.";
-            }
-            if ($created['gitlab_apps'] > 0) {
-                $warnings[] = "GitLab sources imported. Update webhook URL to {$targetUrl}/webhooks/source/gitlab/events so automations work on this instance.";
-            }
+            $warnings = array_merge($warnings, $this->importWarnings);
 
             $metadata = $server->server_metadata ?? [];
             $metadata['transfer'] = [
@@ -334,6 +411,7 @@ class ServerTransferImporter
                 'source_instance_url' => data_get($bundle, 'source_instance.url'),
                 'imported_at' => now()->toIso8601String(),
                 'adopt_mode' => $adoptMode,
+                'git_source_applications' => array_values(array_unique($this->gitSourceApplications)),
             ];
             $server->server_metadata = $metadata;
             $server->save();
@@ -348,9 +426,13 @@ class ServerTransferImporter
                 'export_id' => data_get($bundle, 'export_id'),
                 'claimed' => false,
                 'claim' => null,
+                'checklist' => $this->postTransferChecklist($bundle),
             ];
         });
 
+        // Provider and storage calls run after the import transaction commits, so an error cannot roll back DB rows.
+        $result['warnings'] = array_values(array_unique(array_merge($result['warnings'], $this->adoptManagedDnsRecords(), $this->storeProjectIcons())));
+
         // Claim after the import transaction commits so a claim failure cannot roll back DB rows.
         if (filled(data_get($result, 'server_uuid'))) {
             $server = Server::where('uuid', $result['server_uuid'])->where('team_id', $teamId)->first();
@@ -358,6 +440,10 @@ class ServerTransferImporter
                 try {
                     $result['claim'] = app(ServerTransferClaimer::class)->claim($server);
                     $result['claimed'] = true;
+                    // Same check as the Validate button. A running proxy and Docker are kept as they are.
+                    ValidateAndInstallServerJob::dispatch($server);
+                    $this->startFinishChecklist($server);
+                    $result['server_url'] = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/').'/server/'.$server->uuid;
                 } catch (Throwable $e) {
                     $result['claimed'] = false;
                     $result['claim'] = null;
@@ -369,6 +455,130 @@ class ServerTransferImporter
         return $result;
     }
 
+    /**
+     * Check the server connection fields with the same rules as the create server API.
+     *
+     * @param  array<string, mixed>  $server
+     */
+    private function assertValidServerPayload(array $server): void
+    {
+        Validator::make($server, [
+            'name' => 'nullable|string|max:255',
+            'ip' => ['required', 'string', new ValidServerIp],
+            'port' => 'required|integer|between:1,65535',
+            'user' => ValidationPatterns::serverUsernameRules(required: false),
+        ], [], [
+            'ip' => 'server.ip',
+            'port' => 'server.port',
+            'user' => 'server.user',
+        ])->validate();
+    }
+
+    /**
+     * Checks that a server can be imported into the team, without the bundle. Every check runs, so the
+     * source instance can show which checks are OK and which failed.
+     *
+     * @return list<array{field: string, label: string, ok: bool, message: string|null}>
+     */
+    public function importChecks(string $serverUuid, string $serverIp, int $teamId, bool $preserveUuids = true): array
+    {
+        $team = Team::find($teamId);
+        $archive = $preserveUuids ? $this->replaceableArchive($serverUuid, $teamId) : null;
+        // The archive is replaced, so the import does not add a server.
+        $limitReached = ! $team || ($archive === null && Team::serverLimitReached($team));
+
+        $existingServer = $preserveUuids && $archive === null ? Server::withTrashed()->where('uuid', $serverUuid)->first() : null;
+        $uuidMessage = match (true) {
+            $existingServer === null => null,
+            $existingServer->trashed() => "The server with UUID {$serverUuid} is still being deleted on this instance. Wait a minute, then transfer again.",
+            $existingServer->isTransferredAway() => "Another team of this instance has the archived copy of server {$existingServer->name}. Transfer the server into that team, or delete the archive there first.",
+            default => "A server with UUID {$serverUuid} already exists on this instance. Delete/transfer it first, or import with preserve_uuids=false.",
+        };
+
+        $ipExists = Server::where('ip', Server::normalizeIp($serverIp))->when($archive, fn ($query) => $query->whereKeyNot($archive->id))->exists();
+
+        return [
+            [
+                'field' => 'server',
+                'label' => 'the team can have one more server',
+                'ok' => ! $limitReached,
+                'message' => $limitReached ? 'Server limit reached for your subscription.' : null,
+            ],
+            [
+                'field' => 'server.uuid',
+                'label' => $archive ? 'the archived copy of this server on this instance is replaced' : 'no server with the same UUID exists',
+                'ok' => $uuidMessage === null,
+                'message' => $uuidMessage,
+            ],
+            [
+                'field' => 'server.ip',
+                'label' => 'no server with the same IP exists',
+                'ok' => ! $ipExists,
+                'message' => $ipExists ? "A server with IP/domain {$serverIp} already exists on this instance. Remove it first." : null,
+            ],
+        ];
+    }
+
+    /**
+     * The steps that finish the transfer here, and one notification that points the team to them.
+     * A failure here never fails the import: the server is imported and claimed already.
+     */
+    private function startFinishChecklist(Server $server): void
+    {
+        try {
+            $items = app(TransferFinishChecklist::class)->start($server);
+            $server->team?->notify(new GeneralNotification(
+                "Server '{$server->name}' was transferred to this instance. Open the server to finish the transfer: ".count($items).' steps to check.'
+            ));
+        } catch (Throwable $e) {
+            Log::warning('Could not start the transfer finish checklist', ['server_uuid' => $server->uuid, 'error' => $e->getMessage()]);
+        }
+    }
+
+    /**
+     * The archive that this instance kept when it transferred the server away. A transfer back into the same team
+     * replaces it.
+     */
+    private function replaceableArchive(string $serverUuid, int $teamId): ?Server
+    {
+        $server = Server::query()->where('uuid', $serverUuid)->where('team_id', $teamId)->first();
+
+        return $server?->isTransferredAway() ? $server : null;
+    }
+
+    /**
+     * @throws ValidationException with the first failed import check
+     */
+    public function assertCanImport(string $serverUuid, string $serverIp, int $teamId, bool $preserveUuids = true): void
+    {
+        foreach ($this->importChecks($serverUuid, $serverIp, $teamId, $preserveUuids) as $check) {
+            if (! $check['ok']) {
+                throw ValidationException::withMessages([$check['field'] => [$check['message']]]);
+            }
+        }
+    }
+
+    /**
+     * Running containers are found by the resource UUID. In adopt mode a new UUID would leave them
+     * without a resource, so a conflict stops the import instead.
+     *
+     * @param  class-string<Model>  $modelClass
+     */
+    private function resolveResourceUuid(string $modelClass, string $uuid, bool $adoptMode, string $label): string
+    {
+        if (! $modelClass::withTrashed()->where('uuid', $uuid)->exists()) {
+            return $uuid;
+        }
+
+        if ($adoptMode) {
+            throw ValidationException::withMessages([
+                'bundle' => ["The {$label} UUID {$uuid} is already used on this instance. Delete that {$label} permanently first, because adopt mode needs the same UUID to keep the running containers."],
+            ]);
+        }
+
+        return new_public_id();
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      */
@@ -450,6 +660,12 @@ class ServerTransferImporter
             'private_key_id' => $privateKey->id,
             'team_id' => $teamId,
             'cloud_provider_token_id' => $cloudTokenId,
+            'hetzner_server_id' => data_get($payload, 'hetzner_server_id'),
+            'vultr_instance_id' => data_get($payload, 'vultr_instance_id'),
+            'digitalocean_droplet_id' => data_get($payload, 'digitalocean_droplet_id'),
+            'hostinger_virtual_machine_id' => data_get($payload, 'hostinger_virtual_machine_id'),
+            'proxy_error_page' => data_get($payload, 'proxy_error_page'),
+            'swarm_cluster' => data_get($payload, 'swarm_cluster'),
         ]);
         $server->uuid = $uuid;
         $server->save();
@@ -479,9 +695,16 @@ class ServerTransferImporter
                     'id', 'server_id', 'created_at', 'updated_at',
                     'is_reachable', 'is_usable', 'force_disabled',
                     'sentinel_token', 'sentinel_custom_url',
+                    // A foreign key of the source instance; older bundles still contain it.
+                    'cloudflare_tunnel_integration_token_id',
+                    'cloudflare_tunnel_integration_token_uuid',
                 ])
                 ->all();
             $server->settings->fill($safe);
+            $server->settings->cloudflare_tunnel_integration_token_id = $this->importedIntegrationTokenId(
+                data_get($settingsPayload, 'cloudflare_tunnel_integration_token_uuid'),
+                'The Cloudflare tunnel of this server: its Cloudflare API token was not found on this instance; select it again in the Cloudflare tunnel settings.',
+            );
             // Imported servers start not validated; claim will rebind sentinel.
             $server->settings->is_reachable = false;
             $server->settings->is_usable = false;
@@ -593,6 +816,38 @@ class ServerTransferImporter
         }
     }
 
+    /**
+     * A team variable that already exists keeps the value of this instance.
+     *
+     * @param  list<array<string, mixed>>  $variables
+     */
+    private function importTeamSharedEnvVars(array $variables, int $teamId): void
+    {
+        foreach ($variables as $variable) {
+            $key = (string) data_get($variable, 'key');
+            $exists = SharedEnvironmentVariable::query()
+                ->where('type', 'team')
+                ->where('team_id', $teamId)
+                ->where('key', $key)
+                ->exists();
+            if ($exists) {
+                $this->importWarnings[] = "Team shared variable {$key} already exists on this instance. It keeps its value here, which can differ from the value on the source instance.";
+
+                continue;
+            }
+            SharedEnvironmentVariable::create([
+                'key' => $key,
+                'value' => data_get($variable, 'value'),
+                'is_multiline' => (bool) data_get($variable, 'is_multiline', false),
+                'is_literal' => (bool) data_get($variable, 'is_literal', false),
+                'is_shown_once' => (bool) data_get($variable, 'is_shown_once', false),
+                'comment' => data_get($variable, 'comment'),
+                'type' => 'team',
+                'team_id' => $teamId,
+            ]);
+        }
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      * @param  array<string, int>  $created
@@ -603,9 +858,14 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
+        $icon = data_get($payload, 'icon');
         $existing = Project::where('uuid', $uuid)->where('team_id', $teamId)->first();
         if ($existing) {
             $this->importProjectSharedEnvVars(data_get($payload, 'shared_environment_variables', []), $existing, $teamId);
+            // An icon that the project already has on this instance is kept.
+            if (is_array($icon) && blank($existing->icon_path)) {
+                $this->pendingProjectIcons[] = ['project' => $existing, 'icon' => $icon];
+            }
 
             return $existing;
         }
@@ -624,7 +884,124 @@ class ServerTransferImporter
 
         $this->importProjectSharedEnvVars(data_get($payload, 'shared_environment_variables', []), $project, $teamId);
 
-        return $project->fresh(['environments']);
+        $project = $project->fresh(['environments']);
+        if (is_array($icon)) {
+            $this->pendingProjectIcons[] = ['project' => $project, 'icon' => $icon];
+        }
+
+        return $project;
+    }
+
+    /**
+     * Stores the icons of the imported projects in the icon storage of this instance. Coolify stores every
+     * icon as a JPEG file and serves it as one, so other content is not stored.
+     *
+     * @return list<string> warnings
+     */
+    private function storeProjectIcons(): array
+    {
+        $warnings = [];
+        foreach ($this->pendingProjectIcons as ['project' => $project, 'icon' => $icon]) {
+            $contents = base64_decode((string) data_get($icon, 'content_base64', ''), true);
+            $problem = match (true) {
+                ! is_string($contents) || $contents === '' => 'its content is not valid',
+                strlen($contents) > ServerTransferExporter::MAX_PROJECT_ICON_BYTES => 'it is larger than 2 MB',
+                (new \finfo(FILEINFO_MIME_TYPE))->buffer($contents) !== 'image/jpeg' => 'it is not a JPEG image',
+                default => null,
+            };
+            if ($problem === null) {
+                try {
+                    app(ProjectIconStorageService::class)->storeProjectContents($project, $contents);
+
+                    continue;
+                } catch (Throwable) {
+                    $problem = 'the icon storage of this instance is not available';
+                }
+            }
+            $warnings[] = "The icon of project {$project->name} was not imported, because {$problem}. Upload it again in the project settings.";
+        }
+        $this->pendingProjectIcons = [];
+
+        return $warnings;
+    }
+
+    /**
+     * Manual steps after the transfer, with the URL of this instance in place of {target_url}.
+     *
+     * @param  array<string, mixed>  $bundle
+     * @return list<string>
+     */
+    private function postTransferChecklist(array $bundle): array
+    {
+        $targetUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
+
+        return array_values(array_unique(array_map(
+            fn (string $step) => str_replace('{target_url}', $targetUrl, $step),
+            array_filter((array) data_get($bundle, 'post_transfer_checklist', []), 'is_string'),
+        )));
+    }
+
+    /**
+     * The config is imported disabled: an enabled config makes this instance remove every runner container on
+     * the server that it does not know, also the runners that the source started. The user enables it after
+     * the GitHub App sends its webhooks here.
+     */
+    private function importGithubRunnerConfig(mixed $payload, Server $server, int $teamId, bool $preserveUuids): void
+    {
+        if (! is_array($payload)) {
+            return;
+        }
+
+        $appUuid = (string) data_get($payload, 'github_app_uuid', '');
+        $githubApp = $appUuid === '' ? null : ($this->githubAppMap[$appUuid]
+            ?? GithubApp::query()->where('uuid', $appUuid)->where('is_system_wide', true)->first()
+            ?? GithubApp::query()->where('uuid', $appUuid)->where('team_id', $teamId)->first());
+        if (! $githubApp) {
+            $this->importWarnings[] = 'The GitHub runner settings of this server were not imported, because their GitHub App was not found on this instance. Set up GitHub runners on the server again.';
+
+            return;
+        }
+
+        $validator = Validator::make($payload, [
+            'labels' => ['required', 'array', 'min:1'],
+            'labels.*' => ['string', 'regex:/\A[a-z0-9][a-z0-9._-]{0,99}\z/'],
+            'max_runners' => ['required', 'integer', 'min:1', 'max:32'],
+            'docker_mode' => ['required', Rule::enum(GithubRunnerDockerMode::class)],
+            'runner_image' => ['nullable', 'string', 'max:255', new DockerImageFormat],
+            'cpu_limit' => ['nullable', 'string', 'regex:/\A\d+(\.\d+)?\z/'],
+            'memory_limit' => ['nullable', 'string', 'regex:/\A\d+[bkmg]?\z/i'],
+            'capacity_wait_timeout' => ['required', 'integer', 'min:1', 'max:1440'],
+            'idle_timeout' => ['required', 'integer', 'min:1', 'max:1440'],
+            'job_timeout' => ['required', 'integer', 'min:1', 'max:7200'],
+        ]);
+        if ($validator->fails()) {
+            $this->importWarnings[] = 'The GitHub runner settings of this server were not imported, because they are not valid: '.$validator->errors()->first().' Set up GitHub runners on the server again.';
+
+            return;
+        }
+
+        $uuid = (string) data_get($payload, 'uuid', '');
+        $config = new GithubRunnerConfig;
+        $config->forceFill([
+            'server_id' => $server->id,
+            'github_app_id' => $githubApp->id,
+            'labels' => array_values($payload['labels']),
+            'is_enabled' => false,
+            'is_dedicated' => (bool) data_get($payload, 'is_dedicated', false),
+            'allow_pull_requests' => (bool) data_get($payload, 'allow_pull_requests', false),
+            'max_runners' => (int) $payload['max_runners'],
+            'docker_mode' => GithubRunnerDockerMode::from($payload['docker_mode']),
+            'runner_image' => data_get($payload, 'runner_image'),
+            'cpu_limit' => data_get($payload, 'cpu_limit'),
+            'memory_limit' => data_get($payload, 'memory_limit'),
+            'capacity_wait_timeout' => (int) $payload['capacity_wait_timeout'],
+            'idle_timeout' => (int) $payload['idle_timeout'],
+            'job_timeout' => (int) $payload['job_timeout'],
+        ]);
+        if ($preserveUuids && $uuid !== '' && ! GithubRunnerConfig::where('uuid', $uuid)->exists()) {
+            $config->uuid = $uuid;
+        }
+        $config->save();
     }
 
     /**
@@ -733,6 +1110,86 @@ class ServerTransferImporter
         }
     }
 
+    /**
+     * Canvas positions are keyed by resource uuid. Resources may get a new uuid on import.
+     *
+     * @param  array<string, mixed>  $positions
+     */
+    private function importCanvasPositions(array $positions, Environment $environment): void
+    {
+        $imported = [];
+        foreach ($positions as $uuid => $position) {
+            $resource = $this->applicationMap[$uuid] ?? $this->databaseMap[$uuid] ?? $this->serviceMap[$uuid] ?? null;
+            if ($resource) {
+                $imported[$resource->uuid] = $position;
+            }
+        }
+        if ($imported === []) {
+            return;
+        }
+
+        $environment->canvas_positions = array_merge($environment->canvas_positions ?? [], $imported);
+        $environment->save();
+    }
+
+    /**
+     * Links between two imported resources of the environment. The user who drew the link is a user of the
+     * source instance, so created_by stays empty.
+     *
+     * @param  list<array<string, mixed>>  $links
+     */
+    private function importResourceLinks(array $links, Environment $environment, bool $preserveUuids): void
+    {
+        foreach ($links as $link) {
+            $source = $this->linkedResource(data_get($link, 'source'));
+            $target = $this->linkedResource(data_get($link, 'target'));
+            if (! $source || ! $target || $source->is($target)
+                || (int) $source->environment_id !== $environment->id || (int) $target->environment_id !== $environment->id) {
+                $this->importWarnings[] = "A link between resources on the canvas of environment {$environment->name} was not imported, because one of its resources was not imported.";
+
+                continue;
+            }
+
+            $attributes = [
+                'environment_id' => $environment->id,
+                'source_type' => $source->getMorphClass(),
+                'source_id' => $source->getKey(),
+                'target_type' => $target->getMorphClass(),
+                'target_id' => $target->getKey(),
+            ];
+            if (ResourceLink::query()->where($attributes)->exists()) {
+                continue;
+            }
+
+            $label = data_get($link, 'label');
+            $resourceLink = new ResourceLink([
+                ...$attributes,
+                'label' => is_string($label) && trim($label) !== '' ? mb_substr(trim($label), 0, 64) : null,
+                'created_by' => null,
+            ]);
+            $uuid = (string) data_get($link, 'uuid', '');
+            if ($preserveUuids && $uuid !== '' && ! ResourceLink::where('uuid', $uuid)->exists()) {
+                $resourceLink->uuid = $uuid;
+            }
+            $resourceLink->save();
+        }
+    }
+
+    /**
+     * An end of a canvas link: the kind and the original uuid of an imported resource.
+     */
+    private function linkedResource(mixed $end): ?Model
+    {
+        $uuid = (string) data_get($end, 'uuid', '');
+
+        return match (data_get($end, 'kind')) {
+            'application' => $this->applicationMap[$uuid] ?? null,
+            'database' => $this->databaseMap[$uuid] ?? null,
+            'service' => $this->serviceMap[$uuid] ?? null,
+            default => null,
+        };
+    }
+
     /**
      * @param  array<string, mixed>  $payload
      * @param  array<string, StandaloneDocker|SwarmDocker>  $destinationMap
@@ -750,9 +1207,7 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
-        if (Application::withTrashed()->where('uuid', $uuid)->exists()) {
-            $uuid = new_public_id();
-        }
+        $uuid = $this->resolveResourceUuid(Application::class, $uuid, $adoptMode, 'application');
 
         $attributes = (array) data_get($payload, 'attributes', []);
         unset($attributes['id'], $attributes['environment_id'], $attributes['destination_id'], $attributes['destination_type'], $attributes['source_id'], $attributes['source_type'], $attributes['private_key_id']);
@@ -763,6 +1218,8 @@ class ServerTransferImporter
         $attributes['destination_id'] = $destination->id;
         $attributes['destination_type'] = $destination->getMorphClass();
 
+        $name = (string) data_get($attributes, 'name', $uuid);
+
         // Re-link git source
         $source = data_get($payload, 'source');
         if (is_array($source) && filled(data_get($source, 'uuid'))) {
@@ -786,12 +1243,27 @@ class ServerTransferImporter
                 }
             }
         }
+        $sourceMissing = data_get($payload, 'had_git_source') && ! isset($attributes['source_id']);
+        if ($sourceMissing || data_get($payload, 'source.system_wide') === true) {
+            $this->gitSourceApplications[] = $uuid;
+        }
+        if ($sourceMissing) {
+            $sourceLabel = match (data_get($payload, 'source.type')) {
+                'github_app' => 'GitHub App',
+                'gitlab_app' => 'GitLab App',
+                default => 'git source',
+            };
+            $this->importWarnings[] = "Application {$name}: its {$sourceLabel} was not found on this instance; set the source again.";
+        }
 
         // Re-link deploy key
         $appKeyUuid = data_get($payload, 'private_key_uuid');
         if ($appKeyUuid && isset($this->privateKeyMap[$appKeyUuid])) {
             $attributes['private_key_id'] = $this->privateKeyMap[$appKeyUuid]->id;
         }
+        if (data_get($payload, 'had_private_key') && ! isset($attributes['private_key_id'])) {
+            $this->importWarnings[] = "Application {$name}: its private key was not found on this instance; select the private key again.";
+        }
 
         if ($adoptMode) {
             // Keep runtime status if provided so inventory can match, but default exited if empty.
@@ -800,7 +1272,10 @@ class ServerTransferImporter
             $attributes['status'] = 'exited';
         }
 
-        $application = Application::create($attributes);
+        $application = new Application($attributes);
+        // Maintenance mode is not fillable.
+        $application->forceFill(collect($attributes)->only(['is_maintenance_enabled', 'maintenance_page'])->all());
+        $application->save();
 
         $settings = (array) data_get($payload, 'settings', []);
         if ($settings !== [] && $application->settings) {
@@ -815,6 +1290,7 @@ class ServerTransferImporter
         $this->importScheduledTasks(data_get($payload, 'scheduled_tasks', []), $application, $teamId);
         $this->importTags(data_get($payload, 'tags', []), $application, $teamId);
         $this->importPreviews(data_get($payload, 'previews', []), $application, $preserveUuids, $adoptMode, $teamId);
+        $this->importSecretManagerLink(data_get($payload, 'secret_manager_link'), $application, "Application {$name}");
 
         return $application;
     }
@@ -832,12 +1308,9 @@ class ServerTransferImporter
         int $teamId = 0,
     ): ?Model {
         $type = (string) data_get($payload, 'type', 'StandalonePostgresql');
-        $modelClass = self::DATABASE_MODELS[$type]
-            ?? (is_string(data_get($payload, 'model')) && class_exists((string) data_get($payload, 'model'))
-                ? (string) data_get($payload, 'model')
-                : null);
+        $modelClass = self::DATABASE_MODELS[$type] ?? null;
 
-        if (! $modelClass || ! class_exists($modelClass)) {
+        if (! $modelClass) {
             throw new RuntimeException("Unsupported database type: {$type}");
         }
 
@@ -846,9 +1319,7 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
-        if ($modelClass::withTrashed()->where('uuid', $uuid)->exists()) {
-            $uuid = new_public_id();
-        }
+        $uuid = $this->resolveResourceUuid($modelClass, $uuid, $adoptMode, 'database');
 
         $attributes = (array) data_get($payload, 'attributes', []);
         unset($attributes['id'], $attributes['environment_id'], $attributes['destination_id'], $attributes['destination_type']);
@@ -878,6 +1349,7 @@ class ServerTransferImporter
             $this->importTags(data_get($payload, 'tags', []), $database, $teamId);
         }
         $this->importScheduledBackups(data_get($payload, 'scheduled_backups', []), $database, $teamId);
+        $this->importSecretManagerLink(data_get($payload, 'secret_manager_link'), $database, "Database {$database->name}");
 
         return $database;
     }
@@ -900,9 +1372,7 @@ class ServerTransferImporter
             ? (string) data_get($payload, 'uuid')
             : new_public_id();
 
-        if (Service::withTrashed()->where('uuid', $uuid)->exists()) {
-            $uuid = new_public_id();
-        }
+        $uuid = $this->resolveResourceUuid(Service::class, $uuid, $adoptMode, 'service');
 
         $attributes = (array) data_get($payload, 'attributes', []);
         unset($attributes['id'], $attributes['environment_id'], $attributes['destination_id'], $attributes['destination_type'], $attributes['server_id']);
@@ -913,14 +1383,19 @@ class ServerTransferImporter
         $attributes['destination_id'] = $destination->id;
         $attributes['destination_type'] = $destination->getMorphClass();
 
-        $service = Service::create($attributes);
+        $service = new Service($attributes);
+        // Maintenance mode and the Coolify default variables switch are not fillable.
+        $service->forceFill(collect($attributes)->only(['is_maintenance_enabled', 'maintenance_page', 'include_coolify_default_variables'])->all());
+        $service->save();
 
         $this->importEnvVars(data_get($payload, 'environment_variables', []), $service, false);
         $this->importScheduledTasks(data_get($payload, 'scheduled_tasks', []), $service, $teamId);
         $this->importTags(data_get($payload, 'tags', []), $service, $teamId);
+        $this->importSecretManagerLink(data_get($payload, 'secret_manager_link'), $service, "Service {$service->name}");
 
         foreach (data_get($payload, 'applications', []) as $appPayload) {
-            $this->importServiceApplication($appPayload, $service, $preserveUuids, $adoptMode);
+            $serviceApp = $this->importServiceApplication($appPayload, $service, $preserveUuids, $adoptMode);
+            $this->serviceApplicationMap[(string) data_get($appPayload, 'uuid', $serviceApp->uuid)] = $serviceApp;
         }
 
         foreach (data_get($payload, 'databases', []) as $dbPayload) {
@@ -1033,11 +1508,16 @@ class ServerTransferImporter
                     'is_required' => (bool) data_get($variable, 'is_required', false),
                     // Exports from older versions have no flag; their values use the old escaping.
                     'uses_legacy_escaping' => (bool) data_get($variable, 'uses_legacy_escaping', true),
+                    'preserve_compose_null' => (bool) data_get($variable, 'preserve_compose_null', false),
                     'comment' => data_get($variable, 'comment'),
                     'order' => data_get($variable, 'order'),
                     'resourceable_type' => $resource->getMorphClass(),
                     'resourceable_id' => $resource->id,
                 ]);
+                // Older bundles have no version; the column default applies.
+                if (filled(data_get($variable, 'version'))) {
+                    $env->version = (string) data_get($variable, 'version');
+                }
                 $env->uuid = $uuid;
                 $env->save();
             });
@@ -1241,6 +1721,7 @@ class ServerTransferImporter
 
             $s3Ids = $this->importedBackupS3StorageIds($backup);
             $s3Id = $s3Ids[0] ?? null;
+            $this->warnAboutMissingS3Storage($backup, $s3Id, "database {$database->name}");
 
             $importedBackup = ScheduledDatabaseBackup::create([
                 'uuid' => $uuid,
@@ -1259,6 +1740,7 @@ class ServerTransferImporter
                 'database_backup_retention_max_storage_s3' => data_get($backup, 'database_backup_retention_max_storage_s3'),
                 'timeout' => data_get($backup, 'timeout'),
                 'disable_local_backup' => (bool) data_get($backup, 'disable_local_backup', false),
+                'missing_backup_notification_days' => (int) data_get($backup, 'missing_backup_notification_days', 0),
                 's3_storage_id' => $s3Id,
                 'database_type' => $database->getMorphClass(),
                 'database_id' => $database->id,
@@ -1267,6 +1749,20 @@ class ServerTransferImporter
         }
     }
 
+    /**
+     * @param  array<string, mixed>  $backup
+     */
+    private function warnAboutMissingS3Storage(array $backup, ?int $s3Id, string $backupOf): void
+    {
+        if (! data_get($backup, 'had_s3_storage') || $s3Id !== null) {
+            return;
+        }
+
+        $this->importWarnings[] = data_get($backup, 'save_s3')
+            ? "Backup of {$backupOf}: S3 upload was turned off because its S3 storage was not found."
+            : "Backup of {$backupOf}: its S3 storage was not found; select it again.";
+    }
+
     /**
      * Maps the exported S3 destinations of a backup to imported storages, primary first. Older bundles only have
      * `s3_storage_uuid`.
@@ -1327,6 +1823,10 @@ class ServerTransferImporter
             'metadata' => data_get($payload, 'metadata'),
             'pull_requests' => data_get($payload, 'pull_requests'),
             'administration' => data_get($payload, 'administration'),
+            'organization_self_hosted_runners' => data_get($payload, 'organization_self_hosted_runners'),
+            'actions' => data_get($payload, 'actions'),
+            'webhook_events' => data_get($payload, 'webhook_events'),
+            'runner_group_id' => data_get($payload, 'runner_group_id'),
         ]);
         $app->uuid = $uuid;
         $app->save();
@@ -1464,6 +1964,222 @@ class ServerTransferImporter
         return $token;
     }
 
+    /**
+     * A token with the same UUID in the target team is reused. A UUID that another team uses gets a new UUID.
+     *
+     * @param  array<string, mixed>  $payload
+     */
+    private function importIntegrationToken(array $payload, int $teamId, bool $preserveUuids): IntegrationToken
+    {
+        $uuid = $preserveUuids && filled(data_get($payload, 'uuid'))
+            ? (string) data_get($payload, 'uuid')
+            : new_public_id();
+
+        $existing = IntegrationToken::where('uuid', $uuid)->where('team_id', $teamId)->first();
+        if ($existing) {
+            return $existing;
+        }
+        if (IntegrationToken::where('uuid', $uuid)->exists()) {
+            $uuid = new_public_id();
+        }
+
+        $token = new IntegrationToken;
+        $token->forceFill([
+            'team_id' => $teamId,
+            'provider' => (string) data_get($payload, 'provider'),
+            'name' => data_get($payload, 'name') ?: 'Imported integration token',
+            'token' => (string) data_get($payload, 'token'),
+            'capabilities' => (array) data_get($payload, 'capabilities', []),
+            'metadata' => data_get($payload, 'metadata'),
+        ]);
+        $token->uuid = $uuid;
+        $token->save();
+
+        return $token;
+    }
+
+    /**
+     * The ID of the imported token, or null with a warning when the bundle names a token that it does not contain.
+     */
+    private function importedIntegrationTokenId(mixed $tokenUuid, string $missingWarning): ?int
+    {
+        if (! is_string($tokenUuid) || $tokenUuid === '') {
+            return null;
+        }
+        if (! isset($this->integrationTokenMap[$tokenUuid])) {
+            $this->importWarnings[] = $missingWarning;
+
+            return null;
+        }
+
+        return $this->integrationTokenMap[$tokenUuid]->id;
+    }
+
+    private function importSecretManagerLink(mixed $payload, Model $resource, string $label): void
+    {
+        if (! is_array($payload) || ! method_exists($resource, 'secretManagerLink')) {
+            return;
+        }
+
+        $tokenId = $this->importedIntegrationTokenId(
+            data_get($payload, 'integration_token_uuid'),
+            "{$label}: its secret manager token was not found on this instance; link the secret manager source again.",
+        );
+        if ($tokenId === null) {
+            return;
+        }
+
+        $uuid = filled(data_get($payload, 'uuid')) ? (string) data_get($payload, 'uuid') : new_public_id();
+        if (SecretManagerLink::where('uuid', $uuid)->exists()) {
+            $uuid = new_public_id();
+        }
+
+        $link = new SecretManagerLink;
+        $link->forceFill([
+            'resourceable_type' => $resource->getMorphClass(),
+            'resourceable_id' => $resource->getKey(),
+            'integration_token_id' => $tokenId,
+            'settings' => data_get($payload, 'settings'),
+        ]);
+        $link->uuid = $uuid;
+        $link->save();
+    }
+
+    /**
+     * A zone of the same token and provider zone that the target team already has is reused.
+     *
+     * @param  list<array<string, mixed>>  $zones
+     */
+    private function importDnsZones(array $zones, bool $preserveUuids): void
+    {
+        foreach ($zones as $payload) {
+            $token = $this->integrationTokenMap[(string) data_get($payload, 'integration_token_uuid')] ?? null;
+            if (! $token) {
+                continue;
+            }
+
+            $zone = DnsProviderZone::query()
+                ->where('integration_token_id', $token->id)
+                ->where('provider_zone_id', (string) data_get($payload, 'provider_zone_id'))
+                ->first();
+            if (! $zone) {
+                $uuid = $preserveUuids && filled(data_get($payload, 'uuid')) ? (string) data_get($payload, 'uuid') : new_public_id();
+                if (DnsProviderZone::where('uuid', $uuid)->exists()) {
+                    $uuid = new_public_id();
+                }
+                $zone = new DnsProviderZone;
+                $zone->forceFill([
+                    'integration_token_id' => $token->id,
+                    'provider_zone_id' => (string) data_get($payload, 'provider_zone_id'),
+                    'name' => strtolower((string) data_get($payload, 'name')),
+                    'account_id' => data_get($payload, 'account_id'),
+                    'account_name' => data_get($payload, 'account_name'),
+                ]);
+                $zone->uuid = $uuid;
+                $zone->save();
+            }
+
+            $this->dnsZoneMap[(string) data_get($payload, 'uuid', $zone->uuid)] = $zone;
+        }
+    }
+
+    /**
+     * Imports the managed DNS records and links them to the imported resources. An owned record keeps the ownership
+     * comment of the source at the provider until adoptManagedDnsRecords() replaces it.
+     *
+     * @param  list<array<string, mixed>>  $records
+     */
+    private function importManagedDnsRecords(array $records, int $teamId, bool $preserveUuids): int
+    {
+        $count = 0;
+        foreach ($records as $payload) {
+            $name = (string) data_get($payload, 'name');
+            $zone = $this->dnsZoneMap[(string) data_get($payload, 'dns_provider_zone_uuid')] ?? null;
+            $resources = collect(data_get($payload, 'references', []))
+                ->map(fn ($reference) => match (data_get($reference, 'kind')) {
+                    'application' => $this->applicationMap[(string) data_get($reference, 'uuid')] ?? null,
+                    'preview' => $this->previewMap[(string) data_get($reference, 'uuid')] ?? null,
+                    'service_application' => $this->serviceApplicationMap[(string) data_get($reference, 'uuid')] ?? null,
+                    default => null,
+                })
+                ->filter()
+                ->values();
+            if (! $zone || $resources->isEmpty()) {
+                $this->importWarnings[] = "DNS record {$name}: its DNS zone or resources were not imported, so this instance does not manage it.";
+
+                continue;
+            }
+
+            $record = ManagedDnsRecord::query()
+                ->where('dns_provider_zone_id', $zone->id)
+                ->where('provider_record_id', (string) data_get($payload, 'provider_record_id'))
+                ->first();
+            if (! $record) {
+                $uuid = $preserveUuids && filled(data_get($payload, 'uuid')) ? (string) data_get($payload, 'uuid') : new_public_id();
+                if (ManagedDnsRecord::where('uuid', $uuid)->exists()) {
+                    $uuid = new_public_id();
+                }
+                $previousComment = data_get($payload, 'ownership_comment');
+                // Without the source comment there is no proof of ownership at the provider.
+                $owned = (bool) data_get($payload, 'owned', false) && is_string($previousComment) && $previousComment !== '';
+
+                $record = ManagedDnsRecord::query()->create([
+                    'uuid' => $uuid,
+                    'team_id' => $teamId,
+                    'integration_token_id' => $zone->integration_token_id,
+                    'dns_provider_zone_id' => $zone->id,
+                    'provider_record_id' => (string) data_get($payload, 'provider_record_id'),
+                    'type' => (string) data_get($payload, 'type'),
+                    'name' => $name,
+                    'content' => (string) data_get($payload, 'content'),
+                    'owned' => $owned,
+                ]);
+                if ($owned && $previousComment !== $record->ownershipComment()) {
+                    $this->pendingDnsAdoptions[] = ['record_id' => $record->id, 'previous_comment' => $previousComment];
+                }
+                $count++;
+            }
+
+            foreach ($resources as $resource) {
+                $record->addReference($resource);
+            }
+        }
+
+        return $count;
+    }
+
+    /**
+     * Replaces the ownership comment of the source instance with the comment of this instance at the provider.
+     * A record that cannot be adopted is no longer owned, so this instance never changes or deletes it.
+     *
+     * @return list<string> warnings
+     */
+    private function adoptManagedDnsRecords(): array
+    {
+        $warnings = [];
+        foreach ($this->pendingDnsAdoptions as $adoption) {
+            $record = ManagedDnsRecord::query()->find($adoption['record_id']);
+            if (! $record) {
+                continue;
+            }
+
+            try {
+                $adopted = app(CloudflareDnsProvider::class)->adoptRecord($record, $adoption['previous_comment']);
+            } catch (Throwable) {
+                $adopted = false;
+            }
+            if ($adopted) {
+                continue;
+            }
+
+            $record->forceFill(['owned' => false])->save();
+            $warnings[] = "DNS record {$record->name}: this instance could not take ownership; it will not change or delete it.";
+        }
+        $this->pendingDnsAdoptions = [];
+
+        return $warnings;
+    }
+
     /**
      * @param  list<array<string, mixed>>  $previews
      */
@@ -1531,6 +2247,8 @@ class ServerTransferImporter
                 'git_type' => data_get($previewPayload, 'git_type'),
                 'docker_compose_domains' => data_get($previewPayload, 'docker_compose_domains'),
                 'docker_registry_image_tag' => data_get($previewPayload, 'docker_registry_image_tag'),
+                'domain_port_overrides' => data_get($previewPayload, 'domain_port_overrides'),
+                'max_restart_count' => (int) data_get($previewPayload, 'max_restart_count', 0),
             ];
 
             if ($preview) {
@@ -1551,6 +2269,8 @@ class ServerTransferImporter
                 $preview->save();
             }
 
+            $this->previewMap[(string) data_get($previewPayload, 'uuid', $preview->uuid)] = $preview;
+
             // Avoid duplicating volumes when re-importing the same preview.
             if ($preview->wasRecentlyCreated || $preview->persistentStorages()->count() === 0) {
                 $this->importPersistentStorages(data_get($previewPayload, 'persistent_storages', []), $preview);
@@ -1630,6 +2350,7 @@ class ServerTransferImporter
 
             $s3Ids = $this->importedBackupS3StorageIds($backupPayload);
             $s3Id = $s3Ids[0] ?? null;
+            $this->warnAboutMissingS3Storage($backupPayload, $s3Id, 'volume '.($volume->name ?? $volume->mount_path));
 
             $importedBackup = ScheduledVolumeBackup::create([
                 'uuid' => $uuid,
@@ -1649,6 +2370,7 @@ class ServerTransferImporter
                 'retention_days_s3' => data_get($backupPayload, 'retention_days_s3'),
                 'retention_max_storage_s3' => data_get($backupPayload, 'retention_max_storage_s3'),
                 'timeout' => data_get($backupPayload, 'timeout'),
+                'missing_backup_notification_days' => (int) data_get($backupPayload, 'missing_backup_notification_days', 0),
             ]);
             $importedBackup->syncS3Storages($s3Ids);
             $count++;
diff --git a/app/Services/ServerTransfer/ServerTransferMigrator.php b/app/Services/ServerTransfer/ServerTransferMigrator.php
index 1c2571e3d0..bb51b563f5 100644
--- a/app/Services/ServerTransfer/ServerTransferMigrator.php
+++ b/app/Services/ServerTransfer/ServerTransferMigrator.php
@@ -2,23 +2,402 @@
 
 namespace App\Services\ServerTransfer;
 
+use App\Enums\ApplicationDeploymentStatus;
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\User;
 use App\Rules\SafeWebhookUrl;
 use App\Services\Security\SensitiveDataRedactor;
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\QueryException;
 use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Validator;
+use Illuminate\Support\Sleep;
+use Illuminate\Support\Str;
 use RuntimeException;
 use Throwable;
 
 class ServerTransferMigrator
 {
+    /** Time the target gets for one import request. Its nginx can stop waiting earlier (99 s). */
+    public const IMPORT_TIMEOUT_SECONDS = 300;
+
+    /** How often and how long to ask the target for the result after the import request failed. */
+    public const STATUS_PROBE_ATTEMPTS = 20;
+
+    public const STATUS_PROBE_INTERVAL_SECONDS = 15;
+
+    public const STATUS_REQUEST_TIMEOUT_SECONDS = 15;
+
+    public const CHECK_TIMEOUT_SECONDS = 15;
+
+    /**
+     * Time the queued job gets. It must be longer than the import request and all status probes together,
+     * plus time for the export, so the worker does not stop the job after the target took the server.
+     */
+    public const MIGRATION_TIMEOUT_SECONDS = 1500;
+
+    /** Longer than the job timeout, so a running state older than this one is stale. */
+    public const STALE_MIGRATION_SECONDS = 1800;
+
     public function __construct(
         private ServerTransferExporter $exporter,
         private ServerTransferClaimer $claimer,
     ) {}
 
+    /** The UI shows this many of the latest log lines. */
+    public const MAX_LOG_ENTRIES = 100;
+
+    /**
+     * System-wide git sources that the target of the last precheck does not have.
+     *
+     * @var array{github: list<string>, gitlab: list<string>}
+     */
+    private array $missingSystemSources = ['github' => [], 'gitlab' => []];
+
+    /**
+     * Run the prechecks now, so the user sees problems at once, then run the transfer in a queued job.
+     * Every check writes a line to the transfer log; a failed check stops the transfer before it starts.
+     */
+    public function start(Server $server, string $targetUrl, string $targetToken): void
+    {
+        $targetUrl = $this->normalizeTargetUrl($targetUrl);
+        $token = $this->normalizeToken($targetToken);
+        if ($this->hasRunningMigration($server->fresh())) {
+            throw new RuntimeException('A transfer of this server is already running.');
+        }
+
+        $startedAt = now()->toIso8601String();
+        $log = [$this->logEntry("Running checks before the transfer to {$targetUrl}.")];
+        $checks = [
+            ...$this->migrationChecks($server),
+            $this->sshCheck($server),
+            ...$this->targetChecks($server, $targetUrl, $token),
+        ];
+        foreach ($checks as $check) {
+            $log[] = match ($check['ok']) {
+                true => ['at' => $check['at'], 'level' => 'success', 'message' => "OK: {$check['label']}."],
+                false => ['at' => $check['at'], 'level' => 'error', 'message' => "FAILED: {$check['label']}. {$check['message']}"],
+                null => ['at' => $check['at'], 'level' => 'warning', 'message' => "NOT CHECKED: {$check['label']}. {$check['message']}"],
+            };
+        }
+        foreach ([...$this->sharedProjectNotes($server), ...$this->systemSourceNotes($server)] as $note) {
+            $log[] = $this->logEntry($note);
+        }
+
+        $failed = array_values(array_filter($checks, fn (array $check) => $check['ok'] === false));
+        if ($failed !== []) {
+            $error = count($failed).' of '.count($checks).' checks failed: '.implode(' ', array_column($failed, 'message'));
+            $log[] = $this->logEntry('The transfer did not start, because '.count($failed).' check(s) failed. Fix them, then transfer again.', 'error');
+            DB::transaction(function () use ($server, $targetUrl, $startedAt, $error, $log) {
+                $this->writeMigration(Server::query()->lockForUpdate()->findOrFail($server->id), [
+                    'status' => 'failed',
+                    'phase' => 'checks',
+                    'target_url' => $targetUrl,
+                    'started_at' => $startedAt,
+                    'finished_at' => now()->toIso8601String(),
+                    'error' => $error,
+                    'log' => $log,
+                ]);
+            });
+
+            throw new RuntimeException($error);
+        }
+
+        $log[] = $this->logEntry('All checks passed. The transfer is queued.');
+        DB::transaction(function () use ($server, $targetUrl, $startedAt, $log) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($server->id);
+            if ($this->hasRunningMigration($locked)) {
+                throw new RuntimeException('A transfer of this server is already running.');
+            }
+            $this->writeMigration($locked, [
+                'status' => 'running',
+                'target_url' => $targetUrl,
+                'started_at' => $startedAt,
+                'log' => $log,
+            ]);
+        });
+
+        MigrateServerToInstanceJob::dispatch($server, $targetUrl, $token);
+    }
+
+    /**
+     * Save the state of the queued transfer on the source server, so the UI and the API can show it.
+     *
+     * @param  array<string, mixed>  $details
+     */
+    public function recordMigration(Server $server, string $status, array $details = []): void
+    {
+        $entry = match ($status) {
+            'succeeded' => $this->logEntry('Transfer finished. The target instance manages the server now.', 'success'),
+            'unknown' => $this->logEntry('Transfer result unknown: '.data_get($details, 'error', 'unknown error'), 'warning'),
+            default => $this->logEntry('Transfer failed: '.data_get($details, 'error', 'unknown error'), 'error'),
+        };
+
+        DB::transaction(function () use ($server, $status, $details, $entry) {
+            $locked = Server::query()->lockForUpdate()->find($server->id);
+            if (! $locked) {
+                return;
+            }
+            $migration = array_merge((array) data_get($locked->server_metadata, 'migration', []), $details, [
+                'status' => $status,
+                'finished_at' => now()->toIso8601String(),
+            ]);
+            $migration['log'] = $this->appendToLog((array) data_get($migration, 'log', []), $entry);
+            $this->writeMigration($locked, $migration);
+        });
+    }
+
+    /**
+     * Record the result of a transfer job that the worker stopped, for example at its timeout. When the export
+     * was already sent, ask the target once, because the target can manage the server already.
+     */
+    public function recordStoppedMigration(Server $server, string $targetUrl, string $targetToken, string $error): void
+    {
+        $exportId = data_get($server->fresh()?->server_metadata, 'migration.export_id');
+        if (! is_string($exportId)) {
+            $this->recordMigration($server, 'failed', ['error' => $error]);
+
+            return;
+        }
+
+        $targetUrl = $this->normalizeTargetUrl($targetUrl);
+        $status = $this->targetTransferStatus($targetUrl, $this->normalizeToken($targetToken), $server->uuid, $exportId);
+
+        if ($status === 'claimed') {
+            try {
+                $this->claimer->markTransferred($server, exportId: $exportId, targetInstanceUrl: $targetUrl);
+                $this->recordMigration($server, 'succeeded', [
+                    'warnings' => ['The transfer job stopped before it finished. The target status confirms that the target manages the server.'],
+                ]);
+            } catch (Throwable) {
+                $this->recordMigration($server, 'unknown', [
+                    'error' => "{$error} The target manages the server, but this instance could not mark it as transferred. Call POST /api/v1/servers/{$server->uuid}/transfer/complete on this instance.",
+                ]);
+            }
+
+            return;
+        }
+
+        // The target answered that it does not manage this export, so this instance still manages the server.
+        if (in_array($status, ['imported', 'absent'], true)) {
+            $this->recordMigration($server, 'failed', ['error' => $error]);
+
+            return;
+        }
+
+        $this->recordMigration($server, 'unknown', [
+            'error' => "{$error} This instance could not ask {$targetUrl} whether it imported the server. ".
+                "Check the server on the target. If the target manages it, call POST /api/v1/servers/{$server->uuid}/transfer/complete on this instance. ".
+                'If not, transfer again.',
+        ]);
+    }
+
+    /**
+     * Add one line to the transfer log, so the UI can show where the transfer is.
+     *
+     * @param  array<string, mixed>  $fields  values to save in the transfer state with the line
+     */
+    public function log(Server $server, string $message, string $level = 'info', array $fields = []): void
+    {
+        $entry = $this->logEntry($message, $level);
+
+        DB::transaction(function () use ($server, $entry, $fields) {
+            $locked = Server::query()->lockForUpdate()->find($server->id);
+            if (! $locked) {
+                return;
+            }
+            $migration = array_merge((array) data_get($locked->server_metadata, 'migration', []), $fields);
+            $migration['log'] = $this->appendToLog((array) data_get($migration, 'log', []), $entry);
+            $this->writeMigration($locked, $migration);
+        });
+    }
+
+    /**
+     * @return array{at: string, level: string, message: string}
+     */
+    private function logEntry(string $message, string $level = 'info'): array
+    {
+        return ['at' => now()->toIso8601String(), 'level' => $level, 'message' => $message];
+    }
+
+    /**
+     * @param  list<array<string, string>>  $log
+     * @param  array<string, string>  $entry
+     * @return list<array<string, string>>
+     */
+    private function appendToLog(array $log, array $entry): array
+    {
+        return array_slice([...$log, $entry], -self::MAX_LOG_ENTRIES);
+    }
+
+    /**
+     * @return array{label: string, ok: bool|null, message: string|null, at: string}
+     */
+    private function check(string $label, ?bool $ok, ?string $message = null): array
+    {
+        return ['label' => $label, 'ok' => $ok, 'message' => $message, 'at' => now()->toIso8601String()];
+    }
+
+    /**
+     * @return array{label: string, ok: bool|null, message: string|null, at: string}
+     */
+    private function sshCheck(Server $server): array
+    {
+        ['uptime' => $reachable, 'error' => $error] = $server->validateConnection();
+
+        return $this->check(
+            'this instance can connect to the server over SSH',
+            (bool) $reachable,
+            $reachable ? null : 'This instance cannot connect to the server over SSH: '.rtrim($error ?: 'unknown error', '. ').'. Fix the connection, then transfer again.',
+        );
+    }
+
+    /**
+     * A running state older than the job can run is left over from a stopped worker, so it does not block a new start.
+     */
+    private function hasRunningMigration(Server $server): bool
+    {
+        $startedAt = data_get($server->server_metadata, 'migration.started_at');
+
+        return data_get($server->server_metadata, 'migration.status') === 'running'
+            && is_string($startedAt)
+            && Carbon::parse($startedAt)->gt(now()->subSeconds(self::STALE_MIGRATION_SECONDS));
+    }
+
+    /**
+     * @param  array<string, mixed>  $migration
+     */
+    private function writeMigration(Server $server, array $migration): void
+    {
+        $metadata = $server->server_metadata ?? [];
+        $metadata['migration'] = $migration;
+        $server->server_metadata = $metadata;
+        $server->save();
+    }
+
+    /**
+     * @return list<array{label: string, ok: bool|null, message: string|null, at: string}>
+     */
+    private function migrationChecks(Server $server): array
+    {
+        $activeDeployments = ApplicationDeploymentQueue::query()
+            ->where('server_id', $server->id)
+            ->whereIn('status', [ApplicationDeploymentStatus::QUEUED->value, ApplicationDeploymentStatus::IN_PROGRESS->value])
+            ->count();
+
+        return [
+            $this->check('the server is not the Coolify host', $server->id !== 0,
+                'The Coolify host (localhost) cannot be transferred between instances.'),
+            $this->check('this instance manages the server', ! $server->isTransferredAway(),
+                'This server was already transferred to another instance.'),
+            $this->check('no deployment is queued or running on the server', $activeDeployments === 0,
+                "{$activeDeployments} deployment(s) on this server are queued or running. Wait until they finish or cancel them, then transfer the server."),
+        ];
+    }
+
+    /**
+     * System-wide git sources are not transferred: an application re-links only to one with the same uuid on the
+     * target. One note per source that the target does not have, with the applications that lose their source.
+     *
+     * @return list<string>
+     */
+    private function systemSourceNotes(Server $server): array
+    {
+        $notes = [];
+        foreach ($this->systemSources($server) as $kind => $sources) {
+            foreach ($sources as $uuid => $source) {
+                if (in_array($uuid, $this->missingSystemSources[$kind], true)) {
+                    $label = $kind === 'github' ? 'GitHub App' : 'GitLab App';
+                    $notes[] = "NOTE: the system-wide {$label} '{$source['name']}' of this instance is not transferred, and the target has no matching one. "
+                        .'These applications need a new git source on the target: '.implode(', ', $source['applications']).'. The finish list on the target shows them.';
+                }
+            }
+        }
+
+        return $notes;
+    }
+
+    /**
+     * @return array{github: array<string, array{name: string, applications: list<string>}>, gitlab: array<string, array{name: string, applications: list<string>}>}
+     */
+    private function systemSources(Server $server): array
+    {
+        $sources = ['github' => [], 'gitlab' => []];
+        foreach ($server->applications()->unique('id') as $application) {
+            $source = $application->source;
+            $kind = match (true) {
+                $source instanceof GithubApp => 'github',
+                $source instanceof GitlabApp => 'gitlab',
+                default => null,
+            };
+            if ($kind === null || ! $source->is_system_wide) {
+                continue;
+            }
+            $sources[$kind][$source->uuid]['name'] = $source->name;
+            $sources[$kind][$source->uuid]['applications'][] = $application->name;
+        }
+
+        return $sources;
+    }
+
+    /**
+     * One note for every project that has resources on this server and on other servers. Only the
+     * resources of this server are transferred, so the user must know that the project is split.
+     *
+     * @return list<string>
+     */
+    private function sharedProjectNotes(Server $server): array
+    {
+        $resourcesOnServer = collect([
+            ...$server->applications(),
+            ...$server->databases(),
+            ...$server->services()->get(),
+        ]);
+        $keysOnServer = $resourcesOnServer->map(fn (Model $resource) => $resource::class.':'.$resource->getKey())->flip();
+
+        $projectIds = Environment::query()
+            ->whereIn('id', $resourcesOnServer->pluck('environment_id')->filter()->unique())
+            ->distinct()
+            ->pluck('project_id');
+        $projectIdByEnvironment = Environment::query()->whereIn('project_id', $projectIds)->pluck('project_id', 'id');
+
+        $otherServerCounts = collect([Application::class, Service::class, ...array_values(STANDALONE_DATABASE_MODELS)])
+            ->flatMap(fn (string $model) => $model::query()
+                ->whereIn('environment_id', $projectIdByEnvironment->keys())
+                ->pluck('environment_id', 'id')
+                ->reject(fn (int|string $environmentId, int|string $id) => $keysOnServer->has("{$model}:{$id}")))
+            ->countBy(fn (int|string $environmentId) => $projectIdByEnvironment[$environmentId]);
+
+        return Project::query()
+            ->whereIn('id', $otherServerCounts->keys())
+            ->orderBy('name')
+            ->get(['id', 'name'])
+            ->map(fn (Project $project) => "NOTE: project '{$project->name}' also has {$otherServerCounts[$project->id]} ".
+                Str::plural('resource', $otherServerCounts[$project->id]).' on other servers. They stay on this instance; only the resources of this server are transferred.')
+            ->all();
+    }
+
+    private function assertCanMigrate(Server $server): void
+    {
+        foreach ($this->migrationChecks($server) as $check) {
+            if (! $check['ok']) {
+                throw new RuntimeException($check['message']);
+            }
+        }
+    }
+
     /**
      * One-shot migrate: export on this instance → import+claim on target → complete on this instance.
      *
@@ -29,37 +408,41 @@ class ServerTransferMigrator
      *     import: array<string, mixed>,
      *     complete: array<string, mixed>,
      *     warnings: list<string>,
+     *     checklist: list<string>,
      *     message: string
      * }
      */
-    public function migrate(
-        Server $server,
-        string $targetUrl,
-        string $targetToken,
-        bool $preserveUuids = true,
-        bool $adoptMode = true,
-    ): array {
-        if ($server->id === 0) {
-            throw new RuntimeException('The Coolify host (localhost) cannot be transferred between instances.');
-        }
+    public function migrate(Server $server, string $targetUrl, string $targetToken): array
+    {
+        $server->refresh();
+        $this->assertCanMigrate($server);
 
         $targetUrl = $this->normalizeTargetUrl($targetUrl);
         $token = $this->normalizeToken($targetToken);
 
+        $this->log($server, 'Exporting the server configuration and its resources.');
         $bundle = $this->exporter->export($server, includeSensitive: true);
         $exportId = data_get($bundle, 'export_id');
         $warnings = array_values((array) data_get($bundle, 'warnings', []));
+        $checklist = $this->postTransferChecklist($bundle, $targetUrl);
+        // A job that the worker stops after this line reads the export ID to ask the target for the result.
+        $this->log($server, "Export {$exportId} created. Sending it to {$targetUrl}. The target imports the server and takes over management.", fields: ['export_id' => $exportId]);
 
         // Target import+claim runs in its own DB transaction on the remote instance.
         // Source DB is unchanged until markTransferred below — so a failed remote import leaves source intact.
         $importBody = $this->postImportToTarget(
+            server: $server,
             targetUrl: $targetUrl,
             token: $token,
             bundle: $bundle,
-            preserveUuids: $preserveUuids,
-            adoptMode: $adoptMode,
         );
 
+        // The target fills in its own public URL; the URL typed here can be an internal address.
+        $targetChecklist = array_values(array_filter((array) data_get($importBody, 'checklist', []), 'is_string'));
+        if ($targetChecklist !== []) {
+            $checklist = $targetChecklist;
+        }
+
         if (is_array(data_get($importBody, 'warnings'))) {
             $warnings = array_values(array_unique(array_merge($warnings, $importBody['warnings'])));
         }
@@ -68,13 +451,15 @@ class ServerTransferMigrator
         if (data_get($importBody, 'claimed') !== true) {
             throw new RuntimeException(
                 "Server was imported on {$targetUrl}, but the target could not take management of it. ".
-                'This instance still manages the server. Fix the problem on the target, click Enable management there, then click Disable management here. '.
+                'This instance still manages the server. Delete the imported server on the target, fix the problem, then transfer again. '.
                 'Target warnings: '.(implode(' ', (array) data_get($importBody, 'warnings', [])) ?: 'none')
             );
         }
 
+        $this->log($server, 'The target imported the server and manages it now. Disabling management on this instance.', 'success');
+
         // Cross-instance 2PC is impossible: if complete fails after a successful import, the target
-        // already owns the server. Surface that clearly so the operator can disable management here.
+        // already owns the server. Surface that clearly so the operator can complete the transfer here.
         try {
             $complete = $this->claimer->markTransferred(
                 $server,
@@ -86,7 +471,7 @@ class ServerTransferMigrator
             $reason = $e instanceof QueryException ? 'a database error occurred' : remove_iip($e->getMessage());
             throw new RuntimeException(
                 "Server was imported on {$targetUrl}, but this instance could not mark it as transferred: {$reason}. ".
-                'Disable management of this server here (or API: POST /api/v1/servers/{uuid}/transfer/complete) so automations stay disabled. Do not re-import on the target.',
+                'Call POST /api/v1/servers/{uuid}/transfer/complete on this instance so automations stay disabled here. Do not re-import on the target.',
                 previous: $e
             );
         }
@@ -98,10 +483,77 @@ class ServerTransferMigrator
             'import' => app(SensitiveDataRedactor::class)->redactValue($importBody),
             'complete' => $complete,
             'warnings' => $warnings,
+            'checklist' => $checklist,
+            'target_server_url' => is_string(data_get($importBody, 'server_url')) ? data_get($importBody, 'server_url') : null,
             'message' => 'Server migrated to '.$targetUrl.'. Automations disabled on this instance.',
         ];
     }
 
+    /**
+     * Manual steps the user must do after the transfer. The exporter writes {target_url} where the URL of the target belongs.
+     *
+     * @param  array<string, mixed>  $bundle
+     * @return list<string>
+     */
+    private function postTransferChecklist(array $bundle, string $targetUrl): array
+    {
+        $steps = array_filter((array) data_get($bundle, 'post_transfer_checklist', []), 'is_string');
+
+        return array_values(array_unique(array_map(
+            fn (string $step) => str_replace('{target_url}', $targetUrl, $step),
+            $steps,
+        )));
+    }
+
+    /**
+     * Undo a transfer: ask the instance that manages the server now to transfer it back to this instance. That
+     * instance runs its prechecks at once and then a normal transfer; the import here replaces the archive.
+     * This instance creates a short-lived token for the import, scoped to the team of the archive.
+     */
+    public function requestTransferBack(Server $archive, User $user, string $managerUrl, string $managerToken, string $thisInstanceUrl): void
+    {
+        if (! $archive->isTransferredAway()) {
+            throw new RuntimeException('Only a server that was transferred to another instance can be transferred back.');
+        }
+
+        $managerUrl = $this->normalizeTargetUrl($managerUrl);
+        $managerToken = $this->normalizeToken($managerToken);
+        $thisInstanceUrl = rtrim(trim($thisInstanceUrl), '/');
+        if (! filter_var($thisInstanceUrl, FILTER_VALIDATE_URL)) {
+            throw new RuntimeException('Enter the URL at which the other instance reaches this instance.');
+        }
+
+        $importToken = $user->createToken("transfer back {$archive->uuid}", ['read', 'write'], now()->addHours(3), $archive->team_id);
+        $migrateUrl = $managerUrl.'/api/v1/servers/'.rawurlencode($archive->uuid).'/migrate';
+
+        try {
+            $response = $this->targetRequest($migrateUrl, $managerToken, self::CHECK_TIMEOUT_SECONDS * 4)
+                ->post($migrateUrl, ['target_url' => $thisInstanceUrl, 'target_token' => $importToken->plainTextToken]);
+        } catch (ConnectionException $e) {
+            $importToken->accessToken->delete();
+            throw new RuntimeException('This instance cannot reach '.remove_iip($managerUrl).': '.remove_iip($e->getMessage()), previous: $e);
+        }
+
+        if ($response->status() !== 202) {
+            $importToken->accessToken->delete();
+            $message = remove_iip((string) (data_get($response->json(), 'message') ?: 'no details'));
+            throw new RuntimeException(match ($response->status()) {
+                401 => 'The other instance does not accept the API token.',
+                403 => 'The API token of the other instance needs root, or read:sensitive and write, from an admin or owner. '.$message,
+                404 => 'The other instance does not know this server, or does not support transfers. '.$message,
+                default => "The other instance did not start the transfer back (HTTP {$response->status()}): {$message}",
+            });
+        }
+
+        DB::transaction(function () use ($archive, $managerUrl) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($archive->id);
+            $metadata = $locked->server_metadata ?? [];
+            $metadata['transfer']['transfer_back'] = ['requested_at' => now()->toIso8601String(), 'from' => $managerUrl];
+            $locked->server_metadata = $metadata;
+            $locked->save();
+        });
+    }
+
     private function normalizeTargetUrl(string $targetUrl): string
     {
         $targetUrl = rtrim(trim($targetUrl), '/');
@@ -121,6 +573,10 @@ class ServerTransferMigrator
             return $targetUrl;
         }
 
+        if (strtolower((string) parse_url($targetUrl, PHP_URL_SCHEME)) !== 'https') {
+            throw new RuntimeException('The target instance URL must use https, because the transfer sends credentials.');
+        }
+
         Validator::make(['target_url' => $targetUrl], [
             'target_url' => ['required', new SafeWebhookUrl],
         ])->validate();
@@ -152,31 +608,21 @@ class ServerTransferMigrator
      * @param  array<string, mixed>  $bundle
      * @return array<string, mixed>
      */
-    private function postImportToTarget(
-        string $targetUrl,
-        string $token,
-        array $bundle,
-        bool $preserveUuids,
-        bool $adoptMode,
-    ): array {
+    private function postImportToTarget(Server $server, string $targetUrl, string $token, array $bundle): array
+    {
         $importUrl = $targetUrl.'/api/v1/servers/import';
 
         try {
-            $response = Http::timeout(120)
-                ->withOptions($this->isLocalDevelopmentTarget($importUrl)
-                    ? ['allow_redirects' => false]
-                    : SafeWebhookUrl::httpClientOptions($importUrl))
-                ->acceptJson()
-                ->withToken($token)
-                ->asJson()
+            $response = $this->targetRequest($importUrl, $token, self::IMPORT_TIMEOUT_SECONDS)
                 ->post($importUrl, [
                     'bundle' => $bundle,
                     'dry_run' => false,
-                    'preserve_uuids' => $preserveUuids,
-                    'adopt_mode' => $adoptMode,
+                    'preserve_uuids' => true,
+                    'adopt_mode' => true,
                 ]);
         } catch (ConnectionException $e) {
-            throw new RuntimeException('Could not reach target instance at '.remove_iip($importUrl).': '.remove_iip($e->getMessage()), previous: $e);
+            return $this->resultFromTargetStatus($server, $targetUrl, $token, $bundle, 'the request could not reach the target or timed out')
+                ?? throw new RuntimeException('Could not reach target instance at '.remove_iip($importUrl).': '.remove_iip($e->getMessage()), previous: $e);
         } catch (Throwable $e) {
             throw new RuntimeException('Transfer to target failed: '.remove_iip($e->getMessage()), previous: $e);
         }
@@ -186,6 +632,18 @@ class ServerTransferMigrator
             $importBody = ['raw' => remove_iip($response->body())];
         }
 
+        if ($response->status() === 404) {
+            throw new RuntimeException('The target instance does not support server transfer. Upgrade it to Coolify '.config('constants.coolify.version').' or newer.');
+        }
+
+        // A proxy timeout (502/504) or a server error does not mean that the import failed: the target can still finish it.
+        if ($response->serverError()) {
+            $result = $this->resultFromTargetStatus($server, $targetUrl, $token, $bundle, "the target answered with HTTP {$response->status()}");
+            if ($result !== null) {
+                return $result;
+            }
+        }
+
         if (! $response->successful()) {
             $message = data_get($importBody, 'message')
                 ?? data_get($importBody, 'errors')
@@ -198,4 +656,155 @@ class ServerTransferMigrator
 
         return $importBody;
     }
+
+    /**
+     * Ask the target whether it accepts the token and can import this server, so a wrong token or a
+     * conflict on the target fails before the transfer starts instead of in the queued job. When a
+     * check fails that the target checks depend on, those checks are reported as not checked.
+     *
+     * @return list<array{label: string, ok: bool|null, message: string|null, at: string}>
+     */
+    private function targetChecks(Server $server, string $targetUrl, string $token): array
+    {
+        $checkUrl = $targetUrl.'/api/v1/servers/import/check';
+        $reachLabel = 'the target instance at '.remove_iip($targetUrl).' can be reached';
+        $notChecked = fn (string $label) => $this->check('the checks on the target instance', null, "They did not run, because \"{$label}\" failed.");
+
+        $systemSources = $this->systemSources($server);
+        $this->missingSystemSources = ['github' => [], 'gitlab' => []];
+        try {
+            $response = $this->targetRequest($checkUrl, $token, self::CHECK_TIMEOUT_SECONDS)
+                ->get($checkUrl, [
+                    'server_uuid' => $server->uuid,
+                    'ip' => $server->ip,
+                    'port' => $server->port,
+                    'schema_version' => ServerTransferBundle::SCHEMA_VERSION,
+                    'system_github_apps' => array_keys($systemSources['github']),
+                    'system_gitlab_apps' => array_keys($systemSources['gitlab']),
+                ]);
+        } catch (ConnectionException $e) {
+            return [
+                $this->check($reachLabel, false, 'This instance cannot reach the target instance: '.remove_iip($e->getMessage())),
+                $notChecked($reachLabel),
+            ];
+        }
+
+        $checks = [$this->check($reachLabel, true)];
+        $status = $response->status();
+        $message = remove_iip((string) (data_get($response->json(), 'message') ?: 'no details'));
+
+        // An unknown route answers 404 before the token is checked, so this check comes first.
+        $gates = [
+            [404, 'the target instance supports server transfer', 'The target instance does not support server transfer. Upgrade it to Coolify '.config('constants.coolify.version').' or newer.'],
+            [401, 'the target instance accepts the API token', 'The target instance does not accept the API token. Create a new token on the target instance and paste it here.'],
+            [403, 'the API token can create servers on the target instance', 'Use a token with the write permission from an admin or owner. Target response: '.$message],
+        ];
+        foreach ($gates as [$failStatus, $label, $failMessage]) {
+            if ($status === $failStatus) {
+                return [...$checks, $this->check($label, false, $failMessage), $notChecked($label)];
+            }
+            $checks[] = $this->check($label, true);
+        }
+
+        foreach (['github', 'gitlab'] as $kind) {
+            $this->missingSystemSources[$kind] = array_values(array_filter((array) data_get($response->json(), "missing_system_sources.{$kind}", []), 'is_string'));
+        }
+
+        $remoteChecks = data_get($response->json(), 'checks');
+        if (! in_array($status, [200, 422], true) || ! is_array($remoteChecks)) {
+            return [...$checks, $this->check('the target instance answered the checks', false, "The target instance answered with HTTP {$status}: {$message}")];
+        }
+
+        foreach ($remoteChecks as $remoteCheck) {
+            $checks[] = $this->check(
+                'on the target: '.data_get($remoteCheck, 'label', 'unknown check'),
+                (bool) data_get($remoteCheck, 'ok'),
+                is_string(data_get($remoteCheck, 'message')) ? remove_iip(data_get($remoteCheck, 'message')) : null,
+            );
+        }
+
+        return $checks;
+    }
+
+    /**
+     * Ask the target whether it imported this export. Returns null when the target does not know it.
+     *
+     * @param  array<string, mixed>  $bundle
+     * @return array<string, mixed>|null
+     */
+    private function resultFromTargetStatus(Server $server, string $targetUrl, string $token, array $bundle, string $reason): ?array
+    {
+        $serverUuid = (string) data_get($bundle, 'server.uuid');
+        $exportId = (string) data_get($bundle, 'export_id');
+
+        $this->log($server, "The import request did not finish ({$reason}). The target can still finish the import, so this instance asks the target for the result.", 'warning');
+
+        for ($attempt = 1; $attempt <= self::STATUS_PROBE_ATTEMPTS; $attempt++) {
+            Sleep::for(self::STATUS_PROBE_INTERVAL_SECONDS)->seconds();
+            $this->log($server, "Asking the target for the import result (attempt {$attempt} of ".self::STATUS_PROBE_ATTEMPTS.').');
+
+            $status = $this->targetTransferStatus($targetUrl, $token, $serverUuid, $exportId);
+
+            // A rejected token stays rejected, so more attempts cannot confirm the import.
+            if ($status === 'rejected') {
+                return null;
+            }
+
+            if (in_array($status, ['claimed', 'imported'], true)) {
+                return [
+                    'server_uuid' => $serverUuid,
+                    'export_id' => $exportId,
+                    'claimed' => $status === 'claimed',
+                    'warnings' => ['The import request to the target timed out. The target status confirms the import.'],
+                ];
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Ask the target once what it knows about this export: 'claimed' or 'imported', 'absent' when the target
+     * does not have it, 'rejected' when the target rejects the token, or 'unknown' when there is no clear answer.
+     *
+     * @return 'claimed'|'imported'|'absent'|'rejected'|'unknown'
+     */
+    private function targetTransferStatus(string $targetUrl, string $token, string $serverUuid, string $exportId): string
+    {
+        $statusUrl = $targetUrl.'/api/v1/servers/'.rawurlencode($serverUuid).'/transfer';
+
+        try {
+            $response = $this->targetRequest($statusUrl, $token, self::STATUS_REQUEST_TIMEOUT_SECONDS)->get($statusUrl);
+        } catch (Throwable) {
+            return 'unknown';
+        }
+
+        if (in_array($response->status(), [401, 403], true)) {
+            return 'rejected';
+        }
+        if ($response->status() === 404) {
+            return 'absent';
+        }
+        if (! $response->successful()) {
+            return 'unknown';
+        }
+        if (data_get($response->json(), 'transfer.export_id') !== $exportId) {
+            return 'absent';
+        }
+
+        $status = data_get($response->json(), 'transfer.status');
+
+        return in_array($status, ['claimed', 'imported'], true) ? $status : 'unknown';
+    }
+
+    private function targetRequest(string $url, string $token, int $timeout): PendingRequest
+    {
+        return Http::timeout($timeout)
+            ->withOptions($this->isLocalDevelopmentTarget($url)
+                ? ['allow_redirects' => false]
+                : SafeWebhookUrl::httpClientOptions($url))
+            ->acceptJson()
+            ->withToken($token)
+            ->asJson();
+    }
 }
diff --git a/app/Services/ServerTransfer/TransferFinishChecklist.php b/app/Services/ServerTransfer/TransferFinishChecklist.php
new file mode 100644
index 0000000000..ee8d93dd79
--- /dev/null
+++ b/app/Services/ServerTransfer/TransferFinishChecklist.php
@@ -0,0 +1,581 @@
+<?php
+
+namespace App\Services\ServerTransfer;
+
+use App\Events\TransferFinishChanged;
+use App\Jobs\CheckTransferFinishStepsJob;
+use App\Models\Application;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\ManagedDnsRecord;
+use App\Models\ManagedDnsRecordReference;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\ServiceApplication;
+use App\Models\User;
+use App\Services\Dns\CloudflareDnsProvider;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+use Throwable;
+
+/**
+ * The steps that finish a transfer on the instance that manages the server now: webhooks, DNS, Sentinel, backups,
+ * and runners. Coolify checks each step where it can, and fixes some. The list is saved in
+ * server_metadata.transfer.finish, so its state survives a reload and is the same for every user of the team.
+ *
+ * An item is {key, type, subject, label, status, hint, message, details, error, link, link_label, checked_at}. The hint
+ * says what to do; message is the short result of the last check; details are values to copy (URLs); error is the
+ * technical reason of the last check.
+ * Status: pending (not checked yet), ok, action (the user must do something), done (the user marked it), or
+ * unchecked (Coolify cannot check it).
+ */
+class TransferFinishChecklist
+{
+    public const OPEN_STATUSES = ['pending', 'action', 'unchecked'];
+
+    /** Open steps are checked again in the background when the last check is older than this. */
+    public const RECHECK_AFTER_SECONDS = 30;
+
+    /** @var array<string, string> */
+    public const GROUPS = [
+        'server' => 'Server',
+        'git' => 'Git and webhooks',
+        'dns' => 'Domains and DNS',
+    ];
+
+    private const GROUP_OF_TYPE = [
+        'server_connection' => 'server', 'sentinel' => 'server', 's3_storage' => 'server',
+        'github_app_webhook' => 'git', 'github_app_urls' => 'git', 'gitlab_webhook' => 'git', 'manual_webhook' => 'git',
+        'git_source' => 'git', 'github_runners' => 'git',
+        'dns_record' => 'dns', 'domain' => 'dns',
+    ];
+
+    /** Types that the user can only mark as done. */
+    private const MANUAL_TYPES = ['github_app_urls'];
+
+    /** Types that Coolify can fix with one click. */
+    private const FIX_LABELS = [
+        'github_app_webhook' => 'Set webhook URL',
+        'sentinel' => 'Restart Sentinel',
+        'dns_record' => 'Take ownership',
+    ];
+
+    /**
+     * Build the list for a server that this instance manages now. It replaces an earlier list.
+     *
+     * @return list<array<string, mixed>>
+     */
+    public function start(Server $server): array
+    {
+        $items = $this->buildItems($server);
+        $this->save($server, [
+            'started_at' => now()->toIso8601String(),
+            'finished_at' => null,
+            'finished_by' => null,
+            'skipped' => [],
+            'items' => $items,
+        ]);
+
+        return $items;
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    public function of(Server $server): ?array
+    {
+        $finish = data_get($server->server_metadata, 'transfer.finish');
+
+        return is_array($finish) ? $finish : null;
+    }
+
+    public function isOpen(Server $server): bool
+    {
+        $finish = $this->of($server);
+
+        return $finish !== null && $finish['finished_at'] === null && ! $server->isTransferredAway();
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function openItems(Server $server): array
+    {
+        return array_values(array_filter((array) data_get($this->of($server), 'items', []), fn (array $item) => in_array($item['status'], self::OPEN_STATUSES, true)));
+    }
+
+    public function groupOf(array $item): string
+    {
+        return self::GROUP_OF_TYPE[$item['type']] ?? 'server';
+    }
+
+    /**
+     * Run the checks of the open steps in a queued job when the last run is older than RECHECK_AFTER_SECONDS.
+     */
+    public function checkWhenStale(Server $server): void
+    {
+        $finish = $this->of($server);
+        if (! $this->isOpen($server) || $this->openItems($server) === []) {
+            return;
+        }
+        $lastCheckedAt = data_get($finish, 'last_checked_at');
+        if (is_string($lastCheckedAt) && Carbon::parse($lastCheckedAt)->isAfter(now()->subSeconds(self::RECHECK_AFTER_SECONDS))) {
+            return;
+        }
+
+        CheckTransferFinishStepsJob::dispatch($server);
+    }
+
+    public function canCheck(array $item): bool
+    {
+        return ! in_array($item['type'], self::MANUAL_TYPES, true);
+    }
+
+    /**
+     * Where the user does the step. GitHub App links are built on each render, so lists saved before a rename of
+     * the App, or before the link existed, still point to the right page.
+     *
+     * @return array{0: string, 1: string}|null
+     */
+    public function linkOf(array $item): ?array
+    {
+        if (in_array($item['type'], ['github_app_webhook', 'github_app_urls'], true)) {
+            $githubApp = GithubApp::where('uuid', $item['subject'])->first();
+
+            return $githubApp ? [$githubApp->settingsUrl(), 'Open on GitHub'] : null;
+        }
+
+        return filled($item['link'] ?? null) ? [$item['link'], $item['link_label'] ?? 'Open'] : null;
+    }
+
+    public function fixLabel(array $item): ?string
+    {
+        return self::FIX_LABELS[$item['type']] ?? null;
+    }
+
+    public function check(Server $server, string $key): array
+    {
+        return $this->update($server, $key, fn (array $item) => $this->runCheck($server, $item));
+    }
+
+    public function checkAll(Server $server): void
+    {
+        foreach ($this->openItems($server) as $item) {
+            if ($this->canCheck($item)) {
+                $this->check($server, $item['key']);
+            }
+        }
+
+        $finish = (array) $this->of($server->fresh());
+        $finish['last_checked_at'] = now()->toIso8601String();
+        $this->save($server, $finish);
+    }
+
+    public function fix(Server $server, string $key): array
+    {
+        return $this->update($server, $key, function (array $item) use ($server) {
+            if ($this->fixLabel($item) === null) {
+                throw new RuntimeException('Coolify cannot fix this step. Do it by hand, then mark it as done.');
+            }
+            $this->runFix($server, $item);
+
+            // Sentinel restarts in the background, so a check now would always fail.
+            return $item['type'] === 'sentinel'
+                ? ['pending', 'Sentinel restarts. The step turns OK when Sentinel sends data.', null]
+                : $this->runCheck($server, $item);
+        });
+    }
+
+    public function markDone(Server $server, string $key): array
+    {
+        return $this->update($server, $key, fn (array $item) => ['done', 'Marked as done by '.(auth()->user()?->name ?? 'a user').'.', null]);
+    }
+
+    /**
+     * The user finished the transfer. Open steps are not checked again; they are kept in the list as skipped.
+     */
+    public function finish(Server $server, User $user): void
+    {
+        $finish = $this->of($server) ?? throw new RuntimeException('This server has no transfer to finish.');
+        $finish['finished_at'] = now()->toIso8601String();
+        $finish['finished_by'] = $user->id;
+        $finish['skipped'] = array_column($this->openItems($server), 'key');
+        $this->save($server, $finish);
+    }
+
+    /**
+     * Webhook controllers call this when a verified webhook arrives, so a check can see that the new URL works.
+     */
+    public static function recordWebhook(string $kind, ?string $uuid): void
+    {
+        if (filled($uuid)) {
+            Cache::put("transfer-finish:webhook:{$kind}:{$uuid}", now()->toIso8601String(), now()->addDays(60));
+        }
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    private function buildItems(Server $server): array
+    {
+        $applications = $server->applications()->unique('id')->values();
+        $serviceApplications = $server->services()->with('applications')->get()->flatMap->applications;
+        $runnerConfig = $server->githubRunnerConfig()->with('githubApp')->first();
+        $items = [
+            $this->item('server_connection', 'server', 'Connection to the server'),
+            $this->item('sentinel', 'server', 'Sentinel sends its data to this instance'),
+        ];
+
+        $githubApps = $applications->map(fn (Application $application) => $application->source)
+            ->push($runnerConfig?->githubApp)
+            ->filter(fn ($source) => $source instanceof GithubApp && ! $source->is_system_wide && ! $source->is_public)
+            ->unique('id');
+        foreach ($githubApps as $githubApp) {
+            $items[] = $this->item('github_app_webhook', $githubApp->uuid, "Webhook URL of GitHub App {$githubApp->name}",
+                'GitHub must send webhooks to this instance.', [['label' => 'Webhook URL', 'value' => $this->githubWebhookUrl()]]);
+            $items[] = $this->item('github_app_urls', $githubApp->uuid, "Setup and Callback URL of GitHub App {$githubApp->name}",
+                'Set both in the GitHub App settings. GitHub has no API for them.', [
+                    ['label' => 'Setup URL', 'value' => $this->instanceUrl().'/webhooks/source/github/install'],
+                    ['label' => 'Callback URL', 'value' => $this->instanceUrl().'/login/github/app'],
+                ]);
+        }
+
+        $gitlabApps = $applications->map(fn (Application $application) => $application->source)
+            ->filter(fn ($source) => $source instanceof GitlabApp && ! $source->is_system_wide)
+            ->unique('id');
+        foreach ($gitlabApps as $gitlabApp) {
+            $items[] = $this->item('gitlab_webhook', $gitlabApp->uuid, "GitLab webhooks of GitLab App {$gitlabApp->name}",
+                'Set the webhook URL in each GitLab project that uses it, then push once.',
+                [['label' => 'Webhook URL', 'value' => $this->instanceUrl().'/webhooks/source/gitlab/events']]);
+        }
+
+        // These applications get a git source step instead: their source is not on this instance.
+        $gitSourceApplications = (array) data_get($server->server_metadata, 'transfer.git_source_applications', []);
+        foreach ($applications as $application) {
+            // A Docker image application keeps a default git_repository, but it never deploys from git.
+            if (! in_array($application->uuid, $gitSourceApplications, true) && $application->build_pack !== 'dockerimage' && filled($application->git_repository) && (! $application->source || data_get($application->source, 'is_public') === true)) {
+                $items[] = $this->item('manual_webhook', $application->uuid, "Manual webhook of {$application->name}",
+                    'If the repository has a webhook to Coolify, change its URL, then push once.',
+                    array_map(fn (string $provider, string $label) => ['label' => $label, 'value' => "{$this->instanceUrl()}/webhooks/source/{$provider}/events/manual"],
+                        ['github', 'gitlab', 'bitbucket', 'gitea'], ['GitHub', 'GitLab', 'Bitbucket', 'Gitea']));
+            }
+        }
+
+        foreach ($this->dnsRecords($applications, $serviceApplications) as $record) {
+            $items[] = $this->item('dns_record', $record->uuid, "DNS record {$record->name}");
+        }
+
+        $hosts = $applications->flatMap(fn (Application $application) => $application->fqdns)
+            ->concat($serviceApplications->flatMap(fn (ServiceApplication $application) => explode(',', (string) $application->fqdn)))
+            ->map(fn ($url) => strtolower((string) parse_url(trim((string) $url), PHP_URL_HOST)))
+            ->filter()
+            ->unique();
+        foreach ($hosts as $host) {
+            $items[] = $this->item('domain', $host, "Domain {$host} points to the server");
+        }
+
+        foreach ($this->s3Storages($server) as $storage) {
+            $items[] = $this->item('s3_storage', $storage->uuid, "S3 storage {$storage->name} works from this instance");
+        }
+
+        if ($runnerConfig) {
+            $items[] = $this->item('github_runners', $runnerConfig->uuid, 'GitHub runners on this server',
+                'Disabled after the transfer. Enable them when the GitHub App sends its webhooks here.', [],
+                route('server.github-runners', ['server_uuid' => $server->uuid], false), 'Open runners');
+        }
+
+        // Links are relative: the list is built during the import request, whose host can be an internal one.
+        // The importer lists applications that used a system-wide git source, or a source that this instance lacks.
+        foreach ($applications->whereIn('uuid', $gitSourceApplications) as $application) {
+            $environment = $application->environment;
+            $items[] = $this->item('git_source', $application->uuid, "Git source of {$application->name}",
+                'System-wide git sources are not transferred. Select a source of this instance.', [],
+                $environment?->project ? route('project.application.source', [
+                    'project_uuid' => $environment->project->uuid,
+                    'environment_uuid' => $environment->uuid,
+                    'application_uuid' => $application->uuid,
+                ], false) : null, 'Open source');
+        }
+
+        return $items;
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null} status, short message, technical reason
+     */
+    private function runCheck(Server $server, array $item): array
+    {
+        $startedAt = Carbon::parse((string) data_get($this->of($server), 'started_at', now()->toIso8601String()));
+
+        return match ($item['type']) {
+            'server_connection' => ($result = $server->validateConnection())['uptime']
+                ? ['ok', 'This instance connects to the server over SSH.', null]
+                : ['action', 'This instance cannot connect to the server over SSH.', $result['error']],
+            'sentinel' => $server->sentinel_updated_at && Carbon::parse($server->sentinel_updated_at)->isAfter($startedAt)
+                ? ['ok', 'Sentinel sent data at '.Carbon::parse($server->sentinel_updated_at)->format('H:i').'.', null]
+                : ['action', 'No data from Sentinel since the transfer.', null],
+            'github_app_webhook' => $this->checkGithubAppWebhook($item['subject'], $startedAt),
+            'gitlab_webhook' => $this->checkWebhookReceipt('gitlab_app', $item['subject'], $startedAt),
+            'manual_webhook' => $this->checkWebhookReceipt('application', $item['subject'], $startedAt),
+            'dns_record' => $this->checkDnsRecord($item['subject']),
+            'domain' => $this->checkDomain($server, $item['subject']),
+            's3_storage' => $this->checkS3Storage($item['subject']),
+            'git_source' => $this->checkGitSource($item['subject']),
+            'github_runners' => $server->githubRunnerConfig()->value('is_enabled')
+                ? ['ok', 'GitHub runners are enabled.', null]
+                : ['action', 'Disabled after the transfer. Enable them when the GitHub App sends its webhooks here.', null],
+            default => throw new RuntimeException('Coolify cannot check this step. Do it by hand, then mark it as done.'),
+        };
+    }
+
+    private function runFix(Server $server, array $item): void
+    {
+        match ($item['type']) {
+            'github_app_webhook' => $this->githubAppRequest(GithubApp::where('uuid', $item['subject'])->firstOrFail(), 'patch', '/app/hook/config', ['url' => $this->githubWebhookUrl()]),
+            'sentinel' => $server->restartSentinel(),
+            'dns_record' => app(CloudflareDnsProvider::class)->reclaimRecord(ManagedDnsRecord::where('uuid', $item['subject'])->firstOrFail())
+                ? ManagedDnsRecord::where('uuid', $item['subject'])->update(['owned' => true])
+                : throw new RuntimeException('Coolify could not take ownership: the record changed at Cloudflare, or Cloudflare cannot be reached.'),
+        };
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkGithubAppWebhook(string $uuid, Carbon $startedAt): array
+    {
+        $githubApp = GithubApp::where('uuid', $uuid)->first();
+        if (! $githubApp) {
+            return ['unchecked', 'The GitHub App does not exist on this instance anymore.', null];
+        }
+
+        try {
+            $url = (string) data_get($this->githubAppRequest($githubApp, 'get', '/app/hook/config'), 'url');
+        } catch (Throwable $e) {
+            // Without the API, a webhook that arrives here still proves the URL.
+            [$status, $message] = $this->checkWebhookReceipt('github_app', $uuid, $startedAt);
+
+            return [$status, $status === 'ok' ? $message : 'GitHub cannot be asked with the App key. '.$message, $e->getMessage()];
+        }
+
+        return rtrim($url, '/') === $this->githubWebhookUrl()
+            ? ['ok', 'GitHub sends webhooks to this instance.', null]
+            : ['action', 'GitHub sends webhooks to another URL.', 'Current URL: '.($url ?: 'none')];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkWebhookReceipt(string $kind, string $uuid, Carbon $startedAt): array
+    {
+        $receivedAt = Cache::get("transfer-finish:webhook:{$kind}:{$uuid}");
+        if (is_string($receivedAt) && Carbon::parse($receivedAt)->isAfter($startedAt)) {
+            return ['ok', 'A webhook arrived at '.Carbon::parse($receivedAt)->format('H:i').'.', null];
+        }
+
+        return ['action', 'No webhook arrived since the transfer.', null];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkDnsRecord(string $uuid): array
+    {
+        $record = ManagedDnsRecord::where('uuid', $uuid)->first();
+        if (! $record) {
+            return ['unchecked', 'This instance does not track this record anymore.', null];
+        }
+        if ($record->owned && app(CloudflareDnsProvider::class)->reclaimRecord($record)) {
+            return ['ok', 'This instance manages the record at Cloudflare.', null];
+        }
+
+        return $record->owned
+            ? ['action', 'Cloudflare does not confirm the record.', 'The record changed at Cloudflare, or Cloudflare cannot be reached with the token.']
+            : ['action', 'This instance does not own the record yet.', 'Until it owns the record, this instance does not change or delete it.'];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkDomain(Server $server, string $host): array
+    {
+        $serverIps = filter_var($server->ip, FILTER_VALIDATE_IP) ? [$server->ip] : (gethostbynamel($server->ip) ?: []);
+        $records = @dns_get_record($host, DNS_A | DNS_AAAA) ?: [];
+        $ips = array_values(array_filter(array_map(fn (array $record) => $record['ip'] ?? $record['ipv6'] ?? null, $records)));
+        if ($ips === []) {
+            return ['action', 'The domain does not resolve.', null];
+        }
+        if (array_intersect($ips, $serverIps) !== []) {
+            return ['ok', 'The domain points to the server.', null];
+        }
+
+        return ['action', 'The domain points to another address.', 'Resolves to '.implode(', ', $ips).'; the server is '.implode(', ', $serverIps ?: [$server->ip]).'. If a proxy or load balancer is in front, mark it as done.'];
+    }
+
+    /**
+     * @return array{0: string, 1: string, 2: string|null}
+     */
+    private function checkS3Storage(string $uuid): array
+    {
+        $storage = S3Storage::where('uuid', $uuid)->first();
+        if (! $storage) {
+            return ['unchecked', 'The S3 storage does not exist on this instance anymore.', null];
+        }
+        try {
+            $storage->testConnection(shouldSave: true);
+        } catch (Throwable $e) {
+            return ['action', 'This instance cannot use the S3 storage.', $e->getMessage()];
+        }
+
+        return $storage->fresh()->is_usable ? ['ok', 'This instance can use the S3 storage.', null] : ['action', 'This instance cannot use the S3 storage.', null];
+    }
+
+    private function githubAppRequest(GithubApp $githubApp, string $method, string $path, array $data = []): array
+    {
+        $response = Http::GitSource($githubApp->api_url)
+            ->withHeaders(['Authorization' => 'Bearer '.generateGithubJwt($githubApp), 'Accept' => 'application/vnd.github+json'])
+            ->{$method}(rtrim($githubApp->api_url, '/').$path, $data);
+        if (! $response->successful()) {
+            throw new RuntimeException('GitHub answered with HTTP '.$response->status().': '.data_get($response->json(), 'message', 'no details'));
+        }
+
+        return (array) $response->json();
+    }
+
+    /**
+     * @param  Collection<int, Application>  $applications
+     * @param  Collection<int, ServiceApplication>  $serviceApplications
+     * @return Collection<int, ManagedDnsRecord>
+     */
+    private function dnsRecords(Collection $applications, Collection $serviceApplications): Collection
+    {
+        $ids = ManagedDnsRecordReference::query()
+            ->where(function ($query) use ($applications, $serviceApplications) {
+                $query->where(fn ($q) => $q->where('resource_type', (new Application)->getMorphClass())->whereIn('resource_id', $applications->pluck('id')))
+                    ->orWhere(fn ($q) => $q->where('resource_type', (new ServiceApplication)->getMorphClass())->whereIn('resource_id', $serviceApplications->pluck('id')));
+            })
+            ->pluck('managed_dns_record_id');
+
+        return ManagedDnsRecord::query()->whereIn('id', $ids)->orderBy('name')->get();
+    }
+
+    /**
+     * @return Collection<int, S3Storage>
+     */
+    private function s3Storages(Server $server): Collection
+    {
+        $ids = collect($server->databases())
+            ->flatMap(fn ($database) => method_exists($database, 'scheduledBackups') ? $database->scheduledBackups()->get() : [])
+            ->flatMap(fn ($backup) => [$backup->s3_storage_id, ...$backup->s3Storages()->pluck('s3_storages.id')->all()])
+            ->filter()
+            ->unique();
+
+        return S3Storage::query()->whereIn('id', $ids)->where('team_id', $server->team_id)->get();
+    }
+
+    /**
+     * @param  callable(array<string, mixed>): array{0: string, 1: string}  $change
+     * @return array<string, mixed>
+     */
+    private function update(Server $server, string $key, callable $change): array
+    {
+        $finish = $this->of($server) ?? throw new RuntimeException('This server has no transfer to finish.');
+        $index = array_search($key, array_column($finish['items'], 'key'), true);
+        if ($index === false) {
+            throw new RuntimeException('This step is not in the list.');
+        }
+
+        try {
+            [$status, $message, $error] = $change($finish['items'][$index]) + [2 => null];
+        } catch (Throwable $e) {
+            [$status, $message, $error] = ['action', 'Coolify could not do this step.', $e->getMessage()];
+        }
+
+        return DB::transaction(function () use ($server, $key, $status, $message, $error) {
+            $finish = (array) data_get(Server::query()->lockForUpdate()->findOrFail($server->id)->server_metadata, 'transfer.finish');
+            $index = array_search($key, array_column($finish['items'], 'key'), true);
+            $finish['items'][$index] = [...$finish['items'][$index], 'status' => $status, 'message' => $message, 'error' => $error, 'checked_at' => now()->toIso8601String()];
+            $this->save($server, $finish);
+
+            return $finish['items'][$index];
+        });
+    }
+
+    /**
+     * Writes only transfer.finish, on the current row: callers can hold an older copy of the server, for example
+     * from before the claim, and must not write its other metadata back.
+     */
+    private function save(Server $server, array $finish): void
+    {
+        DB::transaction(function () use ($server, $finish) {
+            $locked = Server::query()->lockForUpdate()->findOrFail($server->id);
+            $metadata = $locked->server_metadata ?? [];
+            $metadata['transfer']['finish'] = $finish;
+            $locked->server_metadata = $metadata;
+            $locked->save();
+            $server->server_metadata = $metadata;
+            $server->syncOriginalAttribute('server_metadata');
+        });
+        TransferFinishChanged::dispatch($server);
+    }
+
+    /**
+     * @return array{0: string, 1: string}
+     */
+    private function checkGitSource(string $applicationUuid): array
+    {
+        $application = Application::where('uuid', $applicationUuid)->first();
+        $source = $application?->source;
+        if (! $source instanceof GithubApp && ! $source instanceof GitlabApp) {
+            return ['action', 'No git source on this instance, so deployments from git fail.', null];
+        }
+        if ($source instanceof GithubApp && ! $source->is_public) {
+            try {
+                generateGithubInstallationToken($source);
+            } catch (Throwable $e) {
+                return ['action', "GitHub App {$source->name} cannot read the repository.", $e->getMessage()];
+            }
+        }
+
+        // Push webhooks of a system-wide App go to the instance where the App is registered.
+        return ['ok', "Uses {$source->name}.", $source->is_system_wide ? 'For push-to-deploy, use a manual webhook if the system-wide App is registered on another instance.' : null];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    /**
+     * @param  list<array{label: string, value: string}>  $details
+     */
+    private function item(string $type, string $subject, string $label, ?string $hint = null, array $details = [], ?string $link = null, ?string $linkLabel = null): array
+    {
+        return [
+            'key' => "{$type}:{$subject}",
+            'type' => $type,
+            'subject' => $subject,
+            'label' => $label,
+            'status' => 'pending',
+            'hint' => $hint,
+            'message' => null,
+            'details' => $details,
+            'error' => null,
+            'link' => $link,
+            'link_label' => $linkLabel,
+            'checked_at' => null,
+        ];
+    }
+
+    private function instanceUrl(): string
+    {
+        return rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
+    }
+
+    private function githubWebhookUrl(): string
+    {
+        return $this->instanceUrl().'/webhooks/source/github/events';
+    }
+}
diff --git a/app/Services/SharedVariableCanvas.php b/app/Services/SharedVariableCanvas.php
index 4e35da400a..775faa8a48 100644
--- a/app/Services/SharedVariableCanvas.php
+++ b/app/Services/SharedVariableCanvas.php
@@ -30,6 +30,12 @@ class SharedVariableCanvas
 
     public const RESOURCES_ZONE = 'resources';
 
+    /**
+     * Server variables that Coolify creates on every server. Resources get them only through a reference,
+     * but every server has them, so the canvas and the overview leave them out to stay readable.
+     */
+    public const BUILT_IN_SERVER_KEYS = ['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME'];
+
     public function __construct(private EnvironmentCanvas $canvas, private ServerCanvas $serverCanvas) {}
 
     /**
@@ -37,9 +43,14 @@ class SharedVariableCanvas
      */
     public function payload(string $scope, Model $owner, bool $canEdit): array
     {
-        $variables = $this->variables($owner);
+        $hidden = $scope === 'server' ? self::BUILT_IN_SERVER_KEYS : [];
+        $variables = $this->variables($owner)->reject(fn (SharedEnvironmentVariable $variable) => in_array($variable->key, $hidden, true))->values();
         $resources = $this->resources($scope, $owner);
-        $links = $this->links($scope, $variables, $resources);
+        // A reference to a hidden variable is not a reference to a deleted one: leave its link out too.
+        $links = collect($this->links($scope, $variables, $resources))
+            ->reject(fn (array $link) => in_array($link['key'], $hidden, true))
+            ->values()
+            ->all();
 
         $missing = collect($links)
             ->where('missing', true)
@@ -240,6 +251,81 @@ class SharedVariableCanvas
         return 'variable:'.$variable->id;
     }
 
+    /**
+     * The shared variables overview of a team: counts per scope, recently changed variables,
+     * and how many resources use each variable (from the {{scope.KEY}} references in the
+     * saved resource variables). Keys and counts only; values are never read out.
+     *
+     * @return array{scopes: array<string, array{variables: int, owners: int}>, recent: Collection<int, array<string, mixed>>, used: Collection<int, array<string, mixed>>, unused: Collection<int, array<string, mixed>>, missing: int}
+     */
+    public function overview(Team $team): array
+    {
+        $variables = SharedEnvironmentVariable::query()
+            ->where('team_id', $team->id)
+            ->with(['project', 'environment.project', 'server'])
+            ->get()
+            // Built-in server variables; the server variables page hides them too.
+            ->reject(fn (SharedEnvironmentVariable $variable) => $variable->type === 'server' && in_array($variable->key, self::BUILT_IN_SERVER_KEYS, true));
+
+        $scopes = collect(self::SCOPES)->mapWithKeys(function (string $scope) use ($variables) {
+            $ofScope = $variables->where('type', $scope);
+            $ownerColumn = $scope === 'team' ? 'team_id' : $scope.'_id';
+
+            return [$scope => ['variables' => $ofScope->count(), 'owners' => $ofScope->pluck($ownerColumn)->unique()->count()]];
+        })->all();
+
+        // Resources per variable: "scope|owner id|KEY" => resource uuids.
+        $idByReference = $variables->mapWithKeys(fn (SharedEnvironmentVariable $variable) => [
+            $variable->type.'|'.($variable->type === 'team' ? $variable->team_id : $variable->{$variable->type.'_id'}).'|'.$variable->key => $variable->id,
+        ]);
+        $resources = $this->resources('team', $team);
+        $resourceByMorph = $resources->mapWithKeys(fn (Model $resource) => [$resource->getMorphClass().'#'.$resource->getKey() => $resource]);
+        $usedBy = [];
+        $missing = [];
+        foreach ($this->resourceVariables($resources) as $environmentVariable) {
+            $resource = $resourceByMorph->get($environmentVariable->resourceable_type.'#'.$environmentVariable->resourceable_id);
+            $owners = [
+                'team' => $team->id,
+                'project' => $resource->environment->project_id,
+                'environment' => $resource->environment_id,
+                'server' => $this->mainServer($resource)?->id,
+            ];
+            foreach ($owners as $scope => $ownerId) {
+                foreach ($this->referencedKeys($scope, $environmentVariable->value) as $key) {
+                    $reference = $scope.'|'.$ownerId.'|'.$key;
+                    if ($idByReference->has($reference)) {
+                        $usedBy[$idByReference->get($reference)][$resource->uuid] = true;
+                    } else {
+                        $missing[$reference] = true;
+                    }
+                }
+            }
+        }
+
+        $rows = $variables->map(fn (SharedEnvironmentVariable $variable) => [
+            'key' => $variable->key,
+            'scope' => $variable->type,
+            'owner' => match ($variable->type) {
+                'team' => 'Team',
+                'project' => $variable->project?->name,
+                'environment' => $variable->environment ? $variable->environment->project?->name.' / '.$variable->environment->name : null,
+                'server' => $variable->server?->name,
+                default => null,
+            },
+            'link' => $this->connectLink($variable),
+            'resources' => count($usedBy[$variable->id] ?? []),
+            'updated_at' => $variable->updated_at,
+        ]);
+
+        return [
+            'scopes' => $scopes,
+            'recent' => $rows->sortByDesc('updated_at')->take(6)->values(),
+            'used' => $rows->where('resources', '>', 0)->sortByDesc('resources')->take(6)->values(),
+            'unused' => $rows->where('resources', 0)->sortBy('key')->values(),
+            'missing' => count($missing),
+        ];
+    }
+
     /**
      * The team of the scope owner.
      */
diff --git a/app/Services/TrafficAnalyticsAggregator.php b/app/Services/TrafficAnalyticsAggregator.php
index e58a78bc3b..66ef76432e 100644
--- a/app/Services/TrafficAnalyticsAggregator.php
+++ b/app/Services/TrafficAnalyticsAggregator.php
@@ -161,6 +161,12 @@ class TrafficAnalyticsAggregator
             $this->breakdowns[$dimension][$value] ??= ['value' => $value, 'requests' => 0, 'bytesOut' => 0];
             $this->breakdowns[$dimension][$value]['requests'] += (int) ($data['requests'] ?? 0);
             $this->breakdowns[$dimension][$value]['bytesOut'] += (int) ($data['bytesOut'] ?? 0);
+
+            // City rows carry coordinates; the first server that has them wins.
+            if (isset($data['lat'], $data['lon'])) {
+                $this->breakdowns[$dimension][$value]['lat'] ??= (float) $data['lat'];
+                $this->breakdowns[$dimension][$value]['lon'] ??= (float) $data['lon'];
+            }
         }
     }
 
@@ -205,7 +211,7 @@ class TrafficAnalyticsAggregator
     }
 
     /**
-     * @return array<string, array<int, array{value: string, requests: int, bytesOut: int}>>
+     * @return array<string, array<int, array{value: string, requests: int, bytesOut: int, lat?: float, lon?: float}>>
      */
     public function breakdowns(int $limit = 50): array
     {
diff --git a/app/Traits/ExecuteRemoteCommand.php b/app/Traits/ExecuteRemoteCommand.php
index 86ed88e9b8..21912fb82f 100644
--- a/app/Traits/ExecuteRemoteCommand.php
+++ b/app/Traits/ExecuteRemoteCommand.php
@@ -248,7 +248,22 @@ trait ExecuteRemoteCommand
 
         $error = $this->redact_sensitive_info($error);
 
-        return "Command execution failed (exit code {$exitCode}): {$commandText}\nError: {$error}";
+        return "Command execution failed (exit code {$exitCode}): {$commandText}\nError: {$error}".$this->dockerNetworkGatewayHint($error);
+    }
+
+    /**
+     * Docker Engine 27.0 to 28.0.0 reports an IPv6 network gateway with its prefix length (fd00::1/64) until the
+     * daemon restarts, and newer Docker CLI and Compose versions fail to parse it.
+     *
+     * @see https://github.com/moby/moby/pull/49520
+     */
+    private function dockerNetworkGatewayHint(string $error): string
+    {
+        if (! preg_match('~ParseAddr\("[0-9A-Fa-f:.]+/\d+"\)~', $error)) {
+            return '';
+        }
+
+        return "\nDocker Engine on this server reports a Docker network gateway with a prefix length, which is a Docker Engine bug fixed in 28.0.1. Run 'systemctl restart docker' on the server (this restarts all containers) or upgrade Docker Engine, then deploy again.";
     }
 
     /**
diff --git a/app/Traits/ExecutesDatabaseStartCommands.php b/app/Traits/ExecutesDatabaseStartCommands.php
index d61cfb3146..dadc4dd68c 100644
--- a/app/Traits/ExecutesDatabaseStartCommands.php
+++ b/app/Traits/ExecutesDatabaseStartCommands.php
@@ -27,4 +27,23 @@ trait ExecutesDatabaseStartCommands
     {
         return $environmentVariables->contains(fn ($variable) => str($variable)->before('=')->value() === $key);
     }
+
+    /**
+     * Adds the Coolify variables that applications and services also get. A key that the user
+     * defines wins.
+     *
+     * @param  Collection<int, string>  $environmentVariables
+     */
+    private function addCoolifyEnvironmentVariables(Collection $environmentVariables): void
+    {
+        $definedKeys = $environmentVariables->map(fn ($variable) => str($variable)->before('=')->value());
+        $coolifyVariables = collect([
+            'COOLIFY_RESOURCE_UUID' => $this->database->uuid,
+            'COOLIFY_CONTAINER_NAME' => $this->database->uuid,
+        ])->except($definedKeys->all())->merge(coolifyDefaultEnvironmentVariables($this->database, $definedKeys));
+
+        foreach ($coolifyVariables as $key => $value) {
+            $environmentVariables->push($key.'='.escapeDollarSign($value));
+        }
+    }
 }
diff --git a/app/Traits/HasS3Replicas.php b/app/Traits/HasS3Replicas.php
index 81e935e174..0d63823cd6 100644
--- a/app/Traits/HasS3Replicas.php
+++ b/app/Traits/HasS3Replicas.php
@@ -2,6 +2,7 @@
 
 namespace App\Traits;
 
+use App\Services\FileDownloadStorageService;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 
@@ -44,6 +45,47 @@ trait HasS3Replicas
         return $this->s3Replicas()->where('s3_uploaded', true)->where('s3_storage_deleted', false)->exists();
     }
 
+    /**
+     * Whether a local file or a live S3 copy is left to download.
+     */
+    public function isDownloadable(): bool
+    {
+        return ! $this->local_storage_deleted
+            || $this->s3Replicas->contains(fn ($replica): bool => $replica->s3_uploaded === true && $replica->s3_storage_deleted === false);
+    }
+
+    /**
+     * A short-lived presigned download URL for the first live copy in a usable S3 storage of the given team, the
+     * primary storage first. Null when no such copy exists.
+     */
+    public function s3DownloadUrl(int $teamId, ?int $primaryStorageId): ?string
+    {
+        if (blank($this->filename)) {
+            return null;
+        }
+
+        $replica = $this->s3Replicas()
+            ->with('s3')
+            ->where('s3_uploaded', true)
+            ->where('s3_storage_deleted', false)
+            ->whereHas('s3', fn (Builder $query) => $query->where('team_id', $teamId)->where('is_usable', true))
+            ->orderBy('id')
+            ->get()
+            ->sortByDesc(fn ($replica): bool => $replica->s3_storage_id === $primaryStorageId)
+            ->first();
+
+        if (! $replica) {
+            return null;
+        }
+
+        // The upload copies the file to "<bucket><backup directory>/", so the object key is the local file path.
+        return $replica->s3->filesystem()->temporaryUrl(
+            $this->filename,
+            now()->addMinutes(FileDownloadStorageService::LINK_TTL_MINUTES),
+            ['ResponseContentDisposition' => FileDownloadStorageService::contentDisposition(basename($this->filename))],
+        );
+    }
+
     /**
      * Writes the replica states to the summary columns: uploaded when every copy uploaded, deleted when every uploaded
      * copy is deleted.
diff --git a/app/Traits/PreparesBackupDownloads.php b/app/Traits/PreparesBackupDownloads.php
new file mode 100644
index 0000000000..118813fa5f
--- /dev/null
+++ b/app/Traits/PreparesBackupDownloads.php
@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Traits;
+
+use App\Jobs\PrepareFileDownloadJob;
+use App\Models\Server;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+
+/**
+ * Backup downloads through the instance download S3 storage: the server
+ * uploads the backup to S3 and the browser downloads it from there. Without
+ * the storage, when the local file is gone, or when the backup is larger
+ * than one S3 PUT, the browser uses the Coolify download route.
+ *
+ * The view must poll checkDownloads() while $pendingDownloads is not empty
+ * and open the URL of each `open-backup-download` window event.
+ */
+trait PreparesBackupDownloads
+{
+    private const MAX_PENDING_S3_DOWNLOADS = 3;
+
+    /** @var array<int, string> */
+    public array $pendingDownloads = [];
+
+    /**
+     * Authorize the user and load the backup from a record scoped to the
+     * component before you call this. Pass a null server or file name when
+     * the local file is gone; the download route then answers the request.
+     */
+    protected function prepareBackupDownload(?Server $server, ?string $filename, string $streamUrl): void
+    {
+        $storage = FileDownloadStorageService::configuredStorage();
+        $size = $storage && $server && filled($filename) ? FileDownloadStorageService::hostFileSize($server, $filename) : null;
+        if ($size === null || $size > FileDownloadStorageService::MAX_SIZE) {
+            $this->dispatch('open-backup-download', url: $streamUrl);
+
+            return;
+        }
+
+        if (count($this->pendingDownloads) >= self::MAX_PENDING_S3_DOWNLOADS
+            || ! RateLimiter::attempt('file-browser-s3-download:'.auth()->id(), 10, fn () => true, 3600)) {
+            $this->dispatch('error', 'Too many downloads are in progress. Wait for them to finish, then try again.');
+
+            return;
+        }
+
+        $downloadId = (string) Str::uuid();
+        $this->pendingDownloads[] = $downloadId;
+        PrepareFileDownloadJob::dispatch($downloadId, auth()->id(), $server->id, null, $filename, false, basename($filename), $storage->id);
+        $this->dispatch('info', 'Preparing '.basename($filename).'. The download starts when it is ready.');
+    }
+
+    /**
+     * Polled while S3 downloads are prepared. Opens each finished link once.
+     */
+    public function checkDownloads(): void
+    {
+        foreach ($this->pendingDownloads as $index => $downloadId) {
+            $result = Cache::get(PrepareFileDownloadJob::cacheKey($downloadId));
+            if (! is_array($result) || ($result['user_id'] ?? null) !== auth()->id()) {
+                continue;
+            }
+
+            unset($this->pendingDownloads[$index]);
+            Cache::forget(PrepareFileDownloadJob::cacheKey($downloadId));
+            if ($result['status'] === 'ready') {
+                $this->dispatch('open-backup-download', url: $result['url']);
+            } else {
+                $this->dispatch('error', $result['message']);
+            }
+        }
+        $this->pendingDownloads = array_values($this->pendingDownloads);
+    }
+
+    protected function s3BackupDownloadsEnabled(): bool
+    {
+        return FileDownloadStorageService::configuredStorage() !== null;
+    }
+}
diff --git a/bootstrap/helpers/constants.php b/bootstrap/helpers/constants.php
index 4ab7d74698..543901932f 100644
--- a/bootstrap/helpers/constants.php
+++ b/bootstrap/helpers/constants.php
@@ -81,6 +81,8 @@ const SPECIFIC_SERVICES = [
     'minio/minio',
     'ghcr.io/coollabsio/minio',
     'coollabsio/minio',
+    'pgsty/silo',
+    'docker.io/pgsty/silo',
     'svhd/logto',
     'dxflrs/garage',
 ];
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index faf3e43acb..787fce986a 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -7,6 +7,7 @@ use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
@@ -675,7 +676,7 @@ function generateServiceSpecificFqdns(ServiceApplication|Application $resource)
     $variables = collect($environment_variables);
     $payload = collect([]);
     switch ($type) {
-        case $type?->contains('minio'):
+        case $type?->contains(['minio', 'pgsty/silo']):
             $MINIO_BROWSER_REDIRECT_URL = $variables->where('key', 'MINIO_BROWSER_REDIRECT_URL')->first();
             $MINIO_SERVER_URL = $variables->where('key', 'MINIO_SERVER_URL')->first();
 
@@ -765,9 +766,12 @@ function isNoindexDomain(string $domain, ?Collection $noindex_domains): bool
         return false;
     }
 
+    // Flags are stored without a port, so compare portless: https://app.example.com:3000 matches https://app.example.com.
+    $normalize = fn (string $url) => DomainPortOverrides::withoutPort(ValidationPatterns::normalizeApplicationDomainUrl($url));
+
     return $noindex_domains
-        ->map(fn (string $noindex_domain) => ValidationPatterns::normalizeApplicationDomainUrl($noindex_domain))
-        ->contains(ValidationPatterns::normalizeApplicationDomainUrl($domain));
+        ->map($normalize)
+        ->contains($normalize($domain));
 }
 
 /**
diff --git a/bootstrap/helpers/domains.php b/bootstrap/helpers/domains.php
index 8be6d9a77a..704c90988f 100644
--- a/bootstrap/helpers/domains.php
+++ b/bootstrap/helpers/domains.php
@@ -3,6 +3,7 @@
 use App\Models\Application;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use Illuminate\Support\Collection;
 
 /**
@@ -591,6 +592,47 @@ function findServiceApplicationForEnvName(Service $resource, string $envServiceN
     return $resource->applications()->where('name', $resolved)->first();
 }
 
+/**
+ * Check if a service copies a SERVICE_FQDN_ / SERVICE_URL_ declaration of the application named in it.
+ * The copy (same name, port and value; URL or FQDN) must not generate a domain or overwrite the variable (#11924).
+ * Declarations with another port or path share the host on purpose (for example Appwrite).
+ *
+ * @param  array<string, mixed>|Collection<string, mixed>  $services  Parsed compose services
+ */
+function isCopiedServiceUrlDeclaration(
+    Service $resource,
+    array|Collection $services,
+    ServiceApplication|ServiceDatabase $current,
+    string $key,
+): bool {
+    $owner = findServiceApplicationForEnvName($resource, parseServiceEnvironmentVariable($key)['service_name']);
+    if (! $owner || $owner->name === $current->name) {
+        return false;
+    }
+
+    // Same declaration sources as serviceParser: environment and build arguments.
+    $declarationsOf = fn (string $serviceName) => convertToKeyValueCollection(
+        collect(data_get($services, [$serviceName, 'environment'], []))
+            ->merge(data_get($services, [$serviceName, 'build', 'args'], []))
+    );
+    $ownerDeclarations = $declarationsOf($owner->name);
+    $currentDeclarations = $declarationsOf($current->name);
+
+    if (! $currentDeclarations->has($key)) {
+        return false;
+    }
+
+    // SERVICE_URL_X_3000 and SERVICE_FQDN_X_3000 write the same variable pair, so either one counts.
+    $twinKey = str_starts_with($key, 'SERVICE_URL_')
+        ? 'SERVICE_FQDN_'.substr($key, strlen('SERVICE_URL_'))
+        : 'SERVICE_URL_'.substr($key, strlen('SERVICE_FQDN_'));
+    $value = (string) $currentDeclarations->get($key);
+
+    return collect([$key, $twinKey])->contains(
+        fn (string $ownerKey) => $ownerDeclarations->has($ownerKey) && (string) $ownerDeclarations->get($ownerKey) === $value
+    );
+}
+
 /**
  * Put/update a service domain entry under the original compose service name,
  * removing legacy twin keys that resolve unambiguously to the same name.
diff --git a/bootstrap/helpers/github.php b/bootstrap/helpers/github.php
index d66ffd88b8..edcbca88f6 100644
--- a/bootstrap/helpers/github.php
+++ b/bootstrap/helpers/github.php
@@ -4,6 +4,8 @@ use App\Models\GithubApp;
 use App\Models\PrivateKey;
 use Carbon\Carbon;
 use Carbon\CarbonImmutable;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
@@ -195,13 +197,20 @@ function generateGithubToken(GithubApp $source, string $type)
     return match ($type) {
         'jwt' => $jwt,
         'installation' => (function () use ($source, $jwt) {
+            // GitHub sometimes answers with a 5xx page or drops the connection; a new token request is harmless.
             $response = Http::GitSource($source->api_url)->withHeaders([
                 'Authorization' => "Bearer $jwt",
                 'Accept' => 'application/vnd.github.machine-man-preview+json',
-            ])->post("{$source->api_url}/app/installations/{$source->installation_id}/access_tokens");
+            ])->retry(
+                3,
+                fn (int $attempt) => $attempt * 1000,
+                fn (Throwable $exception) => $exception instanceof ConnectionException
+                    || ($exception instanceof RequestException && $exception->response->serverError()),
+                throw: false,
+            )->post("{$source->api_url}/app/installations/{$source->installation_id}/access_tokens");
 
             if (! $response->successful()) {
-                $error = data_get($response->json(), 'message', 'no error message found');
+                $error = data_get($response->json(), 'message', "HTTP {$response->status()}");
                 if ($error === 'Not Found') {
                     $error = 'Repository not found. Is it moved or deleted?';
                 }
@@ -216,7 +225,7 @@ function generateGithubToken(GithubApp $source, string $type)
 
 function generateGithubInstallationToken(GithubApp $source)
 {
-    return generateGithubToken($source, 'installation');
+    return $source->installationToken();
 }
 
 function generateGithubJwt(GithubApp $source)
@@ -397,28 +406,34 @@ function loadRepositoryByPage(GithubApp $source, string $token, int $page)
         'repositories' => $json['repositories'],
     ];
 }
-function getGithubCommitRangeFiles(?GithubApp $source, string $owner, string $repo, string $beforeSha, string $afterSha): array
+/**
+ * Returns null when the full list of changed files is unknown (API error or truncated list).
+ */
+function getGithubCommitRangeFiles(?GithubApp $source, string $owner, string $repo, string $beforeSha, string $afterSha): ?array
 {
     try {
         if (! $source) {
             // Manual webhooks don't have GitHub App authentication
-            // Return empty array so watch paths are ignored (current behavior)
             return [];
         }
 
         $endpoint = "/repos/{$owner}/{$repo}/compare/{$beforeSha}...{$afterSha}";
-        $response = githubApi($source, $endpoint, 'get', null, false);
-
-        if (! $response) {
-            return [];
-        }
-
+        $response = githubApi($source, $endpoint);
         $files = collect(data_get($response, 'data.files', []));
 
-        return $files->pluck('filename')->filter()->values()->toArray();
-    } catch (Exception $e) {
+        // The compare API returns at most 300 files and cannot paginate them.
+        if ($files->count() >= 300) {
+            return null;
+        }
 
-        return [];
+        // A renamed file also changes its previous path.
+        return $files->flatMap(fn (mixed $file): array => [data_get($file, 'filename'), data_get($file, 'previous_filename')])
+            ->filter(fn (mixed $filename): bool => is_string($filename) && $filename !== '')
+            ->unique()
+            ->values()
+            ->toArray();
+    } catch (Exception $e) {
+        return null;
     }
 }
 
@@ -444,27 +459,34 @@ function getGithubCommitMessage(?GithubApp $source, string $owner, string $repo,
     }
 }
 
-function getGithubPullRequestFiles(?GithubApp $source, string $owner, string $repo, int $pullRequestId): array
+/**
+ * Returns null when the full list of changed files is unknown (API error or truncated list).
+ */
+function getGithubPullRequestFiles(?GithubApp $source, string $owner, string $repo, int $pullRequestId): ?array
 {
     try {
         if (! $source) {
             // Manual webhooks don't have GitHub App authentication
-            // Return empty array so watch paths are ignored (current behavior)
             return [];
         }
 
-        $endpoint = "/repos/{$owner}/{$repo}/pulls/{$pullRequestId}/files";
-        $response = githubApi($source, $endpoint, 'get', null, false);
+        // GitHub returns at most 100 files per page and 3000 files per pull request.
+        $perPage = 100;
+        $maxPages = 30;
+        $files = collect();
 
-        if (! $response) {
-            return [];
+        for ($page = 1; $page <= $maxPages; $page++) {
+            $endpoint = "/repos/{$owner}/{$repo}/pulls/{$pullRequestId}/files?per_page={$perPage}&page={$page}";
+            $pageFiles = collect(data_get(githubApi($source, $endpoint), 'data', []));
+            $files = $files->merge($pageFiles->pluck('filename'));
+
+            if ($pageFiles->count() < $perPage) {
+                return $files->filter()->values()->toArray();
+            }
         }
 
-        $files = collect(data_get($response, 'data', []));
-
-        return $files->pluck('filename')->filter()->values()->toArray();
+        return null;
     } catch (Exception $e) {
-
-        return [];
+        return null;
     }
 }
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 104497ed92..1a8f09c529 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -2031,7 +2031,9 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $coolifyEnvironments->put('COOLIFY_URL', $fqdns->map(fn ($fqdn) => getFqdnWithoutPort($fqdn))->implode(','));
             $coolifyEnvironments->put('COOLIFY_FQDN', $fqdns->map(fn ($fqdn) => getHostWithoutPort($fqdn))->implode(','));
         }
-        add_coolify_default_environment_variables($resource, $coolifyEnvironments, $resource->environment_variables);
+        $userDefinedKeys = $resource->environment_variables->pluck('key')->merge($environment->keys());
+        coolifyDefaultEnvironmentVariables($resource, $userDefinedKeys)
+            ->each(fn ($value, $key) => $coolifyEnvironments->put($key, escapeDollarSign($value)));
         if ($environment->count() > 0) {
             $environment = $environment->filter(function ($value, $key) {
                 return ! str($key)->startsWith('SERVICE_FQDN_');
@@ -2547,6 +2549,10 @@ function serviceParser(Service $resource): Collection
                 $port = $parsed['port'];
                 $fqdnFor = $parsed['service_name'];
 
+                if (isCopiedServiceUrlDeclaration($resource, $services, $savedService, $key->value())) {
+                    continue;
+                }
+
                 // Only ServiceApplication has fqdn column, ServiceDatabase does not
                 $isServiceApplication = $savedService instanceof ServiceApplication;
 
@@ -2667,8 +2673,8 @@ function serviceParser(Service $resource): Collection
                     // Also check if a port-suffixed version exists (e.g., SERVICE_FQDN_UMAMI_3000)
                     $portSuffixedExists = $resource->environment_variables()
                         ->where('key', 'LIKE', $key->value().'_%')
-                        ->whereRaw('key ~ ?', ['^'.$key->value().'_[0-9]+$'])
-                        ->exists();
+                        ->pluck('key')
+                        ->contains(fn ($envKey) => preg_match('/^'.preg_quote($key->value(), '/').'_[0-9]+$/', $envKey) === 1);
                     $serviceExists = findServiceApplicationForEnvName($resource, (string) $fqdnFor);
                     // Check if FQDN already has a port set (contains ':' after the domain)
                     $fqdnHasPort = $serviceExists && str($serviceExists->fqdn)->contains(':') && str($serviceExists->fqdn)->afterLast(':')->isMatch('/^\d+$/');
@@ -2712,8 +2718,8 @@ function serviceParser(Service $resource): Collection
                     // Also check if a port-suffixed version exists (e.g., SERVICE_URL_DASHBOARD_6791)
                     $portSuffixedExists = $resource->environment_variables()
                         ->where('key', 'LIKE', $key->value().'_%')
-                        ->whereRaw('key ~ ?', ['^'.$key->value().'_[0-9]+$'])
-                        ->exists();
+                        ->pluck('key')
+                        ->contains(fn ($envKey) => preg_match('/^'.preg_quote($key->value(), '/').'_[0-9]+$/', $envKey) === 1);
                     $serviceExists = findServiceApplicationForEnvName($resource, (string) $urlFor);
                     // Check if FQDN already has a port set (contains ':' after the domain)
                     $fqdnHasPort = $serviceExists && str($serviceExists->fqdn)->contains(':') && str($serviceExists->fqdn)->afterLast(':')->isMatch('/^\d+$/');
@@ -3333,7 +3339,9 @@ function serviceParser(Service $resource): Collection
             $coolifyEnvironments->put('COOLIFY_FQDN', $fqdns->map(fn ($fqdn) => getHostWithoutPort($fqdn))->implode(','));
             $coolifyEnvironments->put('COOLIFY_URL', $fqdns->map(fn ($fqdn) => getFqdnWithoutPort($fqdn))->implode(','));
         }
-        add_coolify_default_environment_variables($resource, $coolifyEnvironments, $resource->environment_variables);
+        $userDefinedKeys = $resource->environment_variables->pluck('key')->merge($environment->keys());
+        coolifyDefaultEnvironmentVariables($resource, $userDefinedKeys)
+            ->each(fn ($value, $key) => $coolifyEnvironments->put($key, escapeDollarSign($value)));
         if ($environment->count() > 0) {
             $environment = $environment->filter(function ($value, $key) {
                 return ! str($key)->startsWith('SERVICE_FQDN_');
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 66154ce7e8..667b9b18e3 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -409,8 +409,16 @@ function updateCompose(ServiceApplication|ServiceDatabase $resource)
             // Those belong to other services and will be updated when THOSE services are updated
         }
 
-        // Remove duplicates
-        $templateVariableNames = array_unique($templateVariableNames);
+        // Remove duplicates and copies of another application's declaration
+        $templateVariableNames = array_filter(
+            array_unique($templateVariableNames),
+            fn ($variableName) => ! isCopiedServiceUrlDeclaration(
+                $resource->service,
+                collect(data_get($dockerCompose, 'services', [])),
+                $resource,
+                $variableName,
+            ),
+        );
 
         // Extract unique service names to process (preserving the original case from template)
         // This allows us to create both URL and FQDN pairs regardless of which one is in the template
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 482c77f40a..19049f6426 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -935,6 +935,15 @@ function s3_image_url(?int $storageId, ?string $path, int $version): ?string
         return null;
     }
 
+    // S3-compatible endpoints (e.g. Cloudflare R2) require authenticated requests for
+    // every object, including plain GETs, so an unauthenticated direct link only works
+    // when a public CDN has been configured in front of the bucket. Without one, callers
+    // must fall back to the app's own authenticated proxy route.
+    $cdnUrl = instanceSettings()->image_cdn_url;
+    if (blank($cdnUrl)) {
+        return null;
+    }
+
     $storage = S3Storage::query()
         ->whereKey($storageId)
         ->whereTeamId(0)
@@ -945,9 +954,7 @@ function s3_image_url(?int $storageId, ?string $path, int $version): ?string
         return null;
     }
 
-    $baseUrl = instanceSettings()->image_cdn_url ?: $storage->awsUrl();
-
-    return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
+    return rtrim($cdnUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
 }
 
 /**
@@ -1517,7 +1524,25 @@ function sslip(Server $server)
     }
     $ip = $server->ip === 'host.docker.internal' ? base_ip() : $server->ip;
 
-    return 'http://'.sslipHostLabel($ip).'.sslip.io';
+    return 'http://'.sslipHostLabel(resolveHostToIp($ip)).'.sslip.io';
+}
+
+/**
+ * Resolve a hostname to its IPv4 (or else IPv6) address. sslip.io only answers for names that
+ * contain an IP address. Returns the input unchanged if it is already an IP or does not resolve.
+ */
+function resolveHostToIp(string $host): string
+{
+    if (filter_var(normalizeIpAddress($host), FILTER_VALIDATE_IP) !== false) {
+        return $host;
+    }
+    $ipv4 = gethostbyname($host);
+    if (filter_var($ipv4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) {
+        return $ipv4;
+    }
+    $ipv6 = data_get(@dns_get_record($host, DNS_AAAA), '0.ipv6');
+
+    return is_string($ipv6) && $ipv6 !== '' ? $ipv6 : $host;
 }
 
 function service_templates_cache_key(): string
@@ -2683,44 +2708,53 @@ function deduplicateAllowlist(array $entries): array
     return $result;
 }
 
-function get_public_ips()
+/**
+ * Detect the instance public IPs with ifconfig.io. Only empty settings are filled, so an address saved in Settings is kept.
+ */
+function get_public_ips(): void
 {
     try {
-        [$first, $second] = Process::concurrently(function (Pool $pool) {
-            $pool->path(__DIR__)->command('curl -4s https://ifconfig.io');
-            $pool->path(__DIR__)->command('curl -6s https://ifconfig.io');
-        });
-        $ipv4 = $first->output();
-        if ($ipv4) {
-            $ipv4 = trim($ipv4);
-            $validate_ipv4 = filter_var($ipv4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4);
-            if ($validate_ipv4 == false) {
-                echo "Invalid ipv4: $ipv4\n";
-
-                return;
-            }
-            InstanceSettings::get()->update(['public_ipv4' => $ipv4]);
+        $settings = InstanceSettings::get();
+        $columns = array_values(array_filter(['public_ipv4', 'public_ipv6'], fn (string $column) => blank($settings->$column)));
+        if ($columns === []) {
+            return;
         }
-    } catch (Exception $e) {
-        echo "Error: {$e->getMessage()}\n";
-    }
-    try {
-        $ipv6 = $second->output();
-        if ($ipv6) {
-            $ipv6 = trim($ipv6);
-            $validate_ipv6 = filter_var($ipv6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
-            if ($validate_ipv6 == false) {
-                echo "Invalid ipv6: $ipv6\n";
 
-                return;
-            }
-            InstanceSettings::get()->update(['public_ipv6' => $ipv6]);
+        $detected = detect_public_ips($columns);
+        if ($detected !== []) {
+            $settings->update($detected);
         }
     } catch (Throwable $e) {
         echo "Error: {$e->getMessage()}\n";
     }
 }
 
+/**
+ * Look up the public IPs of this host with ifconfig.io, without saving them.
+ *
+ * @param  list<'public_ipv4'|'public_ipv6'>  $columns
+ * @return array<'public_ipv4'|'public_ipv6', string> valid addresses only
+ */
+function detect_public_ips(array $columns = ['public_ipv4', 'public_ipv6']): array
+{
+    $versions = array_intersect_key(['public_ipv4' => 4, 'public_ipv6' => 6], array_flip($columns));
+    $results = Process::concurrently(function (Pool $pool) use ($versions) {
+        foreach ($versions as $column => $version) {
+            $pool->as($column)->path(__DIR__)->command("curl -{$version}s https://ifconfig.io");
+        }
+    });
+
+    $detected = [];
+    foreach ($versions as $column => $version) {
+        $ip = trim($results[$column]->output());
+        if (filter_var($ip, FILTER_VALIDATE_IP, $version === 4 ? FILTER_FLAG_IPV4 : FILTER_FLAG_IPV6) !== false) {
+            $detected[$column] = $ip;
+        }
+    }
+
+    return $detected;
+}
+
 function isAnyDeploymentInprogress(bool $showAll = false)
 {
     $runningJobs = ApplicationDeploymentQueue::where('horizon_job_worker', gethostname())->where('status', ApplicationDeploymentStatus::IN_PROGRESS->value)->get();
@@ -3624,19 +3658,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                 $parsedServiceVariables->put('COOLIFY_RESOURCE_UUID', "{$resource->uuid}");
                 $parsedServiceVariables->put('COOLIFY_CONTAINER_NAME', "$serviceName-{$resource->uuid}");
 
-                // TODO: move this in a shared function
-                if (! $parsedServiceVariables->has('COOLIFY_APP_NAME')) {
-                    $parsedServiceVariables->put('COOLIFY_APP_NAME', "\"{$resource->name}\"");
-                }
-                if (! $parsedServiceVariables->has('COOLIFY_SERVER_IP')) {
-                    $parsedServiceVariables->put('COOLIFY_SERVER_IP', "\"{$resource->destination->server->ip}\"");
-                }
-                if (! $parsedServiceVariables->has('COOLIFY_ENVIRONMENT_NAME')) {
-                    $parsedServiceVariables->put('COOLIFY_ENVIRONMENT_NAME', "\"{$resource->environment->name}\"");
-                }
-                if (! $parsedServiceVariables->has('COOLIFY_PROJECT_NAME')) {
-                    $parsedServiceVariables->put('COOLIFY_PROJECT_NAME', "\"{$resource->project()->name}\"");
-                }
+                coolifyDefaultEnvironmentVariables($resource, $parsedServiceVariables->keys())
+                    ->each(fn ($value, $key) => $parsedServiceVariables->put($key, escapeDollarSign($value)));
 
                 $parsedServiceVariables = $parsedServiceVariables->map(function ($value, $key) use ($envs_from_coolify) {
                     if (! str($value)->startsWith('$')) {
@@ -4509,56 +4532,32 @@ function isAssociativeArray($array)
 }
 
 /**
- * This method adds the default environment variables to the resource.
- * - COOLIFY_APP_NAME
- * - COOLIFY_PROJECT_NAME
- * - COOLIFY_SERVER_IP
- * - COOLIFY_ENVIRONMENT_NAME
+ * The variables that tell a container where it runs. Values are raw: each caller escapes them
+ * for its output (compose file, .env file, or build arguments). Keys in $definedKeys are
+ * skipped, so a variable that the user defines wins. Pass $server when the container runs on
+ * another server than the main destination (an application on an additional server).
  *
- *  Theses variables are added in place to the $where_to_add array.
+ * @param  iterable<int, string>  $definedKeys
+ * @return Collection<string, string>
  */
-function add_coolify_default_environment_variables(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse|StandaloneSqlite|Application|Service $resource, Collection &$where_to_add, ?Collection $where_to_check = null)
+function coolifyDefaultEnvironmentVariables(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse|StandaloneSqlite|Application|Service $resource, iterable $definedKeys = [], ?Server $server = null): Collection
 {
-    // Currently disabled
-    return;
-    if ($resource instanceof Service) {
-        $ip = $resource->server->ip;
-    } else {
-        $ip = $resource->destination->server->ip;
-    }
-    if (isAssociativeArray($where_to_add)) {
-        $isAssociativeArray = true;
-    } else {
-        $isAssociativeArray = false;
-    }
-    if ($where_to_check != null && $where_to_check->where('key', 'COOLIFY_APP_NAME')->isEmpty()) {
-        if ($isAssociativeArray) {
-            $where_to_add->put('COOLIFY_APP_NAME', "\"{$resource->name}\"");
-        } else {
-            $where_to_add->push("COOLIFY_APP_NAME=\"{$resource->name}\"");
-        }
-    }
-    if ($where_to_check != null && $where_to_check->where('key', 'COOLIFY_SERVER_IP')->isEmpty()) {
-        if ($isAssociativeArray) {
-            $where_to_add->put('COOLIFY_SERVER_IP', "\"{$ip}\"");
-        } else {
-            $where_to_add->push("COOLIFY_SERVER_IP=\"{$ip}\"");
-        }
-    }
-    if ($where_to_check != null && $where_to_check->where('key', 'COOLIFY_ENVIRONMENT_NAME')->isEmpty()) {
-        if ($isAssociativeArray) {
-            $where_to_add->put('COOLIFY_ENVIRONMENT_NAME', "\"{$resource->environment->name}\"");
-        } else {
-            $where_to_add->push("COOLIFY_ENVIRONMENT_NAME=\"{$resource->environment->name}\"");
-        }
-    }
-    if ($where_to_check != null && $where_to_check->where('key', 'COOLIFY_PROJECT_NAME')->isEmpty()) {
-        if ($isAssociativeArray) {
-            $where_to_add->put('COOLIFY_PROJECT_NAME', "\"{$resource->project()->name}\"");
-        } else {
-            $where_to_add->push("COOLIFY_PROJECT_NAME=\"{$resource->project()->name}\"");
-        }
+    // A model created in this request has no column default loaded yet (null), which means on.
+    $isEnabled = $resource instanceof Application
+        ? $resource->settings?->include_coolify_default_variables
+        : $resource->include_coolify_default_variables;
+    if ($isEnabled === false) {
+        return collect();
     }
+
+    $server ??= $resource instanceof Service ? $resource->server : $resource->destination?->server;
+
+    return collect([
+        'COOLIFY_APP_NAME' => $resource->name,
+        'COOLIFY_PROJECT_NAME' => $resource->project()?->name,
+        'COOLIFY_ENVIRONMENT_NAME' => $resource->environment?->name,
+        'COOLIFY_SERVER_IP' => $server?->ip,
+    ])->whereNotNull()->map(fn ($value) => (string) $value)->except(collect($definedKeys)->all());
 }
 
 function convertToKeyValueCollection($environment)
@@ -4620,6 +4619,20 @@ function wireNavigate(): string
     }
 }
 
+/**
+ * Registers a resource menu that the main sidebar shows in place of its main menu on wide screens
+ * (see components/navbar.blade.php). The menu teleports itself into #main-nav-context-{depth}.
+ * Back on a menu shows the menu one depth lower, and Back at depth 0 shows the main menu.
+ */
+function registerMainNavContext(int $depth, string $label, string $backTitle): void
+{
+    $levels = request()->attributes->get('mainNavContext', []);
+    $levels[$depth] = ['label' => $label, 'backTitle' => $backTitle];
+    ksort($levels);
+
+    request()->attributes->set('mainNavContext', $levels);
+}
+
 /**
  * Flattens a grouped settings sidebar into the items that the command palette
  * shows for the current page: every page, its child pages, and its in-page sections.
@@ -4869,8 +4882,15 @@ function parseScpStyleGitUrl(?string $gitRepository): ?array
     ];
 }
 
-function scpStyleGitUrlToHttps(?string $gitRepository): ?string
+function sshGitUrlToHttps(?string $gitRepository): ?string
 {
+    if (is_string($gitRepository) && str_starts_with($gitRepository, 'ssh://')) {
+        $host = parse_url($gitRepository, PHP_URL_HOST);
+        $path = ltrim((string) parse_url($gitRepository, PHP_URL_PATH), '/');
+
+        return filled($host) && $path !== '' ? "https://{$host}/{$path}" : null;
+    }
+
     $parts = parseScpStyleGitUrl($gitRepository);
 
     if ($parts === null) {
@@ -4886,8 +4906,8 @@ function gitRepositorySlug(?string $gitRepository): string
         return '';
     }
 
-    if (($scp = parseScpStyleGitUrl($gitRepository)) !== null) {
-        $gitRepository = $scp['path'];
+    if (($httpsRepository = sshGitUrlToHttps($gitRepository)) !== null) {
+        $gitRepository = (string) parse_url($httpsRepository, PHP_URL_PATH);
     } elseif (str($gitRepository)->startsWith('http') || str($gitRepository)->contains('github.com')) {
         $gitRepository = str($gitRepository)->replace('https://', '')->replace('http://', '')->replace('github.com/', '');
     }
@@ -5753,6 +5773,115 @@ function deviceLabel(?string $device): string
     };
 }
 
+/**
+ * Prepare aggregated `city` breakdown rows (`CC|subdivision|City`, from
+ * TrafficAnalyticsAggregator::breakdowns(), not raw Sentinel rows) for display,
+ * largest first. `name` and `detail` are the two parts of `label` ("Berlin" and
+ * "BE, Germany"). `CC||` (sent by older Sentinel builds) is an unknown city of
+ * that country. `__other__` and malformed values are merged into one "Other"
+ * row, which stays last. Returns [] when no row has a real city.
+ *
+ * @param  iterable<int, array{value?: string, requests?: int, bytesOut?: int, lat?: float, lon?: float}>  $rows
+ * @return array<int, array{key: string, country: string, label: string, name: string, detail: string, requests: int, bytesOut: int, lat: ?float, lon: ?float}>
+ */
+function trafficCityRows(iterable $rows): array
+{
+    $out = [];
+    $hasCity = false;
+
+    foreach ($rows as $row) {
+        $requests = (int) data_get($row, 'requests', 0);
+        if ($requests <= 0) {
+            continue;
+        }
+
+        $value = (string) data_get($row, 'value', '');
+        $parts = explode('|', $value, 3);
+        $parts[0] = strtoupper($parts[0]);
+        $isCityKey = count($parts) === 3 && preg_match('/^[A-Z]{2}$/', $parts[0]) === 1;
+
+        $key = '__other__';
+        $country = '';
+        $label = 'Other';
+        $name = 'Other';
+        $detail = '';
+        $lat = null;
+        $lon = null;
+
+        if ($isCityKey) {
+            [$country, $subdivision, $city] = array_map('trim', $parts);
+            $key = $value;
+
+            if ($city === '') {
+                $label = 'Unknown, '.$country;
+                $name = 'Unknown';
+                $detail = countryName($country);
+            } else {
+                $hasCity = true;
+                $region = preg_match('/^[A-Z]{2,3}$/', $subdivision) === 1 ? $subdivision.', ' : '';
+                $label = $city.', '.$region.$country;
+                $name = $city;
+                $detail = $region.countryName($country);
+
+                $rawLat = data_get($row, 'lat');
+                $rawLon = data_get($row, 'lon');
+                if (is_numeric($rawLat) && is_numeric($rawLon)) {
+                    $lat = (float) $rawLat;
+                    $lon = (float) $rawLon;
+                }
+            }
+        }
+
+        $out[$key] ??= ['key' => $key, 'country' => $country, 'label' => $label, 'name' => $name, 'detail' => $detail, 'requests' => 0, 'bytesOut' => 0, 'lat' => $lat, 'lon' => $lon];
+        $out[$key]['requests'] += $requests;
+        $out[$key]['bytesOut'] += (int) data_get($row, 'bytesOut', 0);
+    }
+
+    if (! $hasCity) {
+        return [];
+    }
+
+    $other = $out['__other__'] ?? null;
+    unset($out['__other__']);
+    $out = array_values($out);
+    usort($out, fn (array $a, array $b): int => $b['requests'] <=> $a['requests']);
+
+    return $other === null ? $out : [...$out, $other];
+}
+
+/**
+ * Marker data for the analytics globe, one set for each view of the Locations
+ * card: a marker per country with a valid ISO-A2 code, and a marker per city
+ * that has coordinates.
+ *
+ * @param  iterable<int, mixed>  $countryRows
+ * @param  iterable<int, mixed>  $cityRows
+ * @return array{countries: array<int, array{code: string, requests: int}>, cities: array<int, array{lat: float, lon: float, requests: int}>}
+ */
+function trafficGeoMarkers(iterable $countryRows, iterable $cityRows): array
+{
+    $countries = [];
+    foreach ($countryRows as $row) {
+        $code = strtoupper((string) data_get($row, 'value', ''));
+        $requests = (int) data_get($row, 'requests', 0);
+        if ($requests > 0 && preg_match('/^[A-Z]{2}$/', $code) === 1) {
+            $countries[] = ['code' => $code, 'requests' => $requests];
+        }
+    }
+
+    $cities = [];
+    foreach ($cityRows as $row) {
+        $requests = (int) data_get($row, 'requests', 0);
+        $lat = data_get($row, 'lat');
+        $lon = data_get($row, 'lon');
+        if ($requests > 0 && is_numeric($lat) && is_numeric($lon)) {
+            $cities[] = ['lat' => (float) $lat, 'lon' => (float) $lon, 'requests' => $requests];
+        }
+    }
+
+    return ['countries' => $countries, 'cities' => $cities];
+}
+
 /**
  * Resolve an ISO 3166-1 alpha-2 country code to its English country name.
  *
diff --git a/config/constants.php b/config/constants.php
index 0da39cc3d2..728ba9c8ee 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -5,7 +5,7 @@ $sshCommandTimeout = (int) env('SSH_COMMAND_TIMEOUT', 3600);
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.4.6',
+        'version' => env('COOLIFY_VERSION') ?: '4.5',
         'helper_version' => '1.0.18',
         'railpack_version' => '0.40.1',
         'self_hosted' => env('SELF_HOSTED', true),
diff --git a/database/migrations/2026_10_14_105230_add_file_download_storage_to_instance_settings_table.php b/database/migrations/2026_10_14_105230_add_file_download_storage_to_instance_settings_table.php
new file mode 100644
index 0000000000..ff1a43faba
--- /dev/null
+++ b/database/migrations/2026_10_14_105230_add_file_download_storage_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->foreignId('file_download_s3_storage_id')->nullable()->constrained('s3_storages')->nullOnDelete();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('file_download_s3_storage_id');
+        });
+    }
+};
diff --git a/database/migrations/2026_10_15_213357_spread_default_auto_update_frequency.php b/database/migrations/2026_10_15_213357_spread_default_auto_update_frequency.php
new file mode 100644
index 0000000000..9648ab50ec
--- /dev/null
+++ b/database/migrations/2026_10_15_213357_spread_default_auto_update_frequency.php
@@ -0,0 +1,24 @@
+<?php
+
+use App\Models\InstanceSettings;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * Move instances that use the old midnight default to a random minute after midnight,
+     * so they do not all pull images from the registry at 00:00.
+     */
+    public function up(): void
+    {
+        DB::table('instance_settings')
+            ->where('auto_update_frequency', '0 0 * * *')
+            ->update(['auto_update_frequency' => InstanceSettings::randomAutoUpdateFrequency()]);
+    }
+
+    public function down(): void
+    {
+        //
+    }
+};
diff --git a/database/migrations/2026_10_18_103517_add_include_coolify_default_variables_to_resources.php b/database/migrations/2026_10_18_103517_add_include_coolify_default_variables_to_resources.php
new file mode 100644
index 0000000000..5059e44005
--- /dev/null
+++ b/database/migrations/2026_10_18_103517_add_include_coolify_default_variables_to_resources.php
@@ -0,0 +1,40 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    private const TABLES = [
+        'application_settings',
+        'services',
+        'standalone_postgresqls',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_mongodbs',
+        'standalone_redis',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+        'standalone_sqlites',
+    ];
+
+    public function up(): void
+    {
+        foreach (self::TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->boolean('include_coolify_default_variables')->default(true);
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        foreach (self::TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->dropColumn('include_coolify_default_variables');
+            });
+        }
+    }
+};
diff --git a/docker-compose.dev-multi.yml b/docker-compose.dev-multi.yml
index 153e1c9a1b..1b5e3fad10 100644
--- a/docker-compose.dev-multi.yml
+++ b/docker-compose.dev-multi.yml
@@ -181,7 +181,10 @@ services:
     volumes:
       - minio_data:/data
     networks:
-      - coolify
+      coolify:
+        # The seeded "Local MinIO" storage (S3StorageSeeder) uses http://coolify-minio:9000.
+        aliases:
+          - coolify-minio
 
   minio-init:
     profiles: ["minio"]
diff --git a/docker-compose.dev-side-by-side.yml b/docker-compose.dev-side-by-side.yml
new file mode 100644
index 0000000000..5c8404495a
--- /dev/null
+++ b/docker-compose.dev-side-by-side.yml
@@ -0,0 +1,9 @@
+# Added by scripts/dev for side-by-side instances (COOLIFY_DEV_SIDE_BY_SIDE=1). Two instances of one
+# checkout share storage/, and both have a server with the uuid "localhost", so they would share the
+# SSH key and multiplexing files. This gives the instance its own SSH folder.
+services:
+  coolify:
+    volumes:
+      - ssh_data:/var/www/html/storage/app/ssh
+volumes:
+  ssh_data:
diff --git a/docker/development/Dockerfile b/docker/development/Dockerfile
index aa178765ad..06e779d4ae 100644
--- a/docker/development/Dockerfile
+++ b/docker/development/Dockerfile
@@ -70,6 +70,7 @@ RUN apk add --no-cache \
     git-lfs \
     jq \
     lsof \
+    procps \
     vim
 
 # Install PHP extensions
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/horizon b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/horizon
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/horizon
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/horizon
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/init-setup b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/init-setup
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/init-setup
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/init-setup
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/reverb b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/reverb
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/reverb
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/reverb
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/scheduler-worker b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/scheduler-worker
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/scheduler-worker
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/scheduler-worker
diff --git a/docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server b/docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server
similarity index 100%
rename from docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/terminal-server
rename to docker/development/etc/s6-overlay/user-bundles.d/user/contents.d/terminal-server
diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index 9ddff6476d..5060ef6b13 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -135,6 +135,7 @@ RUN --mount=type=cache,target=/var/cache/apk \
     git-lfs \
     jq \
     lsof \
+    procps \
     vim
 
 # Install PHP extensions
@@ -186,6 +187,8 @@ COPY --chown=www-data:www-data resources/views ./resources/views
 COPY --chown=www-data:www-data artisan artisan
 COPY --chown=www-data:www-data openapi.yaml ./openapi.yaml
 COPY --chown=www-data:www-data changelogs/ ./changelogs/
+# Version data for Traefik, Sentinel, and helper checks until CheckForUpdatesJob refreshes it
+COPY --chown=www-data:www-data versions.json ./versions.json
 
 RUN composer dump-autoload
 
diff --git a/docs/server-transfer-full-coverage.md b/docs/server-transfer-full-coverage.md
new file mode 100644
index 0000000000..af6636b8f0
--- /dev/null
+++ b/docs/server-transfer-full-coverage.md
@@ -0,0 +1,139 @@
+# Full-coverage server for transfer tests
+
+Set up one source server with everything below, transfer it, then compare each item on the target.
+Use values that are NOT the default, so that a lost value is visible after the transfer.
+
+Use the kit in `scripts/transfer-test/` (see its README): it starts the source (A) and the target (B) and seeds A with a basic set of deployed resources.
+
+Legend: ✅ `scripts/transfer-test/seed.sh` or `seed-extras.php` already creates it · ➕ add it · ⚠️ needs special infrastructure
+
+The models come from `ServerTransferCoverage::TRANSFERRED` (`app/Services/ServerTransfer/ServerTransferCoverage.php`).
+When you add a model or a setting to the transfer, add it to this file too.
+
+## 1. Server (Server → General / Proxy)
+
+| ✓ | What | Value to set |
+|---|---|---|
+| ✅ | Non-root SSH user | a dev VM with the `ubuntu-non-root` profile |
+| ➕ | Name, description | any text |
+| ➕ | Port | other than 22, if the VM allows it |
+| ➕ | Proxy: redirect | redirect enabled + target URL |
+| ✅ | Proxy: custom error page | custom HTML (`proxy_error_page`) |
+| ➕ | Server role / build server | mark a second server as a build server |
+| ⚠️ | Cloud provider link | Hetzner/Vultr/DigitalOcean/Hostinger server ID + cloud provider token (needs a real cloud server) |
+| ⚠️ | Swarm | swarm manager / worker + swarm cluster + swarm destination (needs a swarm server) |
+
+## 2. Server settings (Server → Advanced, Log drains, Sentinel/Metrics, Traffic, Cloudflare tunnel)
+
+| ✓ | What | Value to set |
+|---|---|---|
+| ➕ | Wildcard domain | `http://{ip}.sslip.io` style, not empty |
+| ➕ | Concurrent builds, dynamic timeout, deployment queue limit, connection timeout | 3, 1800, 5, 20 |
+| ➕ | Server timezone | `Europe/Budapest` |
+| ➕ | Docker cleanup | force cleanup on, frequency `0 4 * * *`, threshold 70, delete unused volumes on, delete unused networks on |
+| ➕ | Disk usage notification | threshold 70, check frequency `*/30 * * * *`, interval 12 h |
+| ➕ | Terminal | terminal access off |
+| ➕ | Image retention | "disable application image retention" on |
+| ➕ | Labels / Traefik | generate exact labels on, Traefik certificate resolver `custom` |
+| ➕ | Backup compression | CPU percentage 50 |
+| ➕ | Metrics / Sentinel | metrics on, refresh rate 10 s, history 14 days, push interval 30 s |
+| ➕ | Traffic analytics | on, top N 20, sample threshold, retention 1h=3 / 1d=60 days, IP mode `anonymized` |
+| ➕ | GeoIP | on, MaxMind license key, refresh 14 days |
+| ➕ | Log drains | New Relic (key + base URI), Highlight (project ID), Axiom (dataset + key), custom (config + parser), one of them enabled |
+| ✅ | Cloudflare tunnel | tunnel on, tunnel ID, account ID, Cloudflare integration token selected |
+| ➕ | Jump server flag | on (on a server that is only a jump host) |
+
+## 3. Server-level records
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | Default destination | created automatically |
+| ➕ | Second standalone destination | extra Docker network, one resource on it |
+| ➕ | Server shared variables | 2 variables, one multiline, one literal, one with a comment |
+| ➕ | SSL certificates | CA certificate (created automatically) + a database with SSL on (creates a server certificate) |
+| ✅ | GitHub runner config | labels, max runners 2, docker mode `dind`, image, CPU/memory limits, 3 timeouts, PR jobs off, dedicated on, uses the team GitHub App (see 4). Expected: on the target it is **disabled** and the checklist says to enable it |
+
+## 4. Team credentials the server uses
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | Server private key | |
+| ➕ | Deploy key | a second private key used by an application (git over SSH) |
+| ✅ | GitHub App (team, not system-wide) | with runner fields (`organization_self_hosted_runners`, `actions`, `webhook_events`, `runner_group_id`). Expected: checklist step for Webhook/Setup/Callback URL |
+| ➕ | GitLab App (team) | used by one application. Expected: checklist step for the webhook URL |
+| ➕ | S3 storage | the dev MinIO service (the VM must reach it), used by a database backup and a volume backup |
+| ✅ | Cloudflare integration token | for DNS zones and the tunnel |
+| ✅ | Secret manager token | Infisical, Doppler, or Vault |
+| ⚠️ | Cloud provider token | only with a real cloud server |
+
+## 5. Projects and environments
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | 2 projects, 2 environments | for example production and staging |
+| ✅/➕ | Project / environment shared variables | the seed tries to create them; check that they exist |
+| ✅ | Team shared variable | `TEAM_KEY`, used as `{{team.TEAM_KEY}}` in an application variable. Expected: created on the target |
+| ✅ | Project description + icon (JPEG) | Expected: the icon is on the target |
+| ✅ | Canvas positions | drag the nodes on the environment canvas |
+| ✅ | Resource links | a link between 2 resources on this server, and a link to a resource on another server. Expected: the first moves, the second does not, and the export warns |
+| ✅ | Environment with resources only on another server | Expected: it is not exported, and the prechecks show a `NOTE:` line |
+
+## 6. Applications (one per build pack and source)
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | Docker image app (whoami) | |
+| ✅ | Dockerfile app | |
+| ➕ | Nixpacks app, public GitHub repo | Expected: checklist step for manual webhooks |
+| ➕ | Static app (`is_static`, `is_spa`) | |
+| ➕ | Docker Compose app | raw compose on, one variable with an empty value (`preserve_compose_null`) |
+| ➕ | App with GitHub App source, app with GitLab App source, app with deploy key | |
+| ➕ | Domains | 2 domains, noindex domains, domain port overrides, preview URL template |
+| ➕ | Health check | custom path, port, method, return code, interval, retries, start period |
+| ➕ | Limits | memory, swap, swappiness, reservation, CPUs, cpuset, CPU shares |
+| ➕ | Advanced | custom labels, custom docker run options, pre/post deployment command + container, manual webhook secrets |
+| ✅ | Maintenance | maintenance mode on + custom maintenance page |
+| ➕ | All application settings that are not the default | git submodules, LFS, shallow clone, auto deploy off, force HTTPS, debug, preview deployments on, PR deployments public, log drain, GPU (driver, count, device IDs, options), include timestamps, swarm-only worker nodes, build server, consistent container name, gzip off, strip prefix off, connect to Docker network, custom internal name, container label escape off, env sorting, read-only labels, preserve repository, disable build cache, use build secrets, stop grace period 30, inject build args off, include source commit, Docker images to keep 5, custom container name prefix, redact env values in logs, Coolify default variables off, Traefik certificate resolver |
+| ➕ | Environment variables | normal, multiline, literal, shown once, build time only, runtime only, required, with comment, preview-only, and references to `{{team.*}}`, `{{project.*}}`, `{{environment.*}}`, `{{server.*}}` |
+| ✅/➕ | Persistent volume | the seed has one; add a host-path bind mount and preview suffix on |
+| ➕ | File mount + directory mount | content, chown, chmod |
+| ➕ | Volume backup | on the persistent volume: S3 on, stop during backup, all retention values, timeout, missing-backup days |
+| ✅/➕ | Scheduled tasks | the seed has one; add a disabled one with container + timeout |
+| ✅ | Tag | |
+| ➕ | Preview deployment | PR preview with domain port overrides + max restart count (needs the GitHub App, or create it in the database) |
+| ✅ | Secret manager link | the app loads variables from the secret manager token |
+| ✅ | Managed DNS record | owned record in the Cloudflare zone for the app domain. Expected: the target takes ownership (provider comment changes) |
+
+## 7. Databases (one of each of the 9 types)
+
+| ✓ | Type | Extra settings |
+|---|---|---|
+| ✅ | PostgreSQL | + init script, `postgres_conf`, host auth method, SSL on + mode |
+| ➕ | MySQL | + `mysql_conf`, SSL |
+| ✅ | MariaDB | + `mariadb_conf`, SSL |
+| ➕ | MongoDB | + `mongo_conf`, SSL |
+| ✅ | Redis | + `redis_conf`, SSL |
+| ➕ | KeyDB, Dragonfly, ClickHouse | defaults are enough, plus the common settings below |
+| ➕ | SQLite | database files list, volume link |
+
+Common settings on at least one database: custom image, public port + public on + public port timeout, limits, custom docker run options, health check values, log drain, include timestamps, redact env values, Coolify default variables off, environment variables, persistent volume + volume backup, tags, secret manager link (if the type supports it).
+
+Database backups (✅ one exists): add S3 on, dump all, databases list, local and S3 retention (amount, days, max storage), timeout, disable local backup, missing-backup days.
+
+## 8. Services
+
+| ✓ | What | Notes |
+|---|---|---|
+| ✅ | One-click service (uptime-kuma) | |
+| ➕ | Custom compose service with an app and a database part | |
+| ➕ | Service app settings | domain, gzip off, strip prefix off, force HTTPS, exclude from status, redirect, port overrides, log drain, custom image, Traefik resolver |
+| ➕ | Service database settings | public port + public on, custom type |
+| ➕ | Service level | connect to network, label escape off, redact env values, Coolify default variables off, maintenance mode + page, environment variables, scheduled task, tags, volume backup on a service volume |
+
+## 9. After the transfer, check
+
+- Transfer log: every check `OK`, the `NOTE:` line for the shared project.
+- "After the transfer" checklist: GitHub App URLs, GitLab webhook, manual webhooks, GitHub runners. All URLs use the public URL of the target.
+- Target: every item above has the same value. Runner config disabled. DNS records owned by the target.
+- Source: the server is an archive, the runner config is disabled, and no DNS records are tracked.
+- Delete the archive on the source: the containers, DNS records, and GitHub runners are not changed.
diff --git a/openapi.json b/openapi.json
index 102181f7c0..db7af84045 100644
--- a/openapi.json
+++ b/openapi.json
@@ -846,7 +846,7 @@
                                     },
                                     "watch_paths": {
                                         "type": "string",
-                                        "description": "The watch paths."
+                                        "description": "Watch path patterns, one per line (newline-separated). Commas do not separate patterns."
                                     },
                                     "use_build_server": {
                                         "type": "boolean",
@@ -1476,7 +1476,7 @@
                                     },
                                     "watch_paths": {
                                         "type": "string",
-                                        "description": "The watch paths."
+                                        "description": "Watch path patterns, one per line (newline-separated). Commas do not separate patterns."
                                     },
                                     "use_build_server": {
                                         "type": "boolean",
@@ -2106,7 +2106,7 @@
                                     },
                                     "watch_paths": {
                                         "type": "string",
-                                        "description": "The watch paths."
+                                        "description": "Watch path patterns, one per line (newline-separated). Commas do not separate patterns."
                                     },
                                     "use_build_server": {
                                         "type": "boolean",
@@ -3586,18 +3586,6 @@
                         "application\/json": {
                             "schema": {
                                 "properties": {
-                                    "project_uuid": {
-                                        "type": "string",
-                                        "description": "The project UUID."
-                                    },
-                                    "server_uuid": {
-                                        "type": "string",
-                                        "description": "The server UUID."
-                                    },
-                                    "environment_name": {
-                                        "type": "string",
-                                        "description": "The environment name."
-                                    },
                                     "github_app_uuid": {
                                         "type": "string",
                                         "description": "The Github App UUID."
@@ -3614,10 +3602,6 @@
                                         "type": "string",
                                         "description": "The ports to expose."
                                     },
-                                    "destination_uuid": {
-                                        "type": "string",
-                                        "description": "The destination UUID."
-                                    },
                                     "build_pack": {
                                         "type": "string",
                                         "enum": [
@@ -3887,7 +3871,7 @@
                                     },
                                     "watch_paths": {
                                         "type": "string",
-                                        "description": "The watch paths."
+                                        "description": "Watch path patterns, one per line (newline-separated). Commas do not separate patterns."
                                     },
                                     "use_build_server": {
                                         "type": "boolean",
@@ -7302,6 +7286,10 @@
                                         "type": "integer",
                                         "description": "CPU shares of the database"
                                     },
+                                    "instant_deploy": {
+                                        "type": "boolean",
+                                        "description": "Restart the database after the update. Requires the deploy ability."
+                                    },
                                     "postgres_user": {
                                         "type": "string",
                                         "description": "PostgreSQL user"
@@ -13120,6 +13108,9 @@
                     "401": {
                         "$ref": "#\/components\/responses\/401"
                     },
+                    "403": {
+                        "description": "The token needs the deploy ability to set post_install_script_id or public_key_ids."
+                    },
                     "422": {
                         "description": "Validation failed."
                     },
@@ -17655,6 +17646,304 @@
                 ]
             }
         },
+        "\/servers\/{uuid}\/migrate": {
+            "post": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Migrate server to another Coolify instance",
+                "description": "Start a transfer in the background: export this server, import and claim it on the target instance (with the given token), then disable automations here. Follow the progress with GET \/servers\/{uuid}\/transfer. The target URL must use https. Requires read:sensitive and write.",
+                "operationId": "migrate-server-between-instances",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "target_url",
+                                    "target_token"
+                                ],
+                                "properties": {
+                                    "target_url": {
+                                        "type": "string",
+                                        "example": "https:\/\/coolify-b.example.com"
+                                    },
+                                    "target_token": {
+                                        "description": "API token on the target instance (root or write)",
+                                        "type": "string"
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "202": {
+                        "description": "Transfer started"
+                    },
+                    "403": {
+                        "description": "Missing sensitive permission"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "description": "Validation or remote import failed"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/{uuid}\/transfer": {
+            "get": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Get server transfer status",
+                "description": "Show the transfer state of a server on this instance: the import\/claim state (transfer) and the state of a running or finished transfer to another instance (migration).",
+                "operationId": "get-server-transfer-status",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Transfer status"
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/import\/check": {
+            "get": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Check server import",
+                "description": "Check that this instance can import a server, before the source instance starts the transfer. It checks the token, the bundle version, the server limit, servers with the same UUID or IP, and that this instance can reach the SSH port of the server.",
+                "operationId": "check-server-import",
+                "parameters": [
+                    {
+                        "name": "server_uuid",
+                        "in": "query",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "ip",
+                        "in": "query",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "port",
+                        "in": "query",
+                        "required": false,
+                        "schema": {
+                            "type": "integer",
+                            "default": 22
+                        }
+                    },
+                    {
+                        "name": "schema_version",
+                        "in": "query",
+                        "required": false,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    },
+                    {
+                        "name": "system_github_apps[]",
+                        "in": "query",
+                        "description": "UUIDs of system-wide GitHub Apps that the server uses. The response lists the ones this instance does not have.",
+                        "required": false,
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    },
+                    {
+                        "name": "system_gitlab_apps[]",
+                        "in": "query",
+                        "description": "UUIDs of system-wide GitLab Apps that the server uses. The response lists the ones this instance does not have.",
+                        "required": false,
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "The server can be imported. Lists every check with its result."
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "422": {
+                        "description": "One or more checks failed. Lists every check with its result."
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/import": {
+            "post": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Import server transfer bundle",
+                "description": "Import a server transfer bundle into this Coolify instance (adopt mode by default). This instance then manages the server, and Sentinel reports to it.",
+                "operationId": "import-server-transfer-bundle",
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "properties": {
+                                    "bundle": {
+                                        "description": "Transfer bundle",
+                                        "type": "object"
+                                    },
+                                    "dry_run": {
+                                        "type": "boolean",
+                                        "default": false
+                                    },
+                                    "preserve_uuids": {
+                                        "type": "boolean",
+                                        "default": true
+                                    },
+                                    "adopt_mode": {
+                                        "description": "Import without forcing redeploy; keep statuses for adoption",
+                                        "type": "boolean",
+                                        "default": true
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": "Dry-run result"
+                    },
+                    "201": {
+                        "description": "Imported"
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "422": {
+                        "description": "Validation failed"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/servers\/{uuid}\/transfer\/complete": {
+            "post": {
+                "tags": [
+                    "Servers"
+                ],
+                "summary": "Mark server transferred",
+                "description": "Source-instance recovery step: disable automations here when the target already manages the server but the transfer could not finish on this instance.",
+                "operationId": "complete-server-transfer",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "properties": {
+                                    "export_id": {
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
+                                    },
+                                    "target_instance_url": {
+                                        "type": [
+                                            "string",
+                                            "null"
+                                        ]
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": "Marked transferred"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/servers": {
             "get": {
                 "tags": [
@@ -19651,6 +19940,11 @@
                                         "type": "string",
                                         "description": "The base64 encoded Docker Compose content."
                                     },
+                                    "connect_to_docker_network": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Connect the service to the predefined docker network."
+                                    },
                                     "urls": {
                                         "type": "array",
                                         "description": "Array of URLs to be applied to containers of a service.",
diff --git a/openapi.yaml b/openapi.yaml
index 49cc639bd7..cbfb3b6131 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -542,7 +542,7 @@ paths:
                   items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' }, redirect: { type: string, nullable: true, description: 'Per-service www/non-www redirect for this compose service.', enum: [www, non-www, both] } }, type: object }
                 watch_paths:
                   type: string
-                  description: 'The watch paths.'
+                  description: 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'
                 use_build_server:
                   type: boolean
                   nullable: true
@@ -958,7 +958,7 @@ paths:
                   items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' }, redirect: { type: string, nullable: true, description: 'Per-service www/non-www redirect for this compose service.', enum: [www, non-www, both] } }, type: object }
                 watch_paths:
                   type: string
-                  description: 'The watch paths.'
+                  description: 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'
                 use_build_server:
                   type: boolean
                   nullable: true
@@ -1374,7 +1374,7 @@ paths:
                   items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' }, redirect: { type: string, nullable: true, description: 'Per-service www/non-www redirect for this compose service.', enum: [www, non-www, both] } }, type: object }
                 watch_paths:
                   type: string
-                  description: 'The watch paths.'
+                  description: 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'
                 use_build_server:
                   type: boolean
                   nullable: true
@@ -2369,15 +2369,6 @@ paths:
           application/json:
             schema:
               properties:
-                project_uuid:
-                  type: string
-                  description: 'The project UUID.'
-                server_uuid:
-                  type: string
-                  description: 'The server UUID.'
-                environment_name:
-                  type: string
-                  description: 'The environment name.'
                 github_app_uuid:
                   type: string
                   description: 'The Github App UUID.'
@@ -2390,9 +2381,6 @@ paths:
                 ports_exposes:
                   type: string
                   description: 'The ports to expose.'
-                destination_uuid:
-                  type: string
-                  description: 'The destination UUID.'
                 build_pack:
                   type: string
                   enum: [nixpacks, railpack, static, dockerfile, dockercompose]
@@ -2572,7 +2560,7 @@ paths:
                   items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' }, redirect: { type: string, nullable: true, description: 'Per-service www/non-www redirect for this compose service.', enum: [www, non-www, both] } }, type: object }
                 watch_paths:
                   type: string
-                  description: 'The watch paths.'
+                  description: 'Watch path patterns, one per line (newline-separated). Commas do not separate patterns.'
                 use_build_server:
                   type: boolean
                   nullable: true
@@ -4715,6 +4703,9 @@ paths:
                 limits_cpu_shares:
                   type: integer
                   description: 'CPU shares of the database'
+                instant_deploy:
+                  type: boolean
+                  description: 'Restart the database after the update. Requires the deploy ability.'
                 postgres_user:
                   type: string
                   description: 'PostgreSQL user'
@@ -8411,6 +8402,8 @@ paths:
           description: 'Hostinger VPS purchased and linked to a Coolify server.'
         '401':
           $ref: '#/components/responses/401'
+        '403':
+          description: 'The token needs the deploy ability to set post_install_script_id or public_key_ids.'
         '422':
           description: 'Validation failed.'
         '429':
@@ -11144,6 +11137,204 @@ paths:
       security:
         -
           bearerAuth: []
+  '/servers/{uuid}/migrate':
+    post:
+      tags:
+        - Servers
+      summary: 'Migrate server to another Coolify instance'
+      description: 'Start a transfer in the background: export this server, import and claim it on the target instance (with the given token), then disable automations here. Follow the progress with GET /servers/{uuid}/transfer. The target URL must use https. Requires read:sensitive and write.'
+      operationId: migrate-server-between-instances
+      parameters:
+        -
+          name: uuid
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - target_url
+                - target_token
+              properties:
+                target_url:
+                  type: string
+                  example: 'https://coolify-b.example.com'
+                target_token:
+                  description: 'API token on the target instance (root or write)'
+                  type: string
+              type: object
+      responses:
+        '202':
+          description: 'Transfer started'
+        '403':
+          description: 'Missing sensitive permission'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          description: 'Validation or remote import failed'
+      security:
+        -
+          bearerAuth: []
+  '/servers/{uuid}/transfer':
+    get:
+      tags:
+        - Servers
+      summary: 'Get server transfer status'
+      description: 'Show the transfer state of a server on this instance: the import/claim state (transfer) and the state of a running or finished transfer to another instance (migration).'
+      operationId: get-server-transfer-status
+      parameters:
+        -
+          name: uuid
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'Transfer status'
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      security:
+        -
+          bearerAuth: []
+  /servers/import/check:
+    get:
+      tags:
+        - Servers
+      summary: 'Check server import'
+      description: 'Check that this instance can import a server, before the source instance starts the transfer. It checks the token, the bundle version, the server limit, servers with the same UUID or IP, and that this instance can reach the SSH port of the server.'
+      operationId: check-server-import
+      parameters:
+        -
+          name: server_uuid
+          in: query
+          required: true
+          schema:
+            type: string
+        -
+          name: ip
+          in: query
+          required: true
+          schema:
+            type: string
+        -
+          name: port
+          in: query
+          required: false
+          schema:
+            type: integer
+            default: 22
+        -
+          name: schema_version
+          in: query
+          required: false
+          schema:
+            type: integer
+        -
+          name: 'system_github_apps[]'
+          in: query
+          description: 'UUIDs of system-wide GitHub Apps that the server uses. The response lists the ones this instance does not have.'
+          required: false
+          schema:
+            type: array
+            items:
+              type: string
+        -
+          name: 'system_gitlab_apps[]'
+          in: query
+          description: 'UUIDs of system-wide GitLab Apps that the server uses. The response lists the ones this instance does not have.'
+          required: false
+          schema:
+            type: array
+            items:
+              type: string
+      responses:
+        '200':
+          description: 'The server can be imported. Lists every check with its result.'
+        '401':
+          $ref: '#/components/responses/401'
+        '422':
+          description: 'One or more checks failed. Lists every check with its result.'
+      security:
+        -
+          bearerAuth: []
+  /servers/import:
+    post:
+      tags:
+        - Servers
+      summary: 'Import server transfer bundle'
+      description: 'Import a server transfer bundle into this Coolify instance (adopt mode by default). This instance then manages the server, and Sentinel reports to it.'
+      operationId: import-server-transfer-bundle
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              properties:
+                bundle:
+                  description: 'Transfer bundle'
+                  type: object
+                dry_run:
+                  type: boolean
+                  default: false
+                preserve_uuids:
+                  type: boolean
+                  default: true
+                adopt_mode:
+                  description: 'Import without forcing redeploy; keep statuses for adoption'
+                  type: boolean
+                  default: true
+              type: object
+      responses:
+        '200':
+          description: 'Dry-run result'
+        '201':
+          description: Imported
+        '401':
+          $ref: '#/components/responses/401'
+        '422':
+          description: 'Validation failed'
+      security:
+        -
+          bearerAuth: []
+  '/servers/{uuid}/transfer/complete':
+    post:
+      tags:
+        - Servers
+      summary: 'Mark server transferred'
+      description: 'Source-instance recovery step: disable automations here when the target already manages the server but the transfer could not finish on this instance.'
+      operationId: complete-server-transfer
+      parameters:
+        -
+          name: uuid
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                export_id:
+                  type: [string, 'null']
+                target_instance_url:
+                  type: [string, 'null']
+              type: object
+      responses:
+        '200':
+          description: 'Marked transferred'
+        '404':
+          $ref: '#/components/responses/404'
+      security:
+        -
+          bearerAuth: []
   /servers:
     get:
       tags:
@@ -12429,6 +12620,10 @@ paths:
                 docker_compose_raw:
                   type: string
                   description: 'The base64 encoded Docker Compose content.'
+                connect_to_docker_network:
+                  type: boolean
+                  default: false
+                  description: 'Connect the service to the predefined docker network.'
                 urls:
                   type: array
                   description: 'Array of URLs to be applied to containers of a service.'
diff --git a/other/nightly/install.sh b/other/nightly/install.sh
index 5b5d74f1b1..ebd309a021 100755
--- a/other/nightly/install.sh
+++ b/other/nightly/install.sh
@@ -7,7 +7,7 @@
 ## ROOT_USER_PASSWORD - Predefined root user password
 ## DOCKER_ADDRESS_POOL_BASE - Custom Docker address pool base (default: 10.0.0.0/8)
 ## DOCKER_ADDRESS_POOL_SIZE - Custom Docker address pool size (default: 24)
-## DOCKER_POOL_FORCE_OVERRIDE - Force override Docker address pool configuration (default: false)
+## DOCKER_POOL_FORCE_OVERRIDE - Force override Docker address pool configuration, also when Docker must restart with running containers (default: false)
 ## AUTOUPDATE - Set to "false" to disable auto-updates
 ## REGISTRY_URL - Custom registry URL for Docker images (default: docker.io)
 
@@ -31,14 +31,21 @@ fi
 
 # Resource directories hold data whose owner and mode the resource images or a non-root SSH user need.
 # Set their owner and mode only when they are created, never on an upgrade (#11945).
-for COOLIFY_DIRECTORY in /data/coolify /data/coolify/{applications,databases,backups,services,proxy,proxy/dynamic,sentinel}; do
-    if [ ! -d "$COOLIFY_DIRECTORY" ]; then
-        mkdir -p "$COOLIFY_DIRECTORY"
-        chown 9999:root "$COOLIFY_DIRECTORY"
-        chmod 700 "$COOLIFY_DIRECTORY"
+create_data_directory() {
+    if [ ! -d "$1" ]; then
+        mkdir -p "$1"
+        chown 9999:root "$1"
+        chmod 700 "$1"
     fi
-done
-mkdir -p /data/coolify/source /data/coolify/images /data/coolify/ssh/{keys,mux}
+}
+
+# Run only after the checks and downloads succeed, so a failed run does not change the data directories (#11973).
+create_coolify_directories() {
+    for COOLIFY_DIRECTORY in /data/coolify/{applications,databases,backups,services,proxy,proxy/dynamic,sentinel}; do
+        create_data_directory "$COOLIFY_DIRECTORY"
+    done
+    mkdir -p /data/coolify/images /data/coolify/ssh/{keys,mux}
+}
 
 # Coolify's own directories, used by the coolify container (UID 9999)
 set_coolify_directory_permissions() {
@@ -46,7 +53,9 @@ set_coolify_directory_permissions() {
     chmod -R 700 /data/coolify/{source,ssh,images}
 }
 
-set_coolify_directory_permissions
+# The installation log and the downloaded files go to /data/coolify/source, so only it is created before the checks.
+create_data_directory /data/coolify
+mkdir -p /data/coolify/source
 
 INSTALLATION_LOG_WITH_DATE="/data/coolify/source/installation-${DATE}.log"
 
@@ -828,131 +837,39 @@ step_done "${DOCKER_SERVER_VERSION:+v$DOCKER_SERVER_VERSION}"
 
 step_start "Configuring Docker daemon" "log rotation · address pools"
 
-echo " - Network pool configuration: ${DOCKER_ADDRESS_POOL_BASE}/${DOCKER_ADDRESS_POOL_SIZE}"
-echo " - To override existing configuration: DOCKER_POOL_FORCE_OVERRIDE=true"
-
-mkdir -p /etc/docker
-
-# Backup original daemon.json if it exists
-if [ -f /etc/docker/daemon.json ]; then
-    cp /etc/docker/daemon.json /etc/docker/daemon.json.original-"$DATE"
-fi
-
-# Create coolify configuration with or without address pools based on whether they were explicitly provided
+# Changing daemon.json needs a Docker restart, which stops every running container.
+# Coolify sets log rotation and the network pool only when no pool is configured or DOCKER_POOL_FORCE_OVERRIDE=true,
+# keeps all other keys, and does not restart a Docker daemon with running containers unless DOCKER_POOL_FORCE_OVERRIDE=true.
 if [ "$DOCKER_POOL_FORCE_OVERRIDE" = true ] || [ "$EXISTING_POOL_CONFIGURED" = false ]; then
-    # First check if the configuration would actually change anything
-    if [ -f /etc/docker/daemon.json ]; then
-        CURRENT_POOL_BASE=$(jq -r '.["default-address-pools"][0].base' /etc/docker/daemon.json 2>/dev/null)
-        CURRENT_POOL_SIZE=$(jq -r '.["default-address-pools"][0].size' /etc/docker/daemon.json 2>/dev/null)
-
-        if [ "$CURRENT_POOL_BASE" = "$DOCKER_ADDRESS_POOL_BASE" ] && [ "$CURRENT_POOL_SIZE" = "$DOCKER_ADDRESS_POOL_SIZE" ]; then
-            echo " - Network pool configuration unchanged, skipping update"
-            NEED_MERGE=false
+    mkdir -p /etc/docker
+    CURRENT_DAEMON_CONFIG='{}'
+    if [ -s /etc/docker/daemon.json ] && ! CURRENT_DAEMON_CONFIG=$(jq -S . /etc/docker/daemon.json 2>/dev/null); then
+        CURRENT_DAEMON_CONFIG=""
+    fi
+    if [ -z "$CURRENT_DAEMON_CONFIG" ]; then
+        warn "Docker daemon configuration not changed: /etc/docker/daemon.json is not valid JSON."
+    else
+        NEW_DAEMON_CONFIG=$(jq -S --arg base "$DOCKER_ADDRESS_POOL_BASE" --argjson size "$DOCKER_ADDRESS_POOL_SIZE" \
+            '. * {"log-driver": "json-file", "log-opts": {"max-size": "10m", "max-file": "3"}, "default-address-pools": [{"base": $base, "size": $size}]}' <<<"$CURRENT_DAEMON_CONFIG")
+        RUNNING_CONTAINERS=$({ docker ps -q 2>/dev/null || true; } | wc -l)
+        if [ "$NEW_DAEMON_CONFIG" = "$CURRENT_DAEMON_CONFIG" ]; then
+            echo " - Configuration is up to date"
+        elif [ "$RUNNING_CONTAINERS" -gt 0 ] && [ "$DOCKER_POOL_FORCE_OVERRIDE" != true ]; then
+            warn "Docker daemon configuration not changed: log rotation and the ${DOCKER_ADDRESS_POOL_BASE} (size ${DOCKER_ADDRESS_POOL_SIZE}) network pool need a Docker restart, which stops ${RUNNING_CONTAINERS} running container(s) and can change the docker0 bridge IP. To apply it, run the installer again with DOCKER_POOL_FORCE_OVERRIDE=true."
+            UI_STEP_DETAIL="skipped · containers running"
         else
-            # If force override is enabled or no existing configuration exists,
-            # create a new configuration with the specified address pools
-            echo " - Creating new Docker configuration with network pool: ${DOCKER_ADDRESS_POOL_BASE}/${DOCKER_ADDRESS_POOL_SIZE}"
-            cat >/etc/docker/daemon.json <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  },
-  "default-address-pools": [
-    {"base":"${DOCKER_ADDRESS_POOL_BASE}","size":${DOCKER_ADDRESS_POOL_SIZE}}
-  ]
-}
-EOL
-            NEED_MERGE=true
-        fi
-    else
-        # No existing configuration, create new one
-        echo " - Creating new Docker configuration with network pool: ${DOCKER_ADDRESS_POOL_BASE}/${DOCKER_ADDRESS_POOL_SIZE}"
-        cat >/etc/docker/daemon.json <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  },
-  "default-address-pools": [
-    {"base":"${DOCKER_ADDRESS_POOL_BASE}","size":${DOCKER_ADDRESS_POOL_SIZE}}
-  ]
-}
-EOL
-        NEED_MERGE=true
-    fi
-else
-    # Check if we need to update log settings
-    if [ -f /etc/docker/daemon.json ] && jq -e '.["log-driver"] == "json-file" and .["log-opts"]["max-size"] == "10m" and .["log-opts"]["max-file"] == "3"' /etc/docker/daemon.json >/dev/null 2>&1; then
-        echo " - Log configuration is up to date"
-        NEED_MERGE=false
-    else
-        # Create a configuration without address pools to preserve existing ones
-        cat >/etc/docker/daemon.json.coolify <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  }
-}
-EOL
-        NEED_MERGE=true
-    fi
-fi
-
-# Remove the duplicate daemon.json creation since we handle it above
-if ! [ -f /etc/docker/daemon.json ]; then
-    # If no daemon.json exists, create it with default settings
-    cat >/etc/docker/daemon.json <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  },
-  "default-address-pools": [
-    {"base":"${DOCKER_ADDRESS_POOL_BASE}","size":${DOCKER_ADDRESS_POOL_SIZE}}
-  ]
-}
-EOL
-    NEED_MERGE=false
-fi
-
-if [ -s /etc/docker/daemon.json.original-"$DATE" ]; then
-    DIFF=$(diff <(jq --sort-keys . /etc/docker/daemon.json) <(jq --sort-keys . /etc/docker/daemon.json.original-"$DATE") || true)
-    if [ "$DIFF" != "" ]; then
-        echo " - Checking configuration changes..."
-
-        # Check if address pools were changed
-        if echo "$DIFF" | grep -q "default-address-pools"; then
-            if [ "$DOCKER_POOL_BASE_PROVIDED" = true ] || [ "$DOCKER_POOL_SIZE_PROVIDED" = true ]; then
-                echo " - Network pool updated per user request"
-            else
-                echo " - Warning: Network pool modified without explicit request"
+            if [ -f /etc/docker/daemon.json ]; then
+                cp /etc/docker/daemon.json /etc/docker/daemon.json.original-"$DATE"
             fi
-        fi
-
-        # Remove this redundant restart since we already restarted when writing the config
-        echo " - Configuration changes confirmed"
-        if [ "$NEED_MERGE" = true ]; then
+            printf '%s\n' "$NEW_DAEMON_CONFIG" >/etc/docker/daemon.json
+            echo " - Network pool configuration: ${DOCKER_ADDRESS_POOL_BASE} (size ${DOCKER_ADDRESS_POOL_SIZE})"
             echo " - Configuration updated - restarting Docker daemon..."
             restart_docker_service
-        else
-            echo " - Configuration is up to date"
         fi
-    else
-        echo " - Configuration is up to date"
     fi
 else
-    if [ "$NEED_MERGE" = true ]; then
-        echo " - Configuration updated - restarting Docker daemon..."
-        restart_docker_service
-    else
-        echo " - Configuration is up to date"
-    fi
+    echo " - Using the existing network pool ${DOCKER_ADDRESS_POOL_BASE} (size ${DOCKER_ADDRESS_POOL_SIZE})"
+    echo " - To override it: DOCKER_POOL_FORCE_OVERRIDE=true"
 fi
 
 step_done
@@ -1070,6 +987,7 @@ step_done
 
 step_start "Checking SSH key for localhost access"
 SSH_KEY_DETAIL="existing key"
+create_coolify_directories
 if [ ! -f ~/.ssh/authorized_keys ]; then
     mkdir -p ~/.ssh
     chmod 700 ~/.ssh
diff --git a/other/nightly/upgrade.sh b/other/nightly/upgrade.sh
index ce8fdb6589..4d594cb9e9 100644
--- a/other/nightly/upgrade.sh
+++ b/other/nightly/upgrade.sh
@@ -38,6 +38,65 @@ write_status() {
     echo "${step}|${message}|$(date -Iseconds)" > "$STATUS_FILE"
 }
 
+# Print the first gateway of a network that Docker reports with a prefix length (fd00::1/64).
+# Docker Engine 27.0 to 28.0.0 does this for IPv6 until the daemon restarts (https://github.com/moby/moby/pull/49520).
+# The Docker CLI and Compose in the helper image fail on such a network with a ParseAddr error.
+network_gateway_with_prefix() {
+    docker network inspect "$1" --format '{{range .IPAM.Config}}{{.Gateway}} {{end}}' 2>&1 | grep -oE '[0-9A-Fa-f:.]+/[0-9]+' | head -n1
+}
+
+# Make sure the coolify network exists and the helper image can read it.
+# It is created when starting Coolify with docker compose
+ensure_coolify_network() {
+    log "Checking Docker network 'coolify'..."
+    if ! docker network inspect coolify >/dev/null 2>&1; then
+        log "Network 'coolify' does not exist, creating..."
+        if ! docker network create --attachable --ipv6 coolify 2>/dev/null; then
+            log "Failed to create network with IPv6, trying without IPv6..."
+            docker network create --attachable coolify 2>/dev/null
+            log "Network 'coolify' created without IPv6"
+        elif [ -n "$(network_gateway_with_prefix coolify)" ]; then
+            # No container uses the new network yet, so it is safe to recreate it.
+            log "Docker reports the IPv6 gateway of network 'coolify' with a prefix length, recreating it without IPv6..."
+            docker network rm coolify >/dev/null 2>&1
+            docker network create --attachable coolify 2>/dev/null
+            log "Network 'coolify' created without IPv6"
+        else
+            log "Network 'coolify' created with IPv6 support"
+        fi
+        return 0
+    fi
+
+    log "Network 'coolify' already exists"
+    local gateway
+    gateway=$(network_gateway_with_prefix coolify)
+    if [ -n "$gateway" ]; then
+        local message="Docker Engine $(docker version --format '{{.Server.Version}}' 2>/dev/null) reports the gateway of the 'coolify' network as ${gateway}, which Coolify cannot read (Docker Engine bug, fixed in 28.0.1). Run 'systemctl restart docker' (this restarts all containers) or upgrade Docker Engine, then upgrade Coolify again."
+        log "ERROR: ${message}"
+        write_status "error" "$message"
+        echo "     ERROR: ${message}"
+        return 1
+    fi
+}
+
+# Pull an image. Retry with backoff, because the registry can rate limit many instances that pull at the same time.
+pull_image() {
+    local image="$1"
+    local attempt=1
+    local max_attempts=5
+    local delay=15
+    until docker pull "$image" >>"$LOGFILE" 2>&1; do
+        if [ "$attempt" -ge "$max_attempts" ]; then
+            return 1
+        fi
+        log "Pull of $image failed (attempt $attempt/$max_attempts). Retrying in ${delay}s..."
+        echo "     Pull failed (attempt $attempt/$max_attempts). Retrying in ${delay}s..."
+        sleep "$((delay + RANDOM % 10))"
+        attempt=$((attempt + 1))
+        delay=$((delay * 2))
+    done
+}
+
 echo ""
 echo "=========================================="
 echo "   Coolify Upgrade - ${DATE}"
@@ -159,21 +218,7 @@ fi
 log "Environment variables check complete"
 echo "     Done."
 
-# Make sure coolify network exists
-# It is created when starting Coolify with docker compose
-log "Checking Docker network 'coolify'..."
-if ! docker network inspect coolify >/dev/null 2>&1; then
-    log "Network 'coolify' does not exist, creating..."
-    if ! docker network create --attachable --ipv6 coolify 2>/dev/null; then
-        log "Failed to create network with IPv6, trying without IPv6..."
-        docker network create --attachable coolify 2>/dev/null
-        log "Network 'coolify' created without IPv6"
-    else
-        log "Network 'coolify' created with IPv6 support"
-    fi
-else
-    log "Network 'coolify' already exists"
-fi
+ensure_coolify_network || exit 1
 
 mkdir -p /data/coolify/images/{avatars,project-icons}
 chown -R 9999:root /data/coolify/images
@@ -205,7 +250,7 @@ echo "     This may take a few minutes depending on your connection."
 HELPER_IMAGE="${REGISTRY_URL:-docker.io}/coollabsio/coolify-helper:${LATEST_HELPER_VERSION}"
 echo "     - Pulling $HELPER_IMAGE..."
 log "Pulling image: $HELPER_IMAGE"
-if docker pull "$HELPER_IMAGE" >>"$LOGFILE" 2>&1; then
+if pull_image "$HELPER_IMAGE"; then
     log "Successfully pulled $HELPER_IMAGE"
 else
     log "ERROR: Failed to pull $HELPER_IMAGE"
@@ -220,7 +265,7 @@ for IMAGE in $IMAGES; do
     if [ -n "$IMAGE" ]; then
         echo "     - Pulling $IMAGE..."
         log "Pulling image: $IMAGE"
-        if docker pull "$IMAGE" >>"$LOGFILE" 2>&1; then
+        if pull_image "$IMAGE"; then
             log "Successfully pulled $IMAGE"
         else
             log "ERROR: Failed to pull $IMAGE"
@@ -298,8 +343,16 @@ nohup bash -c "
     fi
 
     log 'Running docker compose up...'
-    docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-docker.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env \${COMPOSE_FILES} up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
-    log 'Docker compose up completed'
+    if docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-docker.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env \${COMPOSE_FILES} up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1; then
+        log 'Docker compose up completed'
+    elif [ \"\$(docker inspect --format '{{.State.Running}}' coolify 2>/dev/null)\" = 'true' ]; then
+        # A slow first start (for example long migrations) can pass the wait timeout. Coolify is still starting.
+        log 'Docker compose up did not finish waiting, but the coolify container is running'
+    else
+        log 'ERROR: Docker compose up failed and the coolify container is not running'
+        write_status 'error' \"Coolify did not start. Check the upgrade log: \$LOGFILE\"
+        exit 1
+    fi
 
     # Final log entry
     echo '' >>\"\$LOGFILE\"
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 4165d6831e..7dc784d8e6 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.4.6"
+            "version": "4.5"
         },
         "nightly": {
-            "version": "4.5-rc.1"
+            "version": "4.6-rc.1"
         },
         "helper": {
             "version": "1.0.18"
diff --git a/package-lock.json b/package-lock.json
index fd2834a7b9..4c99d1fa38 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -684,6 +684,72 @@
                 "node": ">=14.0.0"
             }
         },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+            "version": "1.11.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@emnapi/wasi-threads": "1.2.2",
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+            "version": "1.11.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+            "version": "1.2.2",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+            "version": "1.1.4",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@tybys/wasm-util": "^0.10.1"
+            },
+            "funding": {
+                "type": "github",
+                "url": "https://github.com/sponsors/Brooooooklyn"
+            },
+            "peerDependencies": {
+                "@emnapi/core": "^1.7.1",
+                "@emnapi/runtime": "^1.7.1"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+            "version": "0.10.2",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+            "version": "2.8.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "0BSD",
+            "optional": true
+        },
         "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
             "version": "4.3.3",
             "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
@@ -1479,9 +1545,9 @@
             }
         },
         "node_modules/source-map-js": {
-            "version": "1.2.1",
-            "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-            "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+            "version": "1.2.2",
+            "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+            "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
             "dev": true,
             "license": "BSD-3-Clause",
             "engines": {
@@ -1568,14 +1634,6 @@
                 "url": "https://github.com/sponsors/SuperchupuDev"
             }
         },
-        "node_modules/tslib": {
-            "version": "2.8.1",
-            "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-            "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-            "dev": true,
-            "license": "0BSD",
-            "optional": true
-        },
         "node_modules/tw-animate-css": {
             "version": "1.4.0",
             "resolved": "https://registry.npmjs.org/tw-animate-css/-/tw-animate-css-1.4.0.tgz",
diff --git a/resources/css/app.css b/resources/css/app.css
index d752416566..e21e9611ea 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1951,6 +1951,15 @@ html[data-theme="custom"] textarea:disabled {
         grid-column: 2;
     }
 
+    /* A resource menu that the main sidebar shows instead (navbar #main-nav-context-{depth}). */
+    .application-settings-navigation.in-main-nav {
+        display: none;
+    }
+
+    .application-settings-navigation.in-main-nav ~ * {
+        grid-column: 1 / -1;
+    }
+
     html:not(.dark) .application-settings-navigation {
         --rail-fill: var(--coollabs-base);
     }
@@ -1978,7 +1987,7 @@ html[data-theme="custom"] textarea:disabled {
         z-index: 20;
     }
 
-    .app-main-full .application-settings-navigation ~ [data-environment-canvas] {
+    .app-main-full .application-settings-navigation:not(.in-main-nav) ~ [data-environment-canvas] {
         margin-left: calc(210px + 2.5rem);
     }
 
@@ -2097,6 +2106,17 @@ html[data-theme="custom"] textarea:disabled {
     background: transparent;
 }
 
+/* Main sidebar: only the menu scrolls on short or zoomed-in screens; the
+   footer stays visible. Hide the scrollbar so it does not take width from the
+   narrow collapsed rail and push the icons aside. */
+.sidebar-menu {
+    scrollbar-width: none; /* Firefox */
+}
+
+.sidebar-menu::-webkit-scrollbar {
+    display: none; /* Chrome/Safari */
+}
+
 /* Unified resource heading bar: hide tab-strip scrollbars; menus/actions stay overflow-visible for dropdowns */
 .resource-heading-navbar {
     overflow: visible;
@@ -2226,7 +2246,7 @@ html[data-theme="custom"] textarea:disabled {
 .application-heading-actions .button,
 .application-heading-actions .app-tab,
 .application-heading-actions .relative > button[x-ref='trigger'] {
-    height: 1.75rem;
+    height: 2rem;
     display: inline-flex;
     align-items: center;
     gap: 0.375rem;
@@ -2383,11 +2403,6 @@ html[data-theme="custom"] textarea:disabled {
     box-shadow: 0 0 0 1px var(--color-accent);
 }
 
-.application-heading-actions .split-action-main,
-.application-heading-actions .split-action-caret {
-    height: 1.75rem;
-}
-
 /* Custom listbox (replaces native <select>) */
 .listbox-trigger {
     display: flex;
@@ -2713,6 +2728,44 @@ input[type="search"]::-webkit-search-results-decoration {
     grid-template-columns: minmax(14rem, 2.5fr) 4.8rem 6rem 4rem 4.5rem 4.8rem 4.2rem 3rem;
 }
 
+/* File browser: icon, name, perms, size, modified, actions.
+   Every column is a fixed width except the flexible name column, so the
+   header grid and each row grid resolve identical tracks and stay aligned
+   (an `auto` column would size to its own content per row and drift). */
+.file-table-grid {
+    grid-template-columns: 1.75rem minmax(10rem, 1fr) 5rem 6rem 6rem 5rem 11rem 10rem;
+}
+
+@media (max-width: 768px) {
+    .data-table-header.file-table-grid {
+        display: none;
+    }
+
+    .data-table-row.file-table-grid {
+        grid-template-columns: 1.75rem minmax(0, 1fr) 10rem;
+        gap: 0.75rem;
+    }
+
+    /* Hide perms, owner, group, size and modified columns on small screens */
+    .data-table-row.file-table-grid > :nth-child(3),
+    .data-table-row.file-table-grid > :nth-child(4),
+    .data-table-row.file-table-grid > :nth-child(5),
+    .data-table-row.file-table-grid > :nth-child(6),
+    .data-table-row.file-table-grid > :nth-child(7) {
+        display: none;
+    }
+}
+
+/* File browser Monaco editor container: fixed viewport-relative height with a
+   rounded, hairline-framed surface that matches the rest of the settings UI. */
+.file-editor-monaco {
+    height: 60vh;
+    min-height: 320px;
+    overflow: hidden;
+    border-radius: 8px;
+    box-shadow: inset 0 0 0 1px var(--coollabs-line);
+}
+
 .environment-table-scroll {
     overflow-x: auto;
     overscroll-behavior-x: contain;
@@ -3031,13 +3084,14 @@ input[type="search"]::-webkit-search-results-decoration {
     width: 100%;
 }
 
-.data-table-row.service-backup-table-grid {
-    background: var(--coollabs-base);
-    border-bottom: 1px solid var(--coollabs-fill);
+.data-table-header.service-backup-table-grid {
+    border-bottom: 0;
 }
 
-.data-table-row.service-backup-table-grid:last-child {
-    border-bottom: 0;
+/* Rows are reordered with CSS order, so dividers must not depend on DOM position. */
+.data-table-row.service-backup-table-grid {
+    background: var(--coollabs-base);
+    border-top: 1px solid var(--coollabs-fill);
 }
 
 .data-table-row.service-backup-table-grid:hover {
@@ -3225,8 +3279,9 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 }
 
+/* Status and Started only fit a badge and a short "3 hours ago"; the names get the rest. */
 .dashboard-deployment-table-grid {
-    grid-template-columns: minmax(0, 1.2fr) minmax(0, 1fr) minmax(6.25rem, 0.75fr) 10rem 8rem;
+    grid-template-columns: minmax(0, 1.4fr) minmax(0, 1fr) minmax(0, 0.7fr) 6.5rem 6rem;
 }
 
 .team-members-table-grid {
@@ -3287,22 +3342,27 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .backup-executions-table-grid {
-    grid-template-columns: 6.5rem minmax(7rem, 0.8fr) minmax(14rem, 1.5fr) 7rem 5rem 4rem minmax(8rem, 1fr) 5rem;
+    grid-template-columns: 6.5rem minmax(7rem, 0.8fr) minmax(14rem, 1.5fr) 10rem 5rem minmax(8rem, 1fr) 5rem;
     gap: 0.75rem;
-    min-width: 66rem;
+    min-width: 67.5rem;
 }
 
 .backup-executions-table-scroll {
     overflow-x: auto;
 }
 
+/* Match the grid width so the log output spans the full scrolled row. */
+.backup-execution-row {
+    min-width: 67.5rem;
+}
+
 .backup-execution-row:last-child > .data-table-row {
     border-bottom: 0;
 }
 
 .volume-backup-executions-grid {
-    grid-template-columns: 7.5rem minmax(14rem, 1fr) 8.5rem 7rem 9rem minmax(9rem, 0.7fr);
-    min-width: 50rem;
+    grid-template-columns: 7.5rem minmax(14rem, 1fr) 11rem 7rem 9rem minmax(9rem, 0.7fr);
+    min-width: 52.5rem;
 }
 
 .clone-destinations-table-grid {
@@ -3348,11 +3408,10 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 
     .backup-executions-table-grid {
-        grid-template-columns: 7.5rem minmax(9rem, 0.8fr) minmax(14rem, 1.5fr) 8rem 6rem minmax(9rem, auto);
+        grid-template-columns: 7.5rem minmax(9rem, 0.8fr) minmax(14rem, 1.5fr) 10rem minmax(8rem, 1fr) 5rem;
     }
 
-    .backup-executions-table-grid > :nth-child(6),
-    .backup-executions-table-grid > :nth-child(7) {
+    .backup-executions-table-grid > :nth-child(5) {
         display: none;
     }
 }
@@ -3432,15 +3491,18 @@ input[type="search"]::-webkit-search-results-decoration {
         display: none;
     }
 
+    .backup-executions-table-grid,
+    .backup-execution-row {
+        min-width: 42rem;
+    }
+
     .backup-executions-table-grid {
         grid-template-columns: 7.5rem 9rem minmax(14rem, 1fr) minmax(7rem, auto);
-        min-width: 42rem;
     }
 
     .backup-executions-table-grid > :nth-child(4),
     .backup-executions-table-grid > :nth-child(5),
-    .backup-executions-table-grid > :nth-child(6),
-    .backup-executions-table-grid > :nth-child(7) {
+    .backup-executions-table-grid > :nth-child(6) {
         display: none;
     }
 
@@ -5281,18 +5343,24 @@ a.command-palette-item:focus-visible {
    has no background. Applies to both navigation styles. Appearance →
    Navigation items → Flat sets data-nav-items="flat" on <html> and turns these
    rules off, which brings back the plain rows. */
-html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle) {
+html:where(:not([data-nav-items="flat"])) .menu-item:not(.sidebar-toggle) {
     height: 2.5rem;
     padding-left: 0.25rem;
 }
 
+/* In-page section rows have no icon tile, so they stay compact. */
+html:where(:not([data-nav-items="flat"])) .menu-subitem {
+    height: 1.75rem;
+}
+
 /* Only the icon tile reacts: no row background on hover or for the current
    item; the current item shows through its tile and its brighter label.
    In the utilities layer so it can beat the search row's !bg-* utilities
    (a layered !important wins over an unlayered one). */
 @layer utilities {
-    html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle),
-    html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):hover {
+    /* The submenu Back row (navbar) keeps its fill. */
+    html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle, .menu-back),
+    html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle, .menu-back):hover {
         background-color: transparent !important;
     }
 
@@ -5337,6 +5405,13 @@ html.dark:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subi
     --button-depth-color: color-mix(in oklab, var(--color-warning) 35%, transparent) !important;
 }
 
+/* Danger Zone icons (<x-reicon name="danger">) stay red, also when active. */
+html:where(:not([data-nav-items="flat"])) :is(.menu-item-active, .menu-subitem-active) .menu-item-icon.text-error {
+    color: var(--color-error);
+    border-color: color-mix(in oklab, var(--color-error) 45%, transparent) !important;
+    --button-depth-color: color-mix(in oklab, var(--color-error) 40%, transparent) !important;
+}
+
 html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle):focus-visible {
     outline: none;
 }
@@ -5346,6 +5421,47 @@ html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.si
     outline-offset: 2px;
 }
 
+/* Sidebar menu swap: a deeper menu (submenu, resource menu) enters from the right, a lower one from the left.
+   CSS animations restart when an element is shown again, so x-show replays them on each swap. */
+@keyframes nav-swap-forward {
+    from {
+        opacity: 0;
+        transform: translateX(0.5rem);
+    }
+}
+
+@keyframes nav-swap-back {
+    from {
+        opacity: 0;
+        transform: translateX(-0.5rem);
+    }
+}
+
+.nav-swap-forward {
+    animation: nav-swap-forward 150ms ease-out;
+}
+
+.nav-swap-back {
+    animation: nav-swap-back 150ms ease-out;
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .nav-swap-forward,
+    .nav-swap-back {
+        animation: none;
+    }
+}
+
+/* Submenu Back chevron box: one icon wide (flat), or one icon tile wide (16px + padding + border). */
+.menu-back-icon {
+    width: 1rem;
+    height: 1rem;
+}
+
+html:where(:not([data-nav-items="flat"])) .menu-back-icon {
+    width: calc(1rem + 0.875rem + 2px);
+}
+
 html:where(:not([data-nav-items="flat"])) :is(.menu-item, .menu-subitem):not(.sidebar-toggle) .menu-item-icon {
     box-sizing: content-box;
     width: 1rem;
@@ -5489,7 +5605,7 @@ html.dark .canvas-zoom-max {
     --canvas-dots-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 20 20'%3E%3Cpath transform='translate(8 8) scale(0.0125)' d='M64 256H0V64h64Zm0-192V0h256v64Zm0 192h256v64H64Z' fill='rgb(255 255 255 / 0.09)'/%3E%3C/svg%3E");
 }
 
-.canvas-zoom-max :is([data-ec-viewport], .cv-viewport) {
+.canvas-zoom-max [data-ec-viewport] {
     background-image: var(--canvas-dots-image);
 }
 
@@ -5532,7 +5648,7 @@ html.dark .canvas-zoom-max {
         background-color: var(--color-panel);
     }
 
-    html[data-nav-style="floating"] :is(.app-topbar, .app-sidebar > div > nav, .app-tabbar) {
+    html[data-nav-style="floating"] :is(.app-topbar, .app-sidebar > div > nav) {
         border: 1px solid var(--floating-line);
         border-radius: var(--floating-radius);
     }
@@ -5564,14 +5680,16 @@ html.dark .canvas-zoom-max {
         left: var(--floating-gap);
     }
 
-    html[data-nav-style="floating"] .app-sidebar > div > nav > .sticky {
+    html[data-nav-style="floating"] .app-sidebar > div > nav > .sidebar-footer {
         border-radius: 0 0 var(--floating-radius) var(--floating-radius);
     }
 
     html[data-nav-style="floating"] .app-main {
         margin-left: calc(var(--sidebar-w, 14rem) + var(--floating-gap));
-        /* The content top lines up with the sidebar and settings rail panels. */
-        padding-top: var(--floating-top);
+        /* The content top lines up with the sidebar and settings rail panels.
+           The cards draw their frame as a 1px ring outside the box, while the
+           panels use a 1px border inside it, so add 1px to match the edges. */
+        padding-top: calc(var(--floating-top) + 1px);
     }
 
     /* Full-bleed pages (canvases): no top padding gap, and the same gap as the panels. */
@@ -5610,7 +5728,7 @@ html.dark .canvas-zoom-max {
         padding-top: var(--floating-top);
     }
 
-    html[data-nav-style="floating"] .app-main-full :is([data-ec-viewport], .cv-viewport) {
+    html[data-nav-style="floating"] .app-main-full [data-ec-viewport] {
         background-image: none;
     }
 
@@ -5621,10 +5739,11 @@ html.dark .canvas-zoom-max {
         padding-bottom: var(--floating-gap);
     }
 
-    html[data-nav-style="floating"] .app-tabbar {
-        top: var(--floating-top);
+    /* Dashboard canvas Deployments panel: one gap from the floating sidebar and the screen bottom. */
+    /* Bottom-left zoom controls and deployments: the canvas fills the screen behind the sidebar, so start one gap after it. */
+    html[data-nav-style="floating"] .app-main-full [data-ec-dock] {
         left: calc(var(--sidebar-w, 14rem) + var(--floating-gap) * 2);
-        right: var(--floating-gap);
+        bottom: var(--floating-gap);
     }
 }
 
@@ -5717,3 +5836,19 @@ html.dark .canvas-zoom-max {
     html.dark[data-nav-style="floating"] .app-main [class*="dark:hover:bg-white/[0.1]"]:not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
     html.dark[data-nav-style="floating"] .app-main .button:not(:disabled):not(:is([class*="dark:bg-"]:not(.app-main), .button, .view-toggle, .application-settings-section, .box, .coolbox, .data-table, .resource-view, .empty-state, .loading-state-card, .runtime-log-shell, .logs-viewer) *):hover { background-color: color-mix(in oklab, #fff 10%, var(--color-app)) !important; }
 }
+
+/* Resource menu in the collapsed main sidebar: icons only. */
+.sidebar-collapsed .nav-context-menu :is(.menu-item-label, .nav-children, .menu-item > :not(.menu-item-icon)) {
+    display: none !important;
+}
+
+.sidebar-collapsed .nav-context-menu .menu-item {
+    justify-content: center;
+    padding-left: 0;
+    padding-right: 0;
+}
+
+/* A page menu's own "Back to ..." item: the main sidebar copy has the back row instead (components/main-nav-menu). */
+.nav-context-menu [data-page-only] {
+    display: none !important;
+}
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 96511bbf79..a35cb76471 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -249,11 +249,6 @@
     @apply px-2.5 pt-1 pb-1 text-[11px] font-medium text-nav-muted select-none;
 }
 
-/* Collapsible group header (accordion) for the resource settings sidebar. */
-@utility nav-section-toggle {
-    @apply w-full items-center justify-between gap-2 px-2.5 pt-1 pb-1 text-[11px] font-medium text-nav-muted select-none rounded-md transition-colors cursor-pointer hover:text-nav-active;
-}
-
 /* Indented child rows in a collapsible nav group */
 @utility menu-subitem {
     /* Label owns text ellipsis; keep this row overflow-visible so the focus ring is not clipped. */
@@ -435,6 +430,16 @@
         padding-right: 0.625rem;
     }
 
+    /* Flat rows show their own fill, so make it a 2rem square (same as the h-8
+       height) with the icon centered, in line with the footer controls. */
+    html[data-nav-items="flat"] .sidebar-collapsed .menu-item:not(.sidebar-toggle) {
+        width: 2rem;
+        margin-left: 0.1875rem;
+        justify-content: center;
+        padding-left: 0;
+        padding-right: 0;
+    }
+
     .sidebar-collapsed .sidebar-collapsed-label {
         display: none;
     }
diff --git a/resources/js/app.js b/resources/js/app.js
index af249856ad..7e54193431 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1,8 +1,8 @@
 import { initializeCopyButtonComponent } from './copy-button.js';
 import { initializeRuntimeLogsComponent } from './runtime-logs.js';
-import { initializeSettingsSidebarAccordionComponent } from './settings-sidebar-accordion.js';
 import { initializeTerminalComponent } from './terminal.js';
 import './traffic-globe.js';
+import './traffic-table.js';
 import { registerLivewireRequestFailureHandler } from './livewire-request-failure.js';
 import { registerLivewireUpdateDedupe } from './livewire-update-dedupe.js';
 import { parseSubmitAction } from './modal-confirmation.js';
@@ -49,7 +49,6 @@ document.addEventListener('livewire:navigated', () => {
 document.addEventListener('alpine:init', initializeTerminalComponent);
 document.addEventListener('alpine:init', initializeCopyButtonComponent);
 document.addEventListener('alpine:init', initializeRuntimeLogsComponent);
-document.addEventListener('alpine:init', initializeSettingsSidebarAccordionComponent);
 
 /**
  * Smooth-scroll a settings section into view, then flash its border for 500ms
diff --git a/resources/js/canvas-core.js b/resources/js/canvas-core.js
index 41d6c26f23..4f2127df1c 100644
--- a/resources/js/canvas-core.js
+++ b/resources/js/canvas-core.js
@@ -95,6 +95,18 @@ export function setCanvasDots(root, size, x, y, atMaxZoom = false) {
   root.classList.toggle('canvas-zoom-max', atMaxZoom);
 }
 
+/**
+ * The browser zoom shortcut in a keydown event (Cmd/Ctrl with +, - or 0), so the
+ * canvas can zoom itself instead: 'in', 'out', 'reset', or null for other keys.
+ */
+export function zoomShortcut(e) {
+  if (!(e.ctrlKey || e.metaKey) || e.altKey) return null;
+  if (e.key === '+' || e.key === '=') return 'in';
+  if (e.key === '-' || e.key === '_') return 'out';
+  if (e.key === '0') return 'reset';
+  return null;
+}
+
 /**
  * Wheel zoom (ctrl/cmd) and pan, and drag-to-pan on the viewport background.
  * getView() returns the current { x, y, z }, which is changed in place.
diff --git a/resources/js/canvas/CanvasControls.svelte b/resources/js/canvas/CanvasControls.svelte
new file mode 100644
index 0000000000..f4b2532891
--- /dev/null
+++ b/resources/js/canvas/CanvasControls.svelte
@@ -0,0 +1,35 @@
+<script>
+  // Zoom and fit controls that float in the bottom-left corner of a canvas.
+  // With `onrefresh` (environment canvas) it also has a Refresh button. `inline`: the parent places it.
+  // `children`: more actions after the zoom buttons (deploy canvas header).
+  import Icon from './environment/Icon.svelte';
+  import { zoomShortcut } from '../canvas-core.js';
+
+  let { zoom, onzoom, onfit, onrefresh = null, loading = false, inline = false, children = null } = $props();
+
+  const button = 'grid h-7 min-w-7 place-items-center rounded-md px-1.5 text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-neutral-900 disabled:pointer-events-none disabled:opacity-50 dark:text-fg-dim dark:hover:bg-white/[0.07] dark:hover:text-fg';
+
+  /** Cmd/Ctrl + / - / 0 zoom the canvas instead of the page. */
+  function onKeydown(e) {
+    const shortcut = e.defaultPrevented ? null : zoomShortcut(e);
+    if (!shortcut) return;
+    e.preventDefault();
+    onzoom(shortcut === 'in' ? zoom * 1.2 : shortcut === 'out' ? zoom / 1.2 : 1);
+  }
+</script>
+
+<svelte:window onkeydown={onKeydown} />
+
+<div class="{inline ? 'shrink-0' : 'absolute bottom-3 left-3 z-20'} flex items-center gap-0.5 rounded-lg border border-neutral-200 bg-white/85 p-0.5 shadow-sm backdrop-blur-sm dark:border-white/[0.08] dark:bg-panel/85" data-canvas-controls>
+  <button type="button" class={button} title="Zoom out" aria-label="Zoom out" onclick={() => onzoom(zoom / 1.2)}><Icon name="minus" /></button>
+  <button type="button" class="{button} w-12 text-[12px] font-medium tabular-nums" title="Reset zoom to 100%" onclick={() => onzoom(1)}>{Math.round(zoom * 100)}%</button>
+  <button type="button" class={button} title="Zoom in" aria-label="Zoom in" onclick={() => onzoom(zoom * 1.2)}><Icon name="plus" /></button>
+  <span class="mx-0.5 h-4 w-px bg-neutral-200 dark:bg-white/[0.08]"></span>
+  <button type="button" class={button} title="Fit to screen" aria-label="Fit to screen" onclick={onfit}><Icon name="fit" /></button>
+  {#if onrefresh}
+    <button type="button" class={button} title="Load the latest status" aria-label="Refresh" disabled={loading} onclick={onrefresh}><Icon name="refresh" class="size-3.5 {loading ? 'animate-spin' : ''}" /></button>
+  {/if}
+  {#if children}
+    <div class="ml-0.5 flex items-center gap-2 border-l border-neutral-200 pr-0.5 pl-2 dark:border-white/[0.08]">{@render children()}</div>
+  {/if}
+</div>
diff --git a/resources/js/canvas/deploy/DeployCanvas.svelte b/resources/js/canvas/deploy/DeployCanvas.svelte
index 72804b6c50..89dab86f61 100644
--- a/resources/js/canvas/deploy/DeployCanvas.svelte
+++ b/resources/js/canvas/deploy/DeployCanvas.svelte
@@ -7,11 +7,11 @@
   import Node from './Node.svelte';
   import PaletteItem from './PaletteItem.svelte';
   import RunPanel from './RunPanel.svelte';
-  import { closeMenu, cv, dock, els, fit, hideResult, leave, pan, pickNext, PORT_Y, resetCanvas } from './state.svelte.js';
+  import CanvasControls from '../CanvasControls.svelte';
+  import { closeMenu, cv, els, fit, hideResult, leave, pan, pickNext, PORT_Y, resetCanvas } from './state.svelte.js';
 
   // The deploy canvas: header, step palette, and the canvas with the step
   // cards. The state lives in state.svelte.js (init() runs before the mount).
-  let zoomLabel = $state();
   // Theme: same as Coolify (html.dark).
   let dark = $state(document.documentElement.classList.contains('dark'));
   // Palette: full or icons only ('coolify-canvas:collapsed').
@@ -19,6 +19,10 @@
   // Small screens: a notice that the canvas is not optimized for mobile. CSS
   // shows it below 768px; closed once, it stays closed.
   let noticeOpen = $state(!load('mobile-notice-dismissed', false));
+  // Desktop: the header sits in the zoom controls bar (bottom left), as on the
+  // other canvases. Small screens: a box above the canvas.
+  const desktopQuery = matchMedia('(min-width: 1024px)');
+  let desktop = $state(desktopQuery.matches);
 
   const stop = e => e.stopPropagation();
   // A pill joined to the Deploy card: each address opens in a new tab.
@@ -60,7 +64,10 @@
     const reset = () => { if (els.root?.isConnected) resetCanvas(); };
     addEventListener('keydown', escape);
     addEventListener('deploy-canvas-reset', reset);
+    const media = () => { desktop = desktopQuery.matches; };
+    desktopQuery.addEventListener('change', media);
     return () => {
+      desktopQuery.removeEventListener('change', media);
       theme.disconnect();
       removeEventListener('keydown', escape);
       removeEventListener('deploy-canvas-reset', reset);
@@ -69,29 +76,21 @@
   });
 </script>
 
-<div class="cv-root" class:cv-dark={dark} class:cv-folded={folded}>
-  <!-- Header: placed by dock (app top bar, floating panel, or a box above the canvas). -->
-  <div use:dock>
-    <div class="mr-auto flex min-w-0 items-center gap-2">
-      {#if cv.target}
-        <!-- Opened from an environment's New resource page: back to that environment. -->
-        <a class="cv-back button px-2!" href="/project/{cv.target.project}/environment/{cv.target.environment}" title="Back to the environment" aria-label="Back to the environment"><Icon name="back" cls="size-4" /></a>
-      {/if}
-      <b class="shrink-0 text-[14px] font-semibold text-black dark:text-fg">Deploy canvas</b>
-      <span class="shrink-0 rounded-full border border-coollabs/30 bg-coollabs/10 px-2 py-0.5 text-xs font-medium text-coollabs dark:border-warning/30 dark:bg-warning/15 dark:text-warning">Beta</span>
-    </div>
-    <div class="flex shrink-0 items-center gap-2">
-      <!-- Zoom controls, as on the environment canvas header. -->
-      <div class="flex items-center">
-        <button type="button" class="button px-2! rounded-r-none!" title="Zoom out" aria-label="Zoom out" onclick={() => els.pz.zoomTo(cv.view.z / 1.2)}><Icon name={ICONS.minus} cls="size-4" /></button>
-        <!-- Its text is the zoom level, written by panZoom. -->
-        <button bind:this={zoomLabel} type="button" class="button rounded-none! border-x-0! w-14 tabular-nums" title="Reset zoom to 100%" onclick={() => els.pz.zoomTo(1)}>100%</button>
-        <button type="button" class="button px-2! rounded-l-none!" title="Zoom in" aria-label="Zoom in" onclick={() => els.pz.zoomTo(cv.view.z * 1.2)}><Icon name={ICONS.plus} cls="size-4" /></button>
-      </div>
-      <button type="button" class="button px-2!" title="Fit to screen" aria-label="Fit to screen" onclick={fit}><Icon name={ICONS.fit} cls="size-4" />Fit</button>
-      <button type="button" class="button" title="Start again with an empty canvas" onclick={askReset}>Reset</button>
-    </div>
+{#snippet header()}
+  <div class="mr-auto flex min-w-0 items-center gap-2">
+    {#if cv.target}
+      <!-- Opened from an environment's New resource page: back to that environment. -->
+      <a class="cv-back button px-2!" href="/project/{cv.target.project}/environment/{cv.target.environment}" title="Back to the environment" aria-label="Back to the environment"><Icon name="back" cls="size-4" /></a>
+    {/if}
+    <span class="shrink-0 rounded-full border border-coollabs/30 bg-coollabs/10 px-2 py-0.5 text-xs font-medium text-coollabs dark:border-warning/30 dark:bg-warning/15 dark:text-warning">Beta</span>
   </div>
+  <button type="button" class="button shrink-0" title="Start again with an empty canvas" onclick={askReset}>Reset</button>
+{/snippet}
+
+<div class="cv-root" class:cv-dark={dark} class:cv-folded={folded} class:cv-docked={desktop}>
+  {#if !desktop}
+    <div class="cv-island cv-top">{@render header()}</div>
+  {/if}
 
   {#if noticeOpen}
     <div class="cv-island cv-notice" role="note">
@@ -115,7 +114,7 @@
   </aside>
 
   <section class="cv-island cv-stage">
-    <div class="cv-viewport" use:pan={() => zoomLabel}>
+    <div class="cv-viewport" use:pan>
       <div class="cv-world">
         <Edges />
         {#each cv.flow.nodes as n (n.id)}
@@ -157,6 +156,9 @@
     {/if}
   </section>
 
+  <!-- Bottom left of the whole canvas, below the Steps panel. -->
+  <CanvasControls zoom={cv.view.z} onzoom={z => els.pz.zoomTo(z)} onfit={fit} children={desktop ? header : null} />
+
   {#if cv.dropdown}
     {#key cv.dropdown?.trigger}
       <Dropdown />
diff --git a/resources/js/canvas/deploy/state.svelte.js b/resources/js/canvas/deploy/state.svelte.js
index 8d76b5a62d..2cfb6c3c24 100644
--- a/resources/js/canvas/deploy/state.svelte.js
+++ b/resources/js/canvas/deploy/state.svelte.js
@@ -68,8 +68,8 @@ export function leave() {
 
 // ── Actions ────────────────────────────────────────────────────────────
 
-/** use:pan on the viewport: wheel and pinch zoom, drag to pan. zoomLabel() is the zoom button. */
-export function pan(viewport, zoomLabel) {
+/** use:pan on the viewport: wheel and pinch zoom, drag to pan. */
+export function pan(viewport) {
   const world = viewport.querySelector('.cv-world');
   const edges = viewport.querySelector('.cv-edges');
   els.viewport = viewport;
@@ -79,69 +79,16 @@ export function pan(viewport, zoomLabel) {
     root: els.root,
     viewport,
     world,
-    // The button can sit in the app top bar (see dock), so it is looked up on each write.
-    zoomLabel: { set textContent(text) { const label = zoomLabel(); if (label) label.textContent = text; } },
+    zoomLabel: {}, // CanvasControls shows cv.view.z
     getView: () => cv.view,
     onChange: closeDropdown,
     canPan: e => [viewport, world, edges].includes(e.target),
     onPanStart: closeMenu,
   });
-}
-
-const DESKTOP = '(min-width: 1024px)';
-/**
- * use:dock on the header. Desktop: it docks into the app top bar, or with the
- * floating nav it is a separate panel next to the top bar (as on the
- * environment canvas) when it fits there. Small screens: a box above the canvas.
- */
-export function dock(top) {
-  const root = top.closest('.cv-root');
-  const stage = root.querySelector('.cv-stage');
-  function place() {
-    const desktop = matchMedia(DESKTOP).matches;
-    const slot = desktop && document.getElementById('page-toolbar-slot');
-    const topbar = document.querySelector('.app-topbar');
-    top.removeAttribute('style');
-    if (desktop && topbar && document.documentElement.dataset.navStyle === 'floating') {
-      top.className = 'fixed z-40 flex items-center gap-3 rounded-lg border border-neutral-200 bg-white px-2 py-1.5 dark:border-white/[0.08] dark:bg-panel';
-      root.append(top);
-      const gap = 8;
-      const head = topbar.getBoundingClientRect();
-      const width = top.offsetWidth;
-      if (head.right + gap + width <= innerWidth - gap) {
-        // Centered over the canvas, but never over the top bar.
-        const box = stage.getBoundingClientRect();
-        const left = Math.max(box.left + (box.width - width) / 2, head.right + gap);
-        Object.assign(top.style, { top: `${head.top}px`, left: `${left}px`, minHeight: `${head.height}px` });
-        root.classList.add('cv-docked');
-        return;
-      }
-      top.removeAttribute('style');
-    }
-    top.className = slot ? 'flex items-center gap-3 pl-3' : 'cv-island cv-top';
-    root.classList.toggle('cv-docked', !!slot);
-    if (slot) slot.replaceChildren(top);
-    else root.prepend(top);
-  }
-  place();
-  const replace = () => root.isConnected && place();
-  // The floating header is centered over the canvas next to the app top bar, so follow their sizes.
-  const sizes = new ResizeObserver(replace);
-  for (const target of [stage, document.querySelector('.app-topbar')].filter(Boolean)) sizes.observe(target);
-  const media = matchMedia(DESKTOP);
-  media.addEventListener('change', replace);
-  addEventListener('resize', replace);
-  const navStyle = new MutationObserver(replace);
-  navStyle.observe(document.documentElement, { attributes: true, attributeFilter: ['data-nav-style'] });
-  return {
-    destroy() {
-      sizes.disconnect();
-      media.removeEventListener('change', replace);
-      removeEventListener('resize', replace);
-      navStyle.disconnect();
-      top.remove(); // it may sit in the app top bar
-    },
-  };
+  // The root paints the dots, so move them with the viewport when the Steps panel folds or the window resizes.
+  const sizes = new ResizeObserver(() => els.pz.apply());
+  sizes.observe(viewport);
+  return { destroy: () => sizes.disconnect() };
 }
 
 /** use:track on a card: its element (for measuring) and its size (for the lines). */
diff --git a/resources/js/canvas/deploy/styles.js b/resources/js/canvas/deploy/styles.js
index a66713dc2f..869e76d236 100644
--- a/resources/js/canvas/deploy/styles.js
+++ b/resources/js/canvas/deploy/styles.js
@@ -22,6 +22,11 @@ const CSS = `
     display: grid; grid-template-columns: 15.5rem minmax(0, 1fr); grid-template-rows: auto minmax(0, 1fr);
     gap: 8px; padding: 8px;
     background: var(--cv-backdrop); color: var(--cv-text);
+    /* The dots cover the whole backdrop, also under the Steps panel. pan()
+       (canvas-core.js) lines them up with the viewport through these variables. */
+    background-image: var(--canvas-dots-image, radial-gradient(circle, light-dark(rgb(0 0 0 / 0.13), rgb(255 255 255 / 0.09)) 1px, transparent 1.3px));
+    background-size: var(--canvas-dots-size, 20px 20px);
+    background-position: var(--canvas-dots-position, 0 0);
     color-scheme: light; font: 13px/1.4 var(--font-sans, ui-sans-serif, system-ui, sans-serif);
     -webkit-font-smoothing: antialiased;
   }
@@ -30,9 +35,9 @@ const CSS = `
   /* Rounded boxes on the backdrop: the top bar and the step list. */
   .cv-island { border: 1px solid var(--cv-line); border-radius: 8px; background: var(--cv-island); }
   .cv-root svg { width: 1rem; height: 1rem; flex: none; }
-  .cv-root button:not(.button) { font: inherit; }
+  .cv-root button:not(.button, [data-canvas-controls] button) { font: inherit; }
 
-  /* Header island on small screens; on desktop the header docks into the app top bar. */
+  /* Header island on small screens; on desktop the header is in the zoom controls bar. */
   .cv-top { grid-column: 1 / -1; display: flex; flex-wrap: wrap; align-items: center; gap: 0.75rem; padding: 0.625rem 0.75rem; }
   .cv-root.cv-docked { grid-template-rows: minmax(0, 1fr); }
   .cv-btn {
@@ -61,7 +66,9 @@ const CSS = `
 
   /* Palette island */
   /* Hugs its steps instead of filling the row; scrolls when the screen is short. */
-  .cv-palette { display: flex; flex-direction: column; align-self: start; max-height: 100%; overflow-y: auto; padding: 1rem 0.625rem 0.75rem; }
+  /* The zoom controls sit below the Steps panel, so the panel leaves room for them. */
+  .cv-palette { display: flex; flex-direction: column; align-self: start; max-height: calc(100% - 3.25rem); overflow-y: auto; padding: 1rem 0.625rem 0.75rem; }
+  .cv-root > [data-canvas-controls] { bottom: 8px; left: 8px; }
   .cv-palette-head { padding: 0 0.5rem 0.75rem; margin: 0 -0.625rem 0.5rem; padding-inline: 1.125rem; border-bottom: 1px solid var(--cv-line); }
   .cv-palette-head b { display: block; font-size: 14px; font-weight: 600; }
   .cv-palette-head span { color: var(--cv-subtle); font-size: 12px; }
@@ -95,7 +102,8 @@ const CSS = `
   .cv-stage { position: relative; overflow: hidden; border: 0; background: transparent; }
   .cv-viewport {
     position: absolute; inset: 0; cursor: grab; touch-action: none;
-    background-image: radial-gradient(circle, light-dark(rgb(0 0 0 / 0.13), rgb(255 255 255 / 0.09)) 1px, transparent 1.3px);
+    /* The dots are on .cv-root, so the viewport has none of its own. */
+    background-image: none;
   }
   .cv-viewport.panning { cursor: grabbing; }
   .cv-world { position: absolute; top: 0; left: 0; transform-origin: 0 0; }
diff --git a/resources/js/canvas/environment/Card.svelte b/resources/js/canvas/environment/Card.svelte
index 8cf01c74a8..ef1636e528 100644
--- a/resources/js/canvas/environment/Card.svelte
+++ b/resources/js/canvas/environment/Card.svelte
@@ -1,20 +1,29 @@
 <script>
   // A resource card (or, connect view, a shared variable / tag card).
-  import { isSource, MAX_CHILDREN, MAX_VOLUMES, statusLabel, TYPE_LABELS } from '../../environment-canvas.js';
+  import { isSource, MAX_CHILDREN, statusLabel, statusTone, statusWord, TYPE_LABELS } from '../../environment-canvas.js';
   import NodeIcon from './NodeIcon.svelte';
   import StatusDot from './StatusDot.svelte';
 
-  let { node, position, selected, dropTarget, movable, port, linkCount, zoneNames, onpress, onconnect, onselect, onhover } = $props();
+  let { node, position, selected, dropTarget, movable, port, linkCount, zoneNames, serverDown = false, statusText = false, onpress, onconnect, onselect, onhover } = $props();
   let card;
   let portDot = $state();
   // Same as the deploy canvas drop target: accent border and a soft 4px ring.
   const DROP_TARGET = 'border-coollabs! dark:border-warning! ring-4 ring-coollabs/15 dark:ring-warning/15';
 
   const extra = $derived(node.extra_zones?.length || 0);
-  const volumes = $derived(node.volumes || []);
   const children = $derived(node.children || []);
   const chip = 'inline-flex h-5 max-w-[9rem] items-center truncate rounded-full border border-neutral-200 bg-neutral-50 px-1.5 text-[10px] font-medium text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim';
   const stop = e => e.stopPropagation();
+  // The server is not reachable, so the saved status is stale: show it as unknown, not as a failure.
+  const DOWN = 'Unknown (server not reachable)';
+  const status = $derived(serverDown ? 'unknown' : node.status);
+  const TONE_TEXT = {
+    ok: 'text-emerald-600 dark:text-emerald-400',
+    warn: 'text-warning-700 dark:text-warning',
+    busy: 'text-warning-700 dark:text-warning',
+    bad: 'text-red-600 dark:text-red-400',
+    idle: 'text-neutral-500 dark:text-fg-faint',
+  };
 </script>
 
 <!-- data-ec-open: its page opens on double-click (see the root's pointerdown capture listener). -->
@@ -35,7 +44,7 @@
   tabindex="0"
   aria-label={isSource(node)
     ? `${node.name} (${node.missing ? 'deleted ' : ''}${TYPE_LABELS[node.type].toLowerCase()})`
-    : `${node.name} (${TYPE_LABELS[node.type] || node.type}), ${statusLabel(node.status)}`}
+    : `${node.name} (${TYPE_LABELS[node.type] || node.type}), ${serverDown ? DOWN : statusLabel(node.status)}`}
   onpointerdown={e => onpress(e, card)}
   onkeydown={e => {
     if (e.key === 'Enter' || e.key === ' ') {
@@ -64,7 +73,27 @@
         title={node.missing ? 'This shared variable was deleted, but resources still reference it' : `Used by ${linkCount} ${linkCount === 1 ? 'resource' : 'resources'}`}
       >{node.missing ? 'Deleted' : String(linkCount)}</span>
     {:else}
-      <div class="pt-1"><StatusDot status={node.status} /></div>
+      {#if node.deployment}
+        <!-- Dashboard canvas: the running or queued deployment of the application. -->
+        <a
+          class="relative mt-0.5 inline-flex shrink-0 items-center gap-1 rounded-full border border-neutral-200 bg-neutral-50 px-1.5 text-[10px] leading-4 font-medium text-neutral-600 hover:border-neutral-300 hover:text-black dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim dark:hover:border-white/[0.2] dark:hover:text-fg"
+          href={node.deployment.link}
+          title={node.deployment.pull_request_id ? `Pull request #${node.deployment.pull_request_id}` : 'Open the deployment'}
+          onpointerdown={stop}
+          onclick={stop}
+        >
+          <StatusDot status={node.deployment.status} size="size-1.5" />
+          {node.deployment.status === 'queued' ? 'Queued' : 'Deploying'}
+        </a>
+      {/if}
+      {#if statusText}
+        <!-- Server view: the status in words, so a stopped resource reads as stopped at a glance. -->
+        <span class="mt-0.5 inline-flex shrink-0 items-center gap-1.5 text-[11px] leading-4 font-medium {TONE_TEXT[statusTone(status)]}" title={serverDown ? DOWN : statusLabel(status)}>
+          {statusWord(status)}<StatusDot {status} size="size-1.5" title={serverDown ? DOWN : null} />
+        </span>
+      {:else}
+        <div class="pt-1"><StatusDot {status} title={serverDown ? DOWN : null} /></div>
+      {/if}
     {/if}
   </div>
 
@@ -80,11 +109,9 @@
     >{node.urls[0].replace(/^https?:\/\//, '')}</a>
   {/if}
 
-  {#if extra || volumes.length}
+  {#if extra}
     <div class="mt-2 flex min-w-0 flex-wrap gap-1 overflow-hidden h-5">
-      {#if extra}<span class={chip} title={zoneNames.join(', ')}>+{extra} {extra === 1 ? 'server' : 'servers'}</span>{/if}
-      {#each volumes.slice(0, MAX_VOLUMES) as v, i (i)}<span class={chip} title="Volume {v}">{v}</span>{/each}
-      {#if volumes.length > MAX_VOLUMES}<span class={chip} title={volumes.slice(MAX_VOLUMES).join(', ')}>+{volumes.length - MAX_VOLUMES}</span>{/if}
+      <span class={chip} title={zoneNames.join(', ')}>+{extra} {extra === 1 ? 'server' : 'servers'}</span>
     </div>
   {/if}
 
@@ -92,7 +119,7 @@
     <ul class="mt-2 border-t border-neutral-100 pt-1.5 dark:border-white/[0.06]">
       {#each children.slice(0, MAX_CHILDREN) as child, i (i)}
         <li class="flex h-5 items-center gap-2 text-[12px] leading-5">
-          <StatusDot status={child.status} size="size-1.5" />
+          <StatusDot status={serverDown ? 'unknown' : child.status} size="size-1.5" title={serverDown ? DOWN : null} />
           <span class="min-w-0 truncate">{child.name}</span>
         </li>
       {/each}
diff --git a/resources/js/canvas/environment/Deployments.svelte b/resources/js/canvas/environment/Deployments.svelte
new file mode 100644
index 0000000000..73a2c84845
--- /dev/null
+++ b/resources/js/canvas/environment/Deployments.svelte
@@ -0,0 +1,86 @@
+<script>
+  // Dashboard canvas: running, queued, and recent deployments. A row shows its application card;
+  // the status opens the deployment. Folded or open is remembered in localStorage.
+  import { TONE_DOT } from '../../environment-canvas.js';
+  import Icon from './Icon.svelte';
+
+  let { deployments, nodeById, onshow } = $props();
+
+  const KEY = 'coolify-canvas-deployments-open';
+  const STATUS = {
+    in_progress: ['In progress', 'busy'],
+    queued: ['Queued', 'busy'],
+    finished: ['Success', 'ok'],
+    failed: ['Failed', 'bad'],
+    'cancelled-by-user': ['Cancelled', 'idle'],
+  };
+  const status = value => STATUS[value] || [String(value || 'Unknown').replace(/[-_]/g, ' '), 'idle'];
+
+  let open = $state(readOpen());
+  function readOpen() {
+    try {
+      return localStorage.getItem(KEY) !== 'false';
+    } catch {
+      return true;
+    }
+  }
+  function toggle() {
+    open = !open;
+    try {
+      localStorage.setItem(KEY, String(open));
+    } catch {
+      // Storage blocked: the panel opens next time.
+    }
+  }
+
+  // "3m ago"; re-rendered with each canvas reload.
+  const units = [['d', 86400], ['h', 3600], ['m', 60]];
+  function ago(iso) {
+    const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1000);
+    for (const [unit, size] of units) {
+      if (seconds >= size) return `${Math.floor(seconds / size)}${unit} ago`;
+    }
+    return 'just now';
+  }
+</script>
+
+<section class="flex max-h-80 w-72 min-w-0 flex-col overflow-hidden rounded-lg border border-neutral-200 bg-white shadow-lg dark:border-white/[0.08] dark:bg-panel" data-ec-deployments>
+  <button type="button" class="flex w-full shrink-0 items-center gap-2 px-3 py-2.5 text-left" aria-expanded={open} onclick={toggle}>
+    <span class="min-w-0 flex-1 text-[12px] font-semibold text-black dark:text-fg">Recent deployments</span>
+    <span class="text-[11px] text-neutral-400 dark:text-fg-faint">{deployments.length}</span>
+    <Icon name="chevron" class="size-3.5 text-neutral-400 transition-transform dark:text-fg-faint {open ? '' : 'rotate-180'}" />
+  </button>
+  {#if open}
+    <ul class="min-h-0 overflow-y-auto border-t border-neutral-100 dark:border-white/[0.06]">
+      {#each deployments as deployment (deployment.id)}
+        {@const [label, tone] = status(deployment.status)}
+        {@const node = deployment.application ? nodeById(deployment.application) : null}
+        <li class="flex items-center gap-2 border-b border-neutral-100 px-3 py-2 last:border-b-0 dark:border-white/[0.06]">
+          <button
+            type="button"
+            class="min-w-0 flex-1 text-left disabled:cursor-default enabled:hover:[&>p:first-child]:underline"
+            disabled={!node}
+            title={node ? 'Show on the canvas' : undefined}
+            onclick={() => onshow(node.id)}
+          >
+            <p class="truncate text-[12px] font-medium text-black underline-offset-2 dark:text-fg">{deployment.name}</p>
+            <p class="truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+              {deployment.pull_request_id ? `PR #${deployment.pull_request_id} · ` : ''}{deployment.created_at ? ago(deployment.created_at) : deployment.server}
+            </p>
+          </button>
+          <a
+            class="inline-flex shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-50 px-2 text-[10px] leading-5 font-medium text-neutral-600 hover:border-neutral-300 hover:text-black dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim dark:hover:border-white/[0.2] dark:hover:text-fg"
+            href={deployment.link}
+            title="Open the deployment"
+          >
+            <span class="relative flex size-1.5">
+              {#if tone === 'busy'}<span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {TONE_DOT.busy}"></span>{/if}
+              <span class="relative inline-flex size-full rounded-full {TONE_DOT[tone]}"></span>
+            </span>
+            {label}
+          </a>
+        </li>
+      {/each}
+    </ul>
+  {/if}
+</section>
diff --git a/resources/js/canvas/environment/EmptyCard.svelte b/resources/js/canvas/environment/EmptyCard.svelte
new file mode 100644
index 0000000000..dc6721258d
--- /dev/null
+++ b/resources/js/canvas/environment/EmptyCard.svelte
@@ -0,0 +1,24 @@
+<script>
+  // Placeholder card of an environment (or project) without resources: opens the deploy canvas (admins) or its page on click.
+  import Icon from './Icon.svelte';
+
+  let { node, position } = $props();
+</script>
+
+<a
+  class="group absolute flex w-[260px] items-center gap-2.5 rounded-xl border border-dashed border-neutral-300 bg-white/60 p-3 hover:border-neutral-400 dark:border-white/[0.12] dark:bg-white/[0.02] dark:hover:border-white/[0.24]"
+  style:left={position ? `${position.x}px` : null}
+  style:top={position ? `${position.y}px` : null}
+  href={node.link}
+  draggable="false"
+  data-ec-card
+  data-id={node.id}
+>
+  <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-dashed border-neutral-300 text-neutral-400 dark:border-white/[0.12] dark:text-fg-faint">
+    <Icon name="plus" class="size-3.5" />
+  </div>
+  <div class="min-w-0 flex-1">
+    <div class="truncate text-[13px] leading-4 font-semibold text-neutral-500 underline-offset-2 group-hover:underline dark:text-fg-dim">{node.name}</div>
+    <div class="mt-0.5 truncate text-[11px] leading-4 text-neutral-400 dark:text-fg-faint">{node.subtitle}</div>
+  </div>
+</a>
diff --git a/resources/js/canvas/environment/EnvironmentCanvas.svelte b/resources/js/canvas/environment/EnvironmentCanvas.svelte
index 7b2105f9e0..f5f70d76ad 100644
--- a/resources/js/canvas/environment/EnvironmentCanvas.svelte
+++ b/resources/js/canvas/environment/EnvironmentCanvas.svelte
@@ -6,7 +6,7 @@
   // The server canvas (data-endpoint) reuses this view. It saves moves and links on the environment canvas of each card.
   // The shared variables and tags canvases (data-mode) reuse it too: their links add a variable or a tag to a resource.
   import { flushSync, onMount, tick } from 'svelte';
-  import { api, BOX_GAP, freeSpot, MIN_ZOOM, panZoom } from '../../canvas-core.js';
+  import { api, BOX_GAP, freeSpot, panZoom } from '../../canvas-core.js';
   import {
     canConnect,
     canLink,
@@ -16,8 +16,13 @@
     dragRules,
     filterGraph,
     filterOptions,
+    fitView,
+    GROUP_GAP,
+    GROUP_HEADER,
+    GROUP_PADDING,
     groupByUse,
     groupFrames,
+    groupKey,
     isSource,
     layoutGraph,
     layoutServerView,
@@ -25,13 +30,17 @@
     MOBILE_NOTICE_KEY,
     readView,
     STATUS_CHANNELS,
+    unreachableZones,
     zoneBoxes,
     zoneGroups,
   } from '../../environment-canvas.js';
   import Card from './Card.svelte';
+  import Deployments from './Deployments.svelte';
+  import EmptyCard from './EmptyCard.svelte';
   import Icon from './Icon.svelte';
   import Panel from './Panel.svelte';
   import Toolbar from './Toolbar.svelte';
+  import CanvasControls from '../CanvasControls.svelte';
   import Zone from './Zone.svelte';
 
   // The page's [data-environment-canvas] element; it does not change while the canvas is mounted.
@@ -78,11 +87,16 @@
   const interactions = new Set(); // active drags; refetches wait until they end
   let deferred = null;
   const unsaved = {};
-  let offsets = {}; // server view: card shift from its environment canvas position (see layoutServerView)
+  // Saved moves stay on the canvas until a load that started after the save returns them, so an older
+  // response (a poll or status refresh during the drag or the request) cannot put the cards back for a moment.
+  const settling = { positions: {}, saved: {} }; // id -> { at, after: load number the save finished at }
+  let loads = 0;
   let reloadQueued = false;
   let fitted = false;
   let destroyed = false;
   let containers = null; // server canvas: unmanaged container cards, loaded after the canvas renders
+  let usage = $state({}); // server canvas: latest CPU, memory and disk usage per server zone
+  const USAGE_POLL_MS = 30000;
   const timers = { save: 0, refresh: 0, toast: 0, view: 0 };
   // Zoom and pan are kept per team and page, so a reload opens the canvas where it was.
   const viewKey = `coolify-canvas-view:${ds.team || ''}:${window.location.pathname}`;
@@ -97,10 +111,13 @@
   let pz;
 
   const canEdit = $derived(!!graph?.can_edit);
+  // Only the environment canvas has its own card positions; server and project views save on it (canMoveGroups).
   const canMove = $derived(canEdit && graph?.can_move !== false);
-  // Server view: unmanaged containers have no environment canvas, and zone frames are laid out, not saved.
-  const canMoveNode = node => canMove && (!serverView || !!node?.environment);
-  const canMoveZones = $derived(canMove && !serverView);
+  // Server canvas: admins drag whole project / environment groups and their cards; each environment saves them.
+  const canMoveGroups = $derived(canEdit && !!graph?.can_move_groups);
+  /** Server view: key of the card's group when the card can be moved there (it is saved on its environment canvas). */
+  const movableGroupOf = node => (canMoveGroups && node ? groupKey([node], node.zone) : null);
+  let groupMeta = {}; // server view: frame top-left and zone inner top-left per group key (see layoutServerView)
   // Environment canvas endpoints of a card (the server view has no endpoints of its own for changes).
   const environmentBase = node => (serverView
     ? `/projects/${encodeURIComponent(node?.project?.uuid || '')}/environments/${encodeURIComponent(node?.environment?.uuid || '')}/canvas`
@@ -123,6 +140,7 @@
     .filter(p => !filter.project || p.uuid === filter.project)
     .flatMap(p => p.environments.map(e => ({ uuid: e.uuid, name: filter.project ? e.name : `${p.name} / ${e.name}` }))));
   const boxes = $derived(graph ? zoneBoxes(graph, positions, sizes) : []);
+  const downZones = $derived(unreachableZones(graph));
   // Server and connect views: project / environment frames inside the zones.
   const frames = $derived(graph?.layout === 'server' || graph?.layout === 'connect'
     ? zoneGroups(graph).flatMap(zone => groupFrames(zone.nodes.filter(n => n.context), positions, sizes))
@@ -197,26 +215,34 @@
   // Floating nav: the canvas fills the screen behind the top bar and the sidebar (see app.css),
   // so fit and the side panel use only the part that the floating panels do not cover.
   function coveredInsets() {
-    if (!floatingBar()) return { top: 0, left: 0 };
     const gap = 8;
     const v = viewport.getBoundingClientRect();
+    // The bottom-left controls and deployments sit below the cards; fit keeps no side space for them.
+    const deploymentsRight = 0;
+    if (!floatingBar()) return { top: 0, left: Math.max(0, deploymentsRight) };
     // The main sidebar, and a page's fixed settings rail (server canvas) when it is on the left.
     const rail = document.querySelector('.application-settings-navigation');
     const panels = [document.querySelector('.app-sidebar > div > nav'), rail && getComputedStyle(rail).position === 'fixed' ? rail : null]
       .map(el => el?.getBoundingClientRect())
       .filter(r => r?.width);
     // The toolbar is in the top bar row, or in a row below it when the top bar has no room (see alignFloatingBar).
-    const barBottom = bar?.isConnected ? bar.getBoundingClientRect().bottom : 0;
+    const barBottom = bar?.isConnected && !inControls() ? bar.getBoundingClientRect().bottom : 0;
     return {
       top: Math.max(0, Math.max(topbar.getBoundingClientRect().bottom, barBottom) + gap - v.top),
-      left: Math.max(0, ...panels.map(r => r.right + gap - v.left)),
+      left: Math.max(0, deploymentsRight, ...panels.map(r => r.right + gap - v.left)),
     };
   }
+  /** Desktop: the toolbar sits in the zoom controls bar (bottom left), not in its own panel. */
+  const inControls = () => !!bar?.closest('[data-canvas-controls]');
   function alignFloatingBar() {
     if (!floatingBar()) {
       panelTop = '';
       return;
     }
+    if (inControls()) {
+      panelTop = `${coveredInsets().top}px`;
+      return;
+    }
     const gap = 8;
     const area = bodyEl.getBoundingClientRect();
     const head = topbar.getBoundingClientRect();
@@ -232,16 +258,13 @@
     panelTop = `${coveredInsets().top}px`;
   }
   function placeBar() {
-    // data-toolbar-inline: the page docks its own actions in the top bar, so the toolbar stays in the canvas.
-    const slot = desktop.matches && !floatingBar() && !('toolbarInline' in ds) && document.getElementById('page-toolbar-slot');
+    // Desktop (every nav style): the toolbar joins the zoom controls bar at the bottom left.
+    // Small screens: a rounded box above the canvas.
     bar.removeAttribute('style');
-    if (floatingBar()) {
-      bar.className = 'fixed z-40 flex flex-wrap items-center justify-center gap-3 rounded-lg border border-neutral-200 bg-white px-2 py-1.5 dark:border-white/[0.08] dark:bg-panel';
-      bodyEl.append(bar);
+    if (desktop.matches) {
+      bar.className = 'ml-0.5 flex items-center gap-2 border-l border-neutral-200 pr-0.5 pl-2 dark:border-white/[0.08]';
+      rootEl.querySelector('[data-canvas-controls]').append(bar);
       alignFloatingBar();
-    } else if (slot) {
-      bar.className = 'flex items-center gap-3 pl-3';
-      slot.append(bar);
     } else {
       bar.className = 'flex shrink-0 flex-wrap items-center gap-3 rounded-lg border border-neutral-200 bg-white px-3 py-2.5 dark:border-white/[0.08] dark:bg-panel';
       barSlot.append(bar);
@@ -285,14 +308,14 @@
       root: node.closest('[data-ec-root]'),
       viewport: node,
       world: node.firstElementChild,
-      zoomLabel: {}, // the toolbar shows `zoom`
+      zoomLabel: {}, // CanvasControls shows `zoom`
       getView: () => view,
       onChange: () => {
         zoom = view.z;
         clearTimeout(timers.view);
         timers.view = setTimeout(saveView, 300);
       },
-      canPan: e => !e.target.closest('[data-ec-card],[data-ec-zone-header],[data-ec-label],[data-ec-link],a,button,input'),
+      canPan: e => !e.target.closest('[data-ec-card],[data-ec-zone-header],[data-ec-group-header],[data-ec-label],[data-ec-link],a,button,input'),
       onPanEnd: moved => {
         if (!moved) closePanel();
       },
@@ -306,7 +329,8 @@
       // Storage full or blocked: the canvas fits to the screen next time.
     }
   }
-  function fit() {
+  /** Shows every card; the first fit of a load keeps them readable (see fitView). */
+  function fit({ readable = false } = {}) {
     const all = graph ? zoneBoxes(graph, positions, sizes) : [];
     const r = viewport.getBoundingClientRect();
     const inset = coveredInsets();
@@ -315,15 +339,13 @@
       pz.apply();
       return;
     }
-    const minX = Math.min(...all.map(b => b.x));
-    const minY = Math.min(...all.map(b => b.y));
-    const maxX = Math.max(...all.map(b => b.x + b.width));
-    const maxY = Math.max(...all.map(b => b.y + b.height));
-    const pad = 48;
-    const width = r.width - inset.left;
-    const height = r.height - inset.top;
-    const z = Math.min(1.1, Math.max(MIN_ZOOM, Math.min((width - pad * 2) / (maxX - minX), (height - pad * 2) / (maxY - minY))));
-    view = { z, x: inset.left + (width - (maxX - minX) * z) / 2 - minX * z, y: inset.top + (height - (maxY - minY) * z) / 2 - minY * z };
+    const bounds = {
+      minX: Math.min(...all.map(b => b.x)),
+      minY: Math.min(...all.map(b => b.y)),
+      maxX: Math.max(...all.map(b => b.x + b.width)),
+      maxY: Math.max(...all.map(b => b.y + b.height)),
+    };
+    view = fitView(bounds, { left: inset.left, top: inset.top, width: r.width - inset.left, height: r.height - inset.top }, readable);
     pz.apply();
   }
 
@@ -351,6 +373,16 @@
   function select(selection) {
     selected = selection;
   }
+  /** Dashboard deployment panel: centres the card at 100% and selects it. */
+  function showNode(id) {
+    const at = positions[id];
+    if (!at) return;
+    const size = sizes[id] || { width: 260, height: 100 };
+    const r = viewport.getBoundingClientRect();
+    view = { z: 1, x: r.width / 2 - at.x - size.width / 2, y: r.height / 2 - at.y - size.height / 2 };
+    pz.apply();
+    select({ kind: 'node', id });
+  }
   function closePanel() {
     if (selected) select(null);
   }
@@ -446,30 +478,39 @@
     if (e.button !== 0 || e.target.closest('a,button,input,[data-ec-port]')) return;
     e.stopPropagation();
     const start = { cx: e.clientX, cy: e.clientY, ...positions[id] };
+    const key = movableGroupOf(nodeById(id));
+    const meta = key ? groupMeta[key] : null;
+    const movable = canMove || !!meta;
     // The other cards and frames stay put during the drag, so measure them once.
     const rules = dragRules(graph, positions, sizes, id);
+    // Server view: the group frame stays inside its zone, below the zone header.
+    const fits = meta
+      ? b => b.x >= meta.inner.x + GROUP_PADDING && b.y >= meta.inner.y + GROUP_HEADER + GROUP_PADDING && rules.fits(b)
+      : rules.fits;
     let moved = false;
     capture(card, e.pointerId);
     begin(`card:${id}`);
     track(card, ev => {
       if (!moved && Math.hypot(ev.clientX - start.cx, ev.clientY - start.cy) < 4) return;
-      if (!canMoveNode(nodeById(id))) return;
+      if (!movable) return;
       const rect = rectOf(id);
       const wanted = { x: start.x + (ev.clientX - start.cx) / view.z, y: start.y + (ev.clientY - start.cy) / view.z, w: rect.width, h: rect.height };
       // Cards cannot cover each other or another zone: stop at the edge of what is in the way.
-      const spot = freeSpot(wanted, rules.others, BOX_GAP, rules.fits);
+      const spot = freeSpot(wanted, rules.others, BOX_GAP, fits);
       if (!spot) return;
       moved = true;
       positions[id] = { x: spot.x, y: spot.y };
     }, () => {
-      if (moved) queueSave({ [id]: { ...positions[id] } });
+      // Server view: save the whole group, so its other cards keep the place they have here.
+      if (moved && meta) saveGroup(graph.nodes.filter(n => groupKey([n], n.zone) === key).map(n => n.id), meta.shift);
+      else if (moved) queueSave({ [id]: { ...positions[id] } });
       else select({ kind: 'node', id });
       end(`card:${id}`);
     });
   }
 
   function startZoneDrag(box, header, e) {
-    if (e.button !== 0 || !canMoveZones || e.target.closest('a')) return;
+    if (e.button !== 0 || !canMove || e.target.closest('a')) return;
     e.stopPropagation();
     const ids = box.nodes.filter(id => positions[id]);
     const starts = Object.fromEntries(ids.map(id => [id, { ...positions[id] }]));
@@ -494,6 +535,53 @@
     });
   }
 
+  /** Server view: drag a project / environment group inside its server zone; it cannot cover another group. */
+  function startGroupDrag(frame, header, e) {
+    if (e.button !== 0 || !canMoveGroups || !frame.key || !groupMeta[frame.key] || e.target.closest('a')) return;
+    e.stopPropagation();
+    const meta = groupMeta[frame.key];
+    const ids = graph.nodes.filter(n => groupKey([n], n.zone) === frame.key).map(n => n.id);
+    const starts = Object.fromEntries(ids.map(id => [id, { ...positions[id] }]));
+    const box = toBox(frame);
+    const others = frames.filter(f => f !== frame && f.zone === frame.zone).map(toBox);
+    const fits = b => b.x >= meta.inner.x && b.y >= meta.inner.y;
+    const origin = { cx: e.clientX, cy: e.clientY };
+    let moved = false;
+    capture(header, e.pointerId);
+    begin('group');
+    track(header, ev => {
+      if (!moved && Math.hypot(ev.clientX - origin.cx, ev.clientY - origin.cy) < 4) return;
+      const wanted = { ...box, x: Math.max(meta.inner.x, box.x + (ev.clientX - origin.cx) / view.z), y: Math.max(meta.inner.y, box.y + (ev.clientY - origin.cy) / view.z) };
+      // Same gap as layoutServerView, so a reload does not move the group.
+      const spot = freeSpot(wanted, others, GROUP_GAP, fits);
+      if (!spot) return;
+      moved = true;
+      for (const id of ids) positions[id] = { x: starts[id].x + spot.x - box.x, y: starts[id].y + spot.y - box.y };
+    }, () => {
+      if (moved) saveGroup(ids, meta.shift);
+      end('group');
+    });
+  }
+
+  /**
+   * Saves the cards of a moved group on their environment canvas (the server canvas has no positions of its own),
+   * so the group keeps its place here and moves by the same distance on the environment canvas.
+   */
+  async function saveGroup(ids, shift) {
+    const saved = Object.fromEntries(ids.map(id => [id, { x: Math.round(positions[id].x - shift.x), y: Math.round(positions[id].y - shift.y) }]));
+    hold(settling.saved, saved);
+    try {
+      await api('PATCH', `${environmentBase(nodeById(ids[0]))}/positions`, { positions: saved });
+      settle(settling.saved, saved);
+      if (!destroyed) applyGraph(full);
+    } catch (e) {
+      release(settling.saved, saved);
+      if (destroyed) return;
+      toast(e.message, true);
+      load({ quiet: true });
+    }
+  }
+
   function startConnect(id, port, e) {
     if (e.button !== 0 || !canEdit) return;
     e.stopPropagation();
@@ -573,18 +661,8 @@
   }
 
   // ── Persistence ──
-  /**
-   * Server view: environment canvas positions of the moved cards and of the other cards of their group,
-   * so the whole group keeps its arrangement on the next layout.
-   */
-  function environmentPositions(ids) {
-    const moved = ids.map(nodeById).filter(n => n?.environment);
-    const members = (graph?.nodes || []).filter(n => offsets[n.id] && positions[n.id]
-      && moved.some(m => m.zone === n.zone && m.environment.uuid === n.environment?.uuid));
-    return Object.fromEntries(members.map(n => [n.id, { x: positions[n.id].x - offsets[n.id].x, y: positions[n.id].y - offsets[n.id].y }]));
-  }
   function queueSave(map) {
-    Object.assign(unsaved, serverView ? environmentPositions(Object.keys(map)) : map);
+    Object.assign(unsaved, map);
     clearTimeout(timers.save);
     timers.save = setTimeout(() => flushSave(), 400);
   }
@@ -594,27 +672,36 @@
     const ids = Object.keys(batch);
     if (!ids.length || !graph) return;
     const rounded = Object.fromEntries(ids.map(id => [id, { x: Math.round(batch[id].x), y: Math.round(batch[id].y) }]));
-    const forget = () => {
-      for (const id of ids) if (unsaved[id] === batch[id]) delete unsaved[id];
-    };
-    // Server view: one request per environment canvas.
-    const requests = new Map();
-    for (const id of ids) {
-      const path = environmentBase(full?.nodes.find(n => n.id === id));
-      requests.set(path, { ...requests.get(path), [id]: rounded[id] });
-    }
+    hold(settling.positions, rounded);
+    for (const id of ids) if (unsaved[id] === batch[id]) delete unsaved[id];
     try {
-      await Promise.all([...requests].map(([path, part]) => api('PATCH', `${path}/positions`, { positions: part }, options)));
+      await api('PATCH', `${base}/positions`, { positions: rounded }, options);
+      settle(settling.positions, rounded);
       if (graph && !destroyed) patchGraph({ positions: { ...(graph.positions || {}), ...rounded } });
-      forget();
     } catch (e) {
-      forget();
+      release(settling.positions, rounded);
       if (destroyed) return;
       toast(e.message, true);
       load({ quiet: true });
     }
   }
 
+  /** Keeps moves that are being saved on the canvas (see settling). */
+  function hold(map, moves) {
+    for (const [id, at] of Object.entries(moves)) map[id] = { at, after: Infinity };
+  }
+  /** The save is done: loads that start from now on return the moves, so they can replace them. */
+  function settle(map, moves) {
+    for (const id of Object.keys(moves)) if (map[id]?.at === moves[id]) map[id].after = loads;
+  }
+  function release(map, moves) {
+    for (const id of Object.keys(moves)) if (map[id]?.at === moves[id]) delete map[id];
+  }
+  /** A load that started after the save returned the saved moves. */
+  function dropSettled(started) {
+    for (const map of Object.values(settling)) for (const [id, entry] of Object.entries(map)) if (entry.after < started) delete map[id];
+  }
+
   // ── Data ──
   /** Shared variables view: a link change moves its resource in or out of the connected zone right away. */
   function setLinks(links) {
@@ -631,12 +718,14 @@
     next.nodes ||= [];
     next.links ||= [];
     next.positions = next.positions && !Array.isArray(next.positions) ? next.positions : {};
-    // Local moves that are not saved yet stay where the user put them.
-    next.positions = { ...next.positions, ...Object.fromEntries(Object.entries(unsaved).map(([id, p]) => [id, { x: p.x, y: p.y }])) };
+    // Local moves that are not saved yet (or not loaded back yet) stay where the user put them.
+    const kept = Object.fromEntries(Object.entries(settling.positions).map(([id, s]) => [id, s.at]));
+    next.positions = { ...next.positions, ...kept, ...Object.fromEntries(Object.entries(unsaved).map(([id, p]) => [id, { x: p.x, y: p.y }])) };
+    if (Object.keys(settling.saved).length) next.nodes = next.nodes.map(n => (settling.saved[n.id] ? { ...n, saved: settling.saved[n.id].at } : n));
     full = next;
     const shown = groupByUse(filterGraph(next, filter));
-    offsets = {};
-    positions = shown.layout === 'server' ? layoutServerView(shown, offsets) : layoutGraph(shown);
+    groupMeta = {};
+    positions = shown.layout === 'server' ? layoutServerView(shown, groupMeta) : layoutGraph(shown);
     graph = shown;
     error = null;
     if (hover && !nodeById(hover)) hover = null;
@@ -649,7 +738,7 @@
       fitted = true;
       // The first load keeps a saved view; later refits (filter changes) fit again.
       if (restoredView) restoredView = null;
-      else fit();
+      else fit({ readable: true });
       // Connect view: ?select=<card id> (from a variable's or tag's connect button) opens that card.
       const wanted = connectView && params.get('select');
       if (wanted && !selected && nodeById(wanted)) select({ kind: 'node', id: wanted });
@@ -664,13 +753,16 @@
       return;
     }
     loading = true;
+    const started = ++loads;
     try {
       const next = await api('GET', base);
+      dropSettled(started);
       if (next && containers) next.nodes = [...(next.nodes || []), ...containers];
       applyGraph(next);
       if (!quiet && fitted && next) toast('Canvas refreshed.');
       // Status refreshes keep the containers; the first load and the Refresh button read them again.
       if (next?.containers_endpoint && (!quiet || !containers)) loadContainers(next.containers_endpoint);
+      if (!quiet || !Object.keys(usage).length) loadUsage();
     } catch (e) {
       if (destroyed) return;
       if (graph) toast(e.message, true);
@@ -697,6 +789,21 @@
     }
   }
 
+  /** Server canvas: live usage per server, after the canvas renders (Sentinel answers through SSH). */
+  function loadUsage() {
+    for (const zone of full?.zones || []) {
+      const path = zone.details?.usage_endpoint;
+      if (!path) continue;
+      api('GET', path)
+        .then(data => {
+          if (!destroyed && data) usage = { ...usage, [zone.id]: data };
+        })
+        .catch(() => {
+          // Usage is optional; the header shows the other server details.
+        });
+    }
+  }
+
   function scheduleRefresh(delay = 1000) {
     clearTimeout(timers.refresh);
     timers.refresh = setTimeout(() => load({ quiet: true }), delay);
@@ -730,6 +837,19 @@
       }
     }
 
+    // data-poll (seconds): reload while the page is visible, for changes without a broadcast event (dashboard deployments).
+    if (Number(ds.poll) > 0) {
+      const poll = setInterval(() => {
+        if (document.visibilityState === 'visible') load({ quiet: true });
+      }, Number(ds.poll) * 1000);
+      cleanups.push(() => clearInterval(poll));
+    }
+
+    const usagePoll = setInterval(() => {
+      if (document.visibilityState === 'visible') loadUsage();
+    }, USAGE_POLL_MS);
+    cleanups.push(() => clearInterval(usagePoll));
+
     pz.apply();
     load({ quiet: true });
 
@@ -759,20 +879,14 @@
   <!-- The toolbar's place above the canvas; use:dock moves it into the top bar when there is room. -->
   <div bind:this={barSlot} class="contents">
     <Toolbar
-      title={ds.title}
       viewOnly={!!graph && !canEdit}
       {viewOnlyTitle}
       {filter}
       {projects}
       {environments}
-      {loading}
-      {zoom}
       {views}
       {dock}
       onfilter={setFilter}
-      onrefresh={() => load()}
-      onzoom={z => pz.zoomTo(z)}
-      onfit={fit}
     />
   </div>
 
@@ -796,14 +910,21 @@
       <div class="absolute top-0 left-0 origin-top-left">
         <div class="absolute top-0 left-0">
           {#each boxes as box (box.id ?? '__none')}
-            <Zone {box} movable={canMoveZones} onpress={(e, header) => startZoneDrag(box, header, e)} />
+            <Zone {box} movable={canMove} nodes={box.nodes.map(nodeById).filter(Boolean)} usage={usage[box.id]} onpress={(e, header) => startZoneDrag(box, header, e)} />
           {/each}
         </div>
         <!-- Server view: project / environment frames inside the server zones. -->
         <div class="pointer-events-none absolute top-0 left-0">
           {#each frames as frame, i (i)}
+            {@const movableGroup = canMoveGroups && !!frame.key}
             <div class="absolute rounded-xl border border-dashed border-neutral-300 dark:border-white/[0.12]" style:left="{frame.x}px" style:top="{frame.y}px" style:width="{frame.width}px" style:height="{frame.height}px">
-              <div class="flex h-8 items-center gap-1.5 px-3 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+              <!-- svelte-ignore a11y_no_static_element_interactions -->
+              <div
+                class="flex h-8 items-center gap-1.5 px-3 text-[11px] font-medium text-neutral-500 dark:text-fg-dim {movableGroup ? 'pointer-events-auto cursor-grab active:cursor-grabbing' : ''}"
+                data-ec-group-header
+                title={movableGroup ? 'Drag to move this group' : undefined}
+                onpointerdown={e => startGroupDrag(frame, e.currentTarget, e)}
+              >
                 <Icon name="service" class="size-3 text-neutral-400 dark:text-fg-faint" />
                 <a class="pointer-events-auto truncate hover:text-neutral-700 dark:hover:text-fg [&[href]]:cursor-pointer [&[href]]:underline-offset-2 [&[href]]:hover:underline" href={frame.link || undefined} draggable="false">{frame.name || 'Other'}</a>
               </div>
@@ -854,22 +975,28 @@
         </div>
         <div class="absolute top-0 left-0">
           {#each graph?.nodes || [] as node (node.id)}
-            <Card
-              {node}
-              position={positions[node.id]}
-              selected={selected?.kind === 'node' && selected.id === node.id}
-              dropTarget={dropTarget === node.id}
-              movable={canMoveNode(node)}
-              port={canEdit && (connectView ? isSource(node) && !node.missing : !serverView || !!node.environment)
-                ? (connectView ? text.port : 'Drag to another card to draw a link')
-                : null}
-              linkCount={linkCounts[node.id] || 0}
-              zoneNames={zoneNames(node)}
-              onpress={(e, card) => startCardDrag(node.id, card, e)}
-              onconnect={(e, port) => startConnect(node.id, port, e)}
-              onselect={() => select({ kind: 'node', id: node.id })}
-              onhover={on => hoverCard(node.id, on)}
-            />
+            {#if node.type === 'empty'}
+              <EmptyCard {node} position={positions[node.id]} />
+            {:else}
+              <Card
+                {node}
+                position={positions[node.id]}
+                selected={selected?.kind === 'node' && selected.id === node.id}
+                dropTarget={dropTarget === node.id}
+                movable={canMove || !!movableGroupOf(node)}
+                port={canEdit && (connectView ? isSource(node) && !node.missing : !serverView || !!node.environment)
+                  ? (connectView ? text.port : 'Drag to another card to draw a link')
+                  : null}
+                linkCount={linkCounts[node.id] || 0}
+                zoneNames={zoneNames(node)}
+                serverDown={downZones.has(node.zone)}
+                statusText={graph?.layout === 'server'}
+                onpress={(e, card) => startCardDrag(node.id, card, e)}
+                onconnect={(e, port) => startConnect(node.id, port, e)}
+                onselect={() => select({ kind: 'node', id: node.id })}
+                onhover={on => hoverCard(node.id, on)}
+              />
+            {/if}
           {/each}
         </div>
         <!-- Link end dots sit above the cards, on their edges (like the deploy canvas ports). -->
@@ -909,6 +1036,14 @@
       </div>
     {/if}
 
+    <!-- Bottom left: zoom controls, then the dashboard's recent deployments next to them. -->
+    <div class="pointer-events-none absolute bottom-3 left-3 right-3 z-20 flex items-end gap-2 *:pointer-events-auto" data-ec-dock>
+      <CanvasControls inline {zoom} {loading} onzoom={z => pz.zoomTo(z)} onfit={() => fit()} onrefresh={() => load()} />
+      {#if graph?.deployments?.length}
+        <Deployments deployments={graph.deployments} {nodeById} onshow={showNode} />
+      {/if}
+    </div>
+
     {#if graph && (panelNode || panelLink)}
       {#key `${selected.kind}:${selected.id}`}
         <Panel
diff --git a/resources/js/canvas/environment/Panel.svelte b/resources/js/canvas/environment/Panel.svelte
index 12bc001300..b4fd9c549c 100644
--- a/resources/js/canvas/environment/Panel.svelte
+++ b/resources/js/canvas/environment/Panel.svelte
@@ -246,14 +246,6 @@
       {/snippet}
       {@render section('Containers', containers)}
     {/if}
-    {#if node.volumes?.length}
-      {#snippet volumes()}
-        <div class="flex flex-wrap gap-1">
-          {#each node.volumes as v, i (i)}<span class="max-w-full truncate rounded-full border border-neutral-200 bg-neutral-50 px-2 py-0.5 text-[11px] text-neutral-600 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim">{v}</span>{/each}
-        </div>
-      {/snippet}
-      {@render section('Volumes', volumes)}
-    {/if}
     {#snippet linkList()}
       <ul class="flex flex-col gap-0.5">
         {#if !nodeLinks.length}<li class={faint}>{canEdit ? 'No links. Drag the dot on the right edge of a card to another card.' : 'No links.'}</li>{/if}
diff --git a/resources/js/canvas/environment/StatusDot.svelte b/resources/js/canvas/environment/StatusDot.svelte
index 26bed75873..0778c28dbb 100644
--- a/resources/js/canvas/environment/StatusDot.svelte
+++ b/resources/js/canvas/environment/StatusDot.svelte
@@ -1,11 +1,11 @@
 <script>
   import { statusLabel, statusTone, TONE_DOT } from '../../environment-canvas.js';
 
-  let { status, size = 'size-2' } = $props();
+  let { status, size = 'size-2', title = null } = $props();
   const tone = $derived(statusTone(status));
 </script>
 
-<span class="relative flex {size} shrink-0" title={statusLabel(status)}>
+<span class="relative flex {size} shrink-0" title={title || statusLabel(status)}>
   {#if tone === 'busy'}
     <span class="absolute inline-flex size-full rounded-full opacity-75 motion-safe:animate-ping {TONE_DOT.busy}"></span>
   {/if}
diff --git a/resources/js/canvas/environment/Toolbar.svelte b/resources/js/canvas/environment/Toolbar.svelte
index f286c791a0..ee53dcb078 100644
--- a/resources/js/canvas/environment/Toolbar.svelte
+++ b/resources/js/canvas/environment/Toolbar.svelte
@@ -1,9 +1,8 @@
 <script>
-  // Title, filters, refresh and zoom. The root docks it (use:dock) into the app top bar on desktop,
-  // or in a rounded box above the canvas on small screens.
-  import Icon from './Icon.svelte';
+  // Filters and view toggles. The root docks it (use:dock) into the zoom controls bar
+  // (CanvasControls, bottom left) on desktop, or in a rounded box above the canvas on small screens.
 
-  let { title, viewOnly, viewOnlyTitle, filter, projects, environments, loading, zoom, views, dock, onfilter, onrefresh, onzoom, onfit } = $props();
+  let { viewOnly, viewOnlyTitle, filter, projects, environments, views, dock, onfilter } = $props();
 
   const select = 'select h-8! w-44 py-0! text-[12px]! max-lg:w-auto max-lg:min-w-0 max-lg:flex-1 max-lg:basis-32';
   const value = (options, wanted) => (options.some(o => o.uuid === wanted) ? wanted : '');
@@ -18,7 +17,6 @@
 
 <div use:dock data-ec-toolbar>
   <div class="flex min-w-0 items-center gap-2">
-    {#if title}<b class="shrink-0 text-[14px] font-semibold text-black dark:text-fg">{title}</b>{/if}
     <span class="inline-flex items-center">
       <span class="px-2 py-0.5 text-xs font-medium leading-normal rounded-full bg-coollabs/10 text-coollabs border border-coollabs/30 dark:bg-warning/15 dark:text-warning dark:border-warning/30">Beta</span>
     </span>
@@ -37,15 +35,5 @@
       <option value="">All environments</option>
       {#each environments as o (o.uuid)}<option value={o.uuid}>{o.name}</option>{/each}
     </select>
-    <button type="button" class="button" title="Load the latest status" disabled={loading} onclick={onrefresh}>
-      <Icon name="refresh" class="size-3.5 {loading ? 'animate-spin' : ''}" />
-      <span class="hidden sm:inline">Refresh</span>
-    </button>
-    <div class="flex items-center">
-      <button type="button" class="button px-2! rounded-r-none!" title="Zoom out" aria-label="Zoom out" onclick={() => onzoom(zoom / 1.2)}><Icon name="minus" /></button>
-      <button type="button" class="button rounded-none! border-x-0! w-14 tabular-nums" title="Reset zoom to 100%" onclick={() => onzoom(1)}>{Math.round(zoom * 100)}%</button>
-      <button type="button" class="button px-2! rounded-l-none!" title="Zoom in" aria-label="Zoom in" onclick={() => onzoom(zoom * 1.2)}><Icon name="plus" /></button>
-    </div>
-    <button type="button" class="button px-2!" title="Fit to screen" aria-label="Fit to screen" onclick={onfit}><Icon name="fit" />Fit</button>
   </div>
 </div>
diff --git a/resources/js/canvas/environment/Zone.svelte b/resources/js/canvas/environment/Zone.svelte
index 2bbc915609..cff405a1fb 100644
--- a/resources/js/canvas/environment/Zone.svelte
+++ b/resources/js/canvas/environment/Zone.svelte
@@ -1,32 +1,100 @@
 <script>
   // A zone frame (server, or a group of the connect view) with its header; the header drags the zone.
-  import { NO_SERVER } from '../../environment-canvas.js';
+  // Server canvas zones (zone.details) add a second row: host facts, proxy, live usage and a status summary.
+  import { formatMemory, formatUptime, NO_SERVER, statusSummary, zoneHeader } from '../../environment-canvas.js';
   import Icon from './Icon.svelte';
 
-  let { box, movable, onpress } = $props();
+  let { box, movable, onpress, nodes = [], usage = null } = $props();
   let header;
+  // The server IP stays hidden until the user asks for it (screen sharing, screenshots).
+  let showIp = $state(false);
   const zone = $derived(box.zone);
   const ok = $derived(zone?.is_reachable && zone?.is_usable);
   const title = $derived(movable ? 'Drag to move every card in this zone' : !zone ? 'Resources without a server' : undefined);
+  const details = $derived(zone?.details);
+  const host = $derived(details
+    ? [details.os, details.arch, details.cpus ? `${details.cpus} ${details.cpus === 1 ? 'CPU' : 'CPUs'}` : null, formatMemory(details.memory_bytes), details.uptime_since && formatUptime(details.uptime_since) ? `up ${formatUptime(details.uptime_since)}` : null].filter(Boolean)
+    : []);
+  const proxyRunning = $derived(details?.proxy?.status === 'running');
+  const summary = $derived(details && zone?.is_reachable ? statusSummary(nodes) : null);
+  const SUMMARY = [
+    ['ok', 'running', 'bg-emerald-500'],
+    ['busy', 'starting', 'bg-warning'],
+    ['warn', 'degraded', 'bg-warning'],
+    ['bad', 'stopped', 'bg-red-500'],
+    ['idle', 'unknown', 'bg-neutral-400 dark:bg-neutral-500'],
+  ];
+  const USAGE = [['cpu', 'CPU'], ['memory', 'Memory'], ['disk', 'Disk']];
+  const usageTone = value => (value >= 90 ? 'text-red-600 dark:text-red-400' : value >= 75 ? 'text-warning-700 dark:text-warning' : 'text-neutral-600 dark:text-fg-dim');
+  const sep = 'h-3 w-px shrink-0 bg-neutral-200 dark:bg-white/[0.1]';
 </script>
 
 <div
-  class="absolute rounded-2xl border border-neutral-200 bg-white/50 dark:border-white/[0.07] dark:bg-white/[0.02]"
+  class="absolute rounded-2xl border border-neutral-200 bg-[color-mix(in_oklab,var(--color-neutral-50),white_50%)] dark:border-white/[0.07] dark:bg-[color-mix(in_oklab,var(--color-app),var(--color-panel)_35%)]"
   style:left="{box.x}px"
   style:top="{box.y}px"
   style:width="{box.width}px"
   style:height="{box.height}px"
 >
-  <div bind:this={header} class="flex h-10 items-center gap-2 px-4 text-[12px] {movable ? 'cursor-grab active:cursor-grabbing' : ''}" data-ec-zone-header {title} role="presentation" onpointerdown={e => onpress(e, header)}>
-    <Icon name={zone?.icon || 'server'} class="size-3.5 text-neutral-400 dark:text-fg-faint" />
-    <a class="truncate font-semibold text-neutral-700 dark:text-fg [&[href]]:cursor-pointer [&[href]]:underline-offset-2 [&[href]]:hover:underline" href={zone?.link || undefined} draggable="false">{box.name || NO_SERVER}</a>
-    <!-- Zones with an icon are not server zones (connect view). -->
-    {#if zone && !zone.icon}
-      <span
-        class="size-1.5 shrink-0 rounded-full {ok ? 'bg-emerald-500' : zone.is_reachable ? 'bg-warning' : 'bg-red-500'}"
-        title={ok ? 'Reachable' : zone.is_reachable ? 'Reachable, not usable' : 'Not reachable'}
-      ></span>
-      {#if zone.ip}<span class="truncate font-mono text-[11px] text-neutral-400 dark:text-fg-faint">{zone.ip}</span>{/if}
+  <div bind:this={header} class="px-4 {movable ? 'cursor-grab active:cursor-grabbing' : ''}" style:height="{zoneHeader(zone)}px" data-ec-zone-header {title} role="presentation" onpointerdown={e => onpress(e, header)}>
+    <div class="flex h-10 items-center gap-2 text-[12px]">
+      <Icon name={zone?.icon || 'server'} class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+      <a class="truncate font-semibold text-neutral-700 dark:text-fg [&[href]]:cursor-pointer [&[href]]:underline-offset-2 [&[href]]:hover:underline" href={zone?.link || undefined} draggable="false">{box.name || NO_SERVER}</a>
+      <!-- Zones with an icon are not server zones (connect view). -->
+      {#if zone && !zone.icon}
+        {#if ok}
+          <span class="size-1.5 shrink-0 rounded-full bg-emerald-500" title="Reachable"></span>
+        {:else}
+          <!-- Spelled out: the status of every card on this server is unknown while it is down. -->
+          <span
+            class="inline-flex h-5 shrink-0 items-center gap-1.5 rounded-full border px-2 text-[11px] font-medium {zone.is_reachable
+              ? 'border-warning/40 bg-warning/10 text-warning-700 dark:text-warning'
+              : 'border-red-200 bg-red-50 text-red-600 dark:border-red-500/30 dark:bg-red-500/10 dark:text-red-400'}"
+            title={zone.is_reachable ? 'Coolify can connect to this server, but cannot use it (for example, Docker is missing)' : 'Coolify cannot connect to this server. The status of its resources is unknown.'}
+          >
+            <span class="size-1.5 rounded-full {zone.is_reachable ? 'bg-warning' : 'bg-red-500'}"></span>
+            {zone.is_reachable ? 'Not usable' : 'Unreachable'}
+          </span>
+        {/if}
+        {#if zone.ip}
+          <button
+            type="button"
+            class="truncate font-mono text-[11px] text-neutral-400 hover:text-neutral-600 dark:text-fg-faint dark:hover:text-fg-dim"
+            title={showIp ? 'Hide IP address' : 'Show IP address'}
+            onpointerdown={e => e.stopPropagation()}
+            onclick={() => (showIp = !showIp)}
+          >{showIp ? zone.ip : 'Show IP'}</button>
+        {/if}
+        {#if summary}
+          <span class="ml-auto flex shrink-0 items-center gap-2.5 text-[11px] text-neutral-500 dark:text-fg-dim" title="Resources on this server by status">
+            {#each SUMMARY as [tone, label, dot] (tone)}
+              {#if summary[tone]}
+                <span class="inline-flex items-center gap-1"><span class="size-1.5 rounded-full {dot}"></span>{summary[tone]} {label}</span>
+              {/if}
+            {/each}
+          </span>
+        {/if}
+      {/if}
+    </div>
+    {#if details}
+      <div class="flex h-5 min-w-0 items-center gap-2.5 overflow-hidden text-[11px] whitespace-nowrap text-neutral-500 dark:text-fg-faint">
+        {#if host.length}<span class="truncate" title="Operating system, architecture, CPUs, memory and uptime">{host.join(' · ')}</span>{/if}
+        {#if details.proxy}
+          {#if host.length}<span class={sep}></span>{/if}
+          <span class="inline-flex shrink-0 items-center gap-1.5" title="Proxy: {details.proxy.status || 'unknown'}">
+            <span class="size-1.5 rounded-full {proxyRunning ? 'bg-emerald-500' : details.proxy.status ? 'bg-red-500' : 'bg-neutral-400'}"></span>
+            {details.proxy.type.charAt(0) + details.proxy.type.slice(1).toLowerCase()}{proxyRunning ? '' : ` ${details.proxy.status || ''}`}
+          </span>
+        {/if}
+        {#if usage && USAGE.some(([key]) => usage[key] !== null && usage[key] !== undefined)}
+          <span class={sep}></span>
+          {#each USAGE as [key, label] (key)}
+            {#if usage[key] !== null && usage[key] !== undefined}
+              <span class="shrink-0" title="{label} usage (last minute)">{label} <span class="font-medium tabular-nums {usageTone(usage[key])}">{Math.round(usage[key])}%</span></span>
+            {/if}
+          {/each}
+        {/if}
+      </div>
     {/if}
   </div>
 </div>
diff --git a/resources/js/deploy-canvas.test.js b/resources/js/deploy-canvas.test.js
index e4f9be5461..a8fbecc2d7 100644
--- a/resources/js/deploy-canvas.test.js
+++ b/resources/js/deploy-canvas.test.js
@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { freeSpot } from './canvas-core.js';
+import { freeSpot, zoomShortcut } from './canvas-core.js';
 import { canFollow, domainList, fresh, logoOf, onlyOption, parseEnvVars, planOf, splitImage, targetFrom, uniqueLabels, withDeploy, withoutSecrets, withTarget } from './deploy-canvas.js';
 
 test('splits the tag out of an image name', () => {
@@ -176,3 +176,14 @@ test('shows the logo of what a source step creates, like the rest of Coolify', (
     assert.equal(src('database', {}), null);
     assert.equal(src('server', {}), null);
 });
+
+test('reads the browser zoom shortcut so the canvas can zoom instead', () => {
+    const key = (key, mods = {}) => zoomShortcut({ key, ctrlKey: false, metaKey: false, altKey: false, ...mods });
+    assert.equal(key('=', { metaKey: true }), 'in');
+    assert.equal(key('+', { ctrlKey: true }), 'in');
+    assert.equal(key('-', { ctrlKey: true }), 'out');
+    assert.equal(key('0', { metaKey: true }), 'reset');
+    assert.equal(key('-'), null);
+    assert.equal(key('-', { ctrlKey: true, altKey: true }), null);
+    assert.equal(key('s', { metaKey: true }), null);
+});
diff --git a/resources/js/environment-canvas.js b/resources/js/environment-canvas.js
index ed2f105912..1d29816809 100644
--- a/resources/js/environment-canvas.js
+++ b/resources/js/environment-canvas.js
@@ -3,7 +3,7 @@
 //
 // DOM-free: `node --test` imports this file.
 
-import { apart, BOX_GAP, MAX_ZOOM, MIN_ZOOM } from './canvas-core.js';
+import { apart, BOX_GAP, freeSpot, MAX_ZOOM, MIN_ZOOM } from './canvas-core.js';
 
 export const CARD_WIDTH = 260;
 export const COLUMN_GAP = 48;
@@ -11,8 +11,8 @@ export const ROW_GAP = 24;
 export const ZONE_GAP = 72;
 export const ZONE_PADDING = 24;
 export const ZONE_HEADER = 40;
+export const SERVER_ZONE_HEADER = 68; // server canvas: a second header row with host facts, proxy and usage
 export const MAX_CHILDREN = 5;
-export const MAX_VOLUMES = 3;
 export const MAX_ROWS = 6; // auto placement wraps a type into another column after this many cards
 export const NO_SERVER = 'No server';
 export const DOUBLE_CLICK_MS = 400;
@@ -25,6 +25,8 @@ export const isSource = node => node?.type === 'variable' || node?.type === 'tag
 const columnOf = node => COLUMNS[node?.type] ?? 0;
 const columnLeft = (originX, column) => originX + column * (CARD_WIDTH + COLUMN_GAP);
 const isPoint = p => !!p && Number.isFinite(Number(p.x)) && Number.isFinite(Number(p.y));
+/** Header height of a zone frame: server canvas zones show a second row of server details. */
+export const zoneHeader = zone => (zone?.details ? SERVER_ZONE_HEADER : ZONE_HEADER);
 const storedPositions = graph => (graph?.positions && !Array.isArray(graph.positions) ? graph.positions : {});
 
 // ── Pure helpers (tested) ─────────────────────────────────────────────
@@ -33,7 +35,7 @@ const storedPositions = graph => (graph?.positions && !Array.isArray(graph.posit
 export function estimateNodeHeight(node) {
   let height = 58; // padding + icon/name row
   if (node?.urls?.length) height += 20;
-  if (node?.extra_zones?.length || node?.volumes?.length) height += 28;
+  if (node?.extra_zones?.length) height += 28;
   const children = node?.children?.length || 0;
   if (children) height += 12 + Math.min(children, MAX_CHILDREN) * 20 + (children > MAX_CHILDREN ? 20 : 0);
   return height;
@@ -132,11 +134,27 @@ const contextGroups = nodes => {
 const byTypeAndName = (a, b) => columnOf(a) - columnOf(b) || String(a.name).localeCompare(String(b.name));
 
 /**
- * Card positions inside one group, from (0, 0). Linked cards form chains from
- * left to right (source before target, one column per step); every chain gets
- * its own rows. Cards without links follow in a grid of SINGLE_COLUMNS.
+ * Card positions inside one group, from (0, 0). Cards with a position saved on their environment
+ * canvas (node.saved) keep that arrangement; the other cards follow below them in the grid the environment
+ * canvas uses, so both canvases show the group the same way. Otherwise linked
+ * cards form chains from left to right (source before target, one column per step); every chain
+ * gets its own rows. Cards without links follow in a grid of SINGLE_COLUMNS.
  */
 export function layoutBlock(nodes, links = []) {
+  const saved = nodes.filter(n => isPoint(n.saved));
+  if (saved.length) {
+    const left = Math.min(...saved.map(n => Number(n.saved.x)));
+    const top = Math.min(...saved.map(n => Number(n.saved.y)));
+    const out = {};
+    for (const n of saved) out[n.id] = { x: Number(n.saved.x) - left, y: Number(n.saved.y) - top };
+    const width = Math.max(...saved.map(n => out[n.id].x)) + CARD_WIDTH;
+    const bottom = Math.max(...saved.map(n => out[n.id].y + estimateNodeHeight(n)));
+    const rest = nodes.filter(n => !out[n.id]);
+    if (!rest.length) return { positions: out, width, height: bottom };
+    // Same grid as the environment canvas (layoutGraph) puts below the saved cards, so both canvases match.
+    const height = placeGrid(rest, 0, bottom + ROW_GAP, out);
+    return { positions: out, width: Math.max(...Object.values(out).map(p => p.x)) + CARD_WIDTH, height };
+  }
   const ids = new Set(nodes.map(n => n.id));
   const inside = links.filter(l => ids.has(l.source) && ids.has(l.target) && l.source !== l.target);
   const parent = new Map(nodes.map(n => [n.id, n.id]));
@@ -201,69 +219,95 @@ export function layoutBlock(nodes, links = []) {
 }
 
 /**
- * A project / environment group with cards saved on its environment canvas:
- * the same placement as that canvas (saved cards, then a grid below them),
- * moved so the top-left card starts at (0, 0). Groups without saved cards use layoutBlock.
+ * Server view: key of a project / environment group on one server ("<environment uuid>:<zone id>").
+ * Groups of an empty environment (placeholder card) have none, so they cannot be moved.
  */
-export function layoutStoredBlock(nodes, stored, links = []) {
-  if (!nodes.some(n => isPoint(stored[n.id]))) return layoutBlock(nodes, links);
-  const zone = nodes[0].zone;
-  const placed = layoutGraph({ zones: [{ id: zone }], nodes: nodes.map(n => ({ ...n, zone })), positions: stored });
-  const minX = Math.min(...nodes.map(n => placed[n.id].x));
-  const minY = Math.min(...nodes.map(n => placed[n.id].y));
-  const positions = Object.fromEntries(nodes.map(n => [n.id, { x: placed[n.id].x - minX, y: placed[n.id].y - minY }]));
-  return {
-    positions,
-    origin: { x: minX, y: minY },
-    width: Math.max(...nodes.map(n => positions[n.id].x + CARD_WIDTH)),
-    height: Math.max(...nodes.map(n => positions[n.id].y + estimateNodeHeight(n))),
-  };
-}
+export const groupKey = (nodes, zoneId) => {
+  const environment = nodes.find(n => n.type !== 'empty' && n.environment?.uuid)?.environment?.uuid;
+  return environment && zoneId ? `${environment}:${zoneId}` : null;
+};
 
 /**
- * Top-left of the given cards where their environment canvas places them. A group saved for the first time
- * from the server view goes there, so it does not cover the cards of the environment on other servers.
+ * Server view: zones stack downwards. A group with cards saved on its environment canvas (node.saved) sits where
+ * those cards are, so the server canvas and the environment canvas share one position (a group that would
+ * leave the zone or cover another group moves to the nearest free spot). Other groups follow below,
+ * GROUPS_PER_ROW per row. When `groups` is given, it gets per group key its frame top-left, the zone's inner
+ * top-left, and `shift`: environment canvas position = server view position - shift.
  */
-function environmentOrigin(graph, nodes) {
-  const environment = nodes[0]?.environment?.uuid;
-  if (!environment) return { x: 0, y: 0 };
-  const placed = layoutGraph({
-    zones: graph.zones,
-    nodes: (graph.nodes || []).filter(n => n.environment?.uuid === environment),
-    positions: storedPositions(graph),
-  });
-  return { x: Math.min(...nodes.map(n => placed[n.id].x)), y: Math.min(...nodes.map(n => placed[n.id].y)) };
-}
-
-/**
- * Server view: zones stack downwards; inside a zone, one block per project / environment, GROUPS_PER_ROW per row.
- * When `offsets` is given, it gets per card the shift from its environment canvas position to its server view
- * position, so a moved card can be saved on its environment canvas.
- */
-export function layoutServerView(graph, offsets = null) {
-  const stored = storedPositions(graph);
+export function layoutServerView(graph, groups = null, { compact = false } = {}) {
   const out = {};
   let y = 0;
   for (const zone of zoneGroups(graph)) {
-    const innerTop = y + ZONE_HEADER + ZONE_PADDING;
+    const inner = { x: 0, y: y + zoneHeader(zone.zone) + ZONE_PADDING };
+    const blocks = contextGroups(zone.nodes).map(([, nodes]) => {
+      const saved = nodes.filter(n => isPoint(n.saved));
+      const block = layoutBlock(nodes, graph.links || []);
+      return {
+        key: groupKey(nodes, zone.id),
+        nodes,
+        block,
+        size: { w: block.width + GROUP_PADDING * 2, h: GROUP_HEADER + GROUP_PADDING * 2 + block.height },
+        at: saved.length ? { x: Math.min(...saved.map(n => Number(n.saved.x))), y: Math.min(...saved.map(n => Number(n.saved.y))) } : null,
+      };
+    });
+    // Empty environments (placeholder cards only) go next to the other groups after these are placed.
+    const isEmpty = b => b.nodes.every(n => n.type === 'empty');
+    const pinned = blocks.filter(b => b.at).sort((a, b) => a.at.y - b.at.y || a.at.x - b.at.x);
+    // The environment canvas puts its first cards below a zone header; those land at the zone's top-left here.
+    const shift = { x: inner.x + GROUP_PADDING, y: inner.y + GROUP_HEADER + GROUP_PADDING - ZONE_HEADER - ZONE_PADDING };
+    const frames = [];
+    const place = ({ key, block, size }, left, top) => {
+      frames.push({ x: left, y: top });
+      for (const [id, p] of Object.entries(block.positions)) {
+        out[id] = { x: left + GROUP_PADDING + p.x, y: top + GROUP_HEADER + GROUP_PADDING + p.y };
+      }
+      if (groups && key) groups[key] = { x: left, y: top, inner, shift };
+      return top + size.h;
+    };
+    const taken = [];
+    const inside = b => b.x >= inner.x && b.y >= inner.y;
+    let bottom = inner.y;
+    for (const b of pinned) {
+      // Environment canvas positions can be left of or above the zone (negative coordinates): keep the group inside.
+      const wanted = {
+        x: Math.max(inner.x, b.at.x + shift.x - GROUP_PADDING),
+        y: Math.max(inner.y, b.at.y + shift.y - GROUP_HEADER - GROUP_PADDING),
+        ...b.size,
+      };
+      const spot = freeSpot(wanted, taken, GROUP_GAP, inside) || wanted;
+      taken.push({ ...spot, project: b.nodes[0]?.project?.uuid });
+      bottom = Math.max(bottom, place(b, spot.x, spot.y));
+    }
     let x = 0;
-    let rowTop = innerTop;
-    let rowBottom = innerTop;
-    contextGroups(zone.nodes).forEach(([, nodes], i) => {
+    let rowTop = pinned.length ? bottom + GROUP_GAP : inner.y;
+    let rowBottom = rowTop;
+    blocks.filter(b => !b.at && !isEmpty(b)).forEach((b, i) => {
       if (i > 0 && i % GROUPS_PER_ROW === 0) {
         x = 0;
         rowTop = rowBottom + GROUP_GAP;
       }
-      const block = layoutStoredBlock(nodes, stored, graph.links || []);
-      const origin = offsets ? (block.origin ?? environmentOrigin(graph, nodes)) : null;
-      for (const [id, p] of Object.entries(block.positions)) {
-        out[id] = { x: x + GROUP_PADDING + p.x, y: rowTop + GROUP_HEADER + GROUP_PADDING + p.y };
-        if (offsets) offsets[id] = { x: out[id].x - origin.x - p.x, y: out[id].y - origin.y - p.y };
-      }
-      x += block.width + GROUP_PADDING * 2 + GROUP_GAP;
-      rowBottom = Math.max(rowBottom, rowTop + GROUP_HEADER + GROUP_PADDING * 2 + block.height);
+      taken.push({ x, y: rowTop, ...b.size, project: b.nodes[0]?.project?.uuid });
+      rowBottom = Math.max(rowBottom, place(b, x, rowTop));
+      x += b.size.w + GROUP_GAP;
     });
-    y = rowBottom + ZONE_PADDING + ZONE_GAP;
+    bottom = Math.max(bottom, rowBottom);
+    // Right of the last group of the same project (or of the zone), at the nearest free spot.
+    for (const b of blocks.filter(b => !b.at && isEmpty(b))) {
+      const project = b.nodes[0]?.project?.uuid;
+      const anchor = taken.filter(t => t.project === project).at(-1) || taken.at(-1);
+      const wanted = anchor ? { x: anchor.x + anchor.w + GROUP_GAP, y: anchor.y, ...b.size } : { ...inner, ...b.size };
+      const spot = freeSpot(wanted, taken, GROUP_GAP, inside) || wanted;
+      taken.push({ ...spot, project });
+      bottom = Math.max(bottom, place(b, spot.x, spot.y));
+    }
+    if (compact && frames.length) {
+      // The groups keep their arrangement, but start at the zone's top-left (no empty space from saved positions).
+      const dx = inner.x - Math.min(...frames.map(f => f.x));
+      const dy = inner.y - Math.min(...frames.map(f => f.y));
+      for (const n of zone.nodes) if (out[n.id]) out[n.id] = { x: out[n.id].x + dx, y: out[n.id].y + dy };
+      bottom += dy;
+    }
+    y = bottom + ZONE_PADDING + ZONE_GAP;
   }
   return out;
 }
@@ -283,7 +327,7 @@ export function layoutConnectView(graph) {
     out[n.id] = { x: 0, y };
     y += estimateNodeHeight(n) + ROW_GAP;
   }
-  const offset = variables ? CARD_WIDTH + ZONE_PADDING * 2 + ZONE_GAP * 3 : 0;
+  const offset = variables ? CARD_WIDTH + ZONE_PADDING * 2 + ZONE_GAP * 2 : 0;
   let top = 0;
   if (connected) {
     y = ZONE_HEADER + ZONE_PADDING;
@@ -298,7 +342,8 @@ export function layoutConnectView(graph) {
     top = y - GROUP_GAP + ZONE_PADDING + ZONE_GAP;
   }
   const others = groups.filter(g => g.id !== SOURCES_ZONE && g.id !== CONNECTED_ZONE);
-  const placed = layoutServerView({ zones: others.map(g => g.zone || { id: g.id }), nodes: others.flatMap(g => g.nodes) });
+  // Compact: groups cannot be moved here, so positions saved on the environment canvas must not leave gaps.
+  const placed = layoutServerView({ zones: others.map(g => g.zone || { id: g.id }), nodes: others.flatMap(g => g.nodes) }, null, { compact: true });
   for (const [id, p] of Object.entries(placed)) out[id] = { x: p.x + offset, y: p.y + top };
   return out;
 }
@@ -326,6 +371,8 @@ export function groupFrames(nodes, positions, sizes = {}) {
     const minY = Math.min(...rects.map(r => r.y));
     frames.push({
       name,
+      key: groupKey(members, members[0].zone),
+      zone: members[0].zone,
       link: members[0].context_link,
       x: minX - GROUP_PADDING,
       y: minY - GROUP_PADDING - GROUP_HEADER,
@@ -366,9 +413,9 @@ export function zoneBoxes(graph, positions, sizes = {}) {
       zone: group.zone,
       nodes: group.nodes.map(n => n.id),
       x: minX - ZONE_PADDING,
-      y: minY - ZONE_PADDING - ZONE_HEADER,
+      y: minY - ZONE_PADDING - zoneHeader(group.zone),
       width: maxX - minX + ZONE_PADDING * 2,
-      height: maxY - minY + ZONE_PADDING * 2 + ZONE_HEADER,
+      height: maxY - minY + ZONE_PADDING * 2 + zoneHeader(group.zone),
     });
   }
   return boxes;
@@ -399,7 +446,7 @@ export function dragRules(graph, positions, sizes, id) {
   const groupSide = grouped ? GROUP_PADDING : 0;
   const groupTop = grouped ? GROUP_PADDING + GROUP_HEADER : 0;
   const side = ZONE_PADDING + groupSide;
-  const top = ZONE_PADDING + ZONE_HEADER + groupTop;
+  const top = ZONE_PADDING + zoneHeader(own?.zone) + groupTop;
   const zones = zoneBoxes(graph, positions, sizes).filter(z => !z.nodes.includes(id)).map(toBox);
   const groups = grouped ? groupFrames(own.nodes.filter(n => context(n) !== context(node)), positions, sizes).map(toBox) : [];
   const zoneMates = rects(own?.nodes || []);
@@ -409,7 +456,8 @@ export function dragRules(graph, positions, sizes, id) {
   return {
     others: [...rects(graph.nodes), ...zones.map(z => room(z, side, top)), ...groups.map(g => room(g, groupSide, groupTop))],
     fits: box => zones.every(z => apart(frameAround([...zoneMates, box], side, top), z, BOX_GAP))
-      && (!grouped || groups.every(g => apart(frameAround([...groupMates, box], groupSide, groupTop), g, BOX_GAP))),
+      // Same gap between groups as layoutServerView, so a reload does not move the group.
+      && (!grouped || groups.every(g => apart(frameAround([...groupMates, box], groupSide, groupTop), g, GROUP_GAP))),
   };
 }
 
@@ -474,6 +522,62 @@ export function statusTone(status) {
   return 'idle';
 }
 
+export const READABLE_ZOOM = 0.6;
+const FIT_PAD = 48;
+
+/**
+ * View ({x, y, z}) that shows the content bounds in the free part of the viewport ({left, top, width, height}).
+ * `readable`: never below READABLE_ZOOM; content that does not fit then starts at its top-left,
+ * so the cards can be read and the user scrolls to the rest.
+ */
+export function fitView(bounds, area, readable = false) {
+  const w = bounds.maxX - bounds.minX;
+  const h = bounds.maxY - bounds.minY;
+  const room = { w: area.width - FIT_PAD * 2, h: area.height - FIT_PAD * 2 };
+  const whole = Math.min(room.w / w, room.h / h);
+  const z = Math.min(1.1, Math.max(readable ? READABLE_ZOOM : MIN_ZOOM, whole));
+  const x = w * z <= room.w ? area.left + (area.width - w * z) / 2 : area.left + FIT_PAD;
+  const y = h * z <= room.h ? area.top + (area.height - h * z) / 2 : area.top + FIT_PAD;
+  return { z, x: x - bounds.minX * z, y: y - bounds.minY * z };
+}
+
+/** Resource cards per status tone ({ok, warn, bad, busy, idle}); unmanaged containers are not counted. */
+export function statusSummary(nodes) {
+  const out = { ok: 0, warn: 0, bad: 0, busy: 0, idle: 0 };
+  for (const n of nodes || []) if (n.type !== 'container' && !isSource(n)) out[statusTone(n.status)]++;
+  return out;
+}
+
+/** "running:healthy" → "Running": the state word for the status text on a card. */
+export function statusWord(status) {
+  return statusLabel(status).replace(/\s*\(.*$/, '');
+}
+
+/** 1007820800 → "1 GB", 17179869184 → "16 GB". */
+export function formatMemory(bytes) {
+  if (!bytes) return null;
+  const gb = bytes / 1024 ** 3;
+  return `${gb < 10 ? Math.round(gb * 10) / 10 : Math.round(gb)} GB`;
+}
+
+/** Time since a "YYYY-MM-DD HH:MM:SS" (UTC) or ISO date, as "45m", "5h", "12d". */
+export function formatUptime(since, now = Date.now()) {
+  const at = Date.parse(String(since || '').replace(' ', 'T') + (/[zZ]|[+-]\d\d:?\d\d$/.test(since || '') ? '' : 'Z'));
+  if (!Number.isFinite(at)) return null;
+  const minutes = Math.max(0, Math.floor((now - at) / 60000));
+  if (minutes < 60) return `${minutes}m`;
+  if (minutes < 60 * 24) return `${Math.floor(minutes / 60)}h`;
+  return `${Math.floor(minutes / 1440)}d`;
+}
+
+/**
+ * Ids of the server zones whose server is not reachable. The saved status of their resources is stale,
+ * so the canvas shows it as unknown. Zones with an icon (projects, connect view) are not servers.
+ */
+export function unreachableZones(graph) {
+  return new Set((graph?.zones || []).filter(z => !z.icon && z.is_reachable === false).map(z => z.id));
+}
+
 /** "running:healthy" → "Running (healthy)". */
 export function statusLabel(status) {
   const value = String(status ?? '').trim();
@@ -587,6 +691,7 @@ export const TONE_DOT = {
 };
 // Outline icons, drawn from local paths.
 export const ICONS = {
+  chevron: ['M6 15l6-6 6 6'],
   application: ['M3 6.5A2.5 2.5 0 0 1 5.5 4h13A2.5 2.5 0 0 1 21 6.5v11a2.5 2.5 0 0 1-2.5 2.5h-13A2.5 2.5 0 0 1 3 17.5z', 'M3 9h18', 'M9.5 13l-2 2 2 2', 'M14.5 13l2 2-2 2'],
   service: ['M12 4 3 8.5l9 4.5 9-4.5z', 'M3 12.5l9 4.5 9-4.5', 'M3 16.5l9 4.5 9-4.5'],
   database: ['M5 6c0-1.66 3.13-3 7-3s7 1.34 7 3-3.13 3-7 3-7-1.34-7-3z', 'M5 6v12c0 1.66 3.13 3 7 3s7-1.34 7-3V6', 'M5 12c0 1.66 3.13 3 7 3s7-1.34 7-3'],
diff --git a/resources/js/environment-canvas.test.js b/resources/js/environment-canvas.test.js
index 5d7c096be9..6786d577af 100644
--- a/resources/js/environment-canvas.test.js
+++ b/resources/js/environment-canvas.test.js
@@ -2,18 +2,28 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
   CARD_WIDTH,
+  GROUP_GAP,
   MAX_ROWS,
   COLUMN_GAP,
   ROW_GAP,
   ZONE_HEADER,
   ZONE_PADDING,
+  ZONE_GAP,
   canConnect,
   canLink,
   dragRules,
   filterGraph,
   groupByUse,
   filterOptions,
+  fitView,
+  formatMemory,
+  formatUptime,
+  SERVER_ZONE_HEADER,
+  statusSummary,
+  statusWord,
+  READABLE_ZOOM,
   groupFrames,
+  groupKey,
   layoutBlock,
   estimateNodeHeight,
   layoutGraph,
@@ -23,10 +33,11 @@ import {
   statusTone,
   zoneBoxes,
   readView,
+  unreachableZones,
 } from './environment-canvas.js';
 import { freeSpot } from './canvas-core.js';
 
-const node = (id, type, zone, extra = {}) => ({ id, type, zone, name: id, status: 'running:healthy', extra_zones: [], urls: [], children: [], volumes: [], ...extra });
+const node = (id, type, zone, extra = {}) => ({ id, type, zone, name: id, status: 'running:healthy', extra_zones: [], urls: [], children: [], ...extra });
 const graph = (nodes, extra = {}) => ({
   zones: [{ id: 's1', name: 'One' }, { id: 's2', name: 'Two' }],
   nodes,
@@ -101,7 +112,7 @@ test('auto-placed zones go below zones with stored cards', () => {
 
 test('estimates taller cards for urls, chips, and children', () => {
   const plain = estimateNodeHeight(node('a', 'service', 's1'));
-  const rich = estimateNodeHeight(node('b', 'service', 's1', { urls: ['https://x'], volumes: ['v'], children: [{ name: 'c' }, { name: 'd' }] }));
+  const rich = estimateNodeHeight(node('b', 'service', 's1', { urls: ['https://x'], extra_zones: ['s2'], children: [{ name: 'c' }, { name: 'd' }] }));
   assert.ok(rich > plain);
   const capped = estimateNodeHeight(node('c', 'service', 's1', { children: Array.from({ length: 20 }, (_, i) => ({ name: `c${i}` })) }));
   const six = estimateNodeHeight(node('d', 'service', 's1', { children: Array.from({ length: 6 }, (_, i) => ({ name: `c${i}` })) }));
@@ -239,20 +250,6 @@ test('server view: one frame per project / environment, and the frames do not ov
   assert.equal(positions.a.y, positions.b.y);
 });
 
-test('server view: a group keeps the arrangement saved on its environment canvas', () => {
-  const graph = {
-    layout: 'server',
-    zones: [{ id: 'z1', name: 'web' }],
-    nodes: [srv('a', 'application', 'Shop / prod'), srv('b', 'database', 'Shop / prod'), srv('c', 'service', 'Shop / prod')],
-    links: [],
-    positions: { a: { x: 900, y: 500 }, b: { x: 600, y: 800 } },
-  };
-  const positions = layoutGraph(graph);
-  assert.equal(positions.a.x - positions.b.x, 300);
-  assert.equal(positions.b.y - positions.a.y, 300);
-  assert.ok(positions.c.y >= positions.b.y + estimateNodeHeight(graph.nodes[1]), 'a card without a saved position goes below');
-});
-
 const envNode = (id, type, zone, environment, extra = {}) => srv(id, type, `Shop / ${environment}`, { zone, project: { uuid: 'p' }, environment: { uuid: environment }, ...extra });
 
 test('server view: cards link only to cards of the same environment', () => {
@@ -267,26 +264,180 @@ test('server view: cards link only to cards of the same environment', () => {
   assert.equal(canConnect(g, 'container:1', 'a'), false);
 });
 
-test('server view: a moved group saved on its environment canvas keeps its arrangement', () => {
+test('server view: positions saved on an environment canvas are ignored', () => {
   const g = {
     layout: 'server',
-    zones: [{ id: 'z1', name: 'web' }, { id: 'z2', name: 'db' }],
-    nodes: [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'database', 'z1', 'prod'), envNode('c', 'service', 'z2', 'prod'), envNode('d', 'application', 'z1', 'dev')],
-    links: [{ id: 'l', source: 'a', target: 'b' }],
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'database', 'z1', 'prod')],
+    links: [],
     positions: {},
   };
-  const offsets = {};
-  const positions = layoutServerView(g, offsets);
-  // The user drags b 100px down; the canvas saves its group (a, b) in environment canvas coordinates.
-  positions.b = { x: positions.b.x, y: positions.b.y + 100 };
-  const saved = Object.fromEntries(['a', 'b'].map(id => [id, { x: positions[id].x - offsets[id].x, y: positions[id].y - offsets[id].y }]));
-  const again = layoutServerView({ ...g, positions: saved });
-  assert.deepEqual(again.a, positions.a);
-  assert.deepEqual(again.b, positions.b);
-  // On the environment canvas the saved cards do not cover the card of the same environment on the other server.
-  const environment = layoutGraph({ zones: g.zones, nodes: g.nodes.filter(n => n.environment.uuid === 'prod'), positions: saved });
-  const bottom = Math.max(...['a', 'b'].map(id => environment[id].y + estimateNodeHeight(g.nodes.find(n => n.id === id))));
-  assert.ok(environment.c.y > bottom);
+  const auto = layoutServerView(g);
+  assert.deepEqual(layoutServerView({ ...g, positions: { a: { x: 900, y: 700 } } }), auto);
+});
+
+test('server view: cards keep the arrangement saved on their environment canvas, new cards go below', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      envNode('a', 'application', 'z1', 'prod', { saved: { x: 900, y: 700 } }),
+      envNode('b', 'database', 'z1', 'prod', { saved: { x: 600, y: 900 } }),
+      envNode('c', 'service', 'z1', 'prod'),
+    ],
+    links: [],
+  };
+  const p = layoutServerView(g);
+  assert.equal(p.a.x - p.b.x, 300);
+  assert.equal(p.b.y - p.a.y, 200);
+  assert.equal(p.c.x, p.b.x);
+  assert.ok(p.c.y >= p.b.y + estimateNodeHeight(g.nodes[1]) + ROW_GAP);
+});
+
+test('server view: a group with one saved card matches the environment canvas arrangement', () => {
+  const apps = Array.from({ length: MAX_ROWS + 1 }, (_, i) => envNode(`n${i}`, 'application', 'z1', 'prod'));
+  const nodes = [envNode('a', 'application', 'z1', 'prod', { saved: { x: 1000, y: 697 } }), ...apps, envNode('d', 'database', 'z1', 'prod')];
+  const env = layoutGraph({ zones: [{ id: 'z1', name: 'web' }], nodes, links: [], positions: { a: { x: 1000, y: 697 } } });
+  const server = layoutServerView({ layout: 'server', zones: [{ id: 'z1', name: 'web' }], nodes, links: [{ source: 'n0', target: 'd' }] });
+  for (const n of nodes) {
+    assert.deepEqual({ x: server[n.id].x - server.a.x, y: server[n.id].y - server.a.y }, { x: env[n.id].x - env.a.x, y: env[n.id].y - env.a.y }, n.id);
+  }
+});
+
+test('server view: a moved card saved with its group on the environment canvas stays where it was dropped', () => {
+  const nodes = [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'service', 'z1', 'prod'), envNode('d', 'database', 'z1', 'prod')];
+  const g = { layout: 'server', zones: [{ id: 'z1', name: 'web' }], nodes, links: [] };
+  const groups = {};
+  const before = layoutServerView(g, groups);
+  const { shift } = groups['prod:z1'];
+  const dropped = { ...before, b: { x: before.b.x + 120, y: before.b.y + 400 } };
+  const saved = Object.fromEntries(nodes.map(n => [n.id, { x: dropped[n.id].x - shift.x, y: dropped[n.id].y - shift.y }]));
+  const after = layoutServerView({ ...g, nodes: nodes.map(n => ({ ...n, saved: saved[n.id] })) });
+  assert.deepEqual(after, dropped);
+});
+
+test('server view: zones with server details get the taller header', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web', details: { os: 'Ubuntu' } }],
+    nodes: [envNode('a', 'application', 'z1', 'prod')],
+    links: [],
+    positions: {},
+  };
+  const positions = layoutServerView(g);
+  const [box] = zoneBoxes(g, positions);
+  assert.equal(box.y, 0);
+  assert.ok(positions.a.y > SERVER_ZONE_HEADER);
+});
+
+test('server view: groups sit where their cards are saved on the environment canvas', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      envNode('a', 'application', 'z1', 'prod', { saved: { x: 0, y: ZONE_HEADER + ZONE_PADDING } }),
+      envNode('b', 'application', 'z1', 'stage', { saved: { x: 600, y: ZONE_HEADER + ZONE_PADDING } }),
+      envNode('c', 'application', 'z1', 'dev'),
+    ],
+    links: [],
+    positions: {},
+  };
+  const groups = {};
+  const positions = layoutServerView(g, groups);
+  // A card at the start of the environment canvas sits at the zone's top-left.
+  assert.equal(groups['prod:z1'].x, 0);
+  assert.equal(groups['prod:z1'].y, groups['prod:z1'].inner.y);
+  assert.equal(positions.b.x - positions.a.x, 600);
+  // The environment canvas position comes back from the server view position.
+  const { shift } = groups['prod:z1'];
+  assert.deepEqual({ x: positions.b.x - shift.x, y: positions.b.y - shift.y }, { x: 600, y: ZONE_HEADER + ZONE_PADDING });
+  // A group without saved cards goes below.
+  assert.ok(positions.c.y > positions.a.y + estimateNodeHeight(g.nodes[0]));
+});
+
+test('server view: a group saved left of the zone stays inside it', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [envNode('a', 'application', 'z1', 'prod', { saved: { x: -236, y: 251 } })],
+    links: [],
+    positions: {},
+  };
+  const groups = {};
+  layoutServerView(g, groups);
+  assert.equal(groups['prod:z1'].x, groups['prod:z1'].inner.x);
+});
+
+test('server view: saved groups of different environments that would overlap are moved apart', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [
+      envNode('a', 'application', 'z1', 'prod', { saved: { x: 0, y: 0 } }),
+      envNode('b', 'application', 'z1', 'stage', { saved: { x: 0, y: 0 } }),
+    ],
+    links: [],
+    positions: {},
+  };
+  const groups = {};
+  layoutServerView(g, groups);
+  const [p, s] = [groups['prod:z1'], groups['stage:z1']];
+  assert.ok(Math.abs(p.x - s.x) >= CARD_WIDTH || Math.abs(p.y - s.y) >= estimateNodeHeight(g.nodes[0]), 'the groups do not cover each other');
+});
+
+test('status summary counts resources by tone, without unmanaged containers', () => {
+  const nodes = [
+    node('a', 'application', 'z', { status: 'running:healthy' }),
+    node('b', 'database', 'z', { status: 'exited:unhealthy' }),
+    node('c', 'service', 'z', { status: 'exited' }),
+    node('container:1', 'container', 'z', { status: 'exited' }),
+  ];
+  assert.deepEqual(statusSummary(nodes), { ok: 1, warn: 0, bad: 2, busy: 0, idle: 0 });
+  assert.equal(statusWord('exited:unhealthy'), 'Exited');
+});
+
+test('server details: memory and uptime formats', () => {
+  assert.equal(formatMemory(1007820800), '0.9 GB');
+  assert.equal(formatMemory(17179869184), '16 GB');
+  assert.equal(formatMemory(null), null);
+  const now = Date.parse('2026-10-14T12:00:00Z');
+  assert.equal(formatUptime('2026-10-14 11:15:00', now), '45m');
+  assert.equal(formatUptime('2026-10-14 07:00:00', now), '5h');
+  assert.equal(formatUptime('2026-10-02T12:00:00+00:00', now), '12d');
+  assert.equal(formatUptime('nonsense', now), null);
+});
+
+test('unreachable server zones: only server zones whose server is not reachable', () => {
+  const zones = [
+    { id: 'up', is_reachable: true },
+    { id: 'down', is_reachable: false },
+    { id: 'project', icon: 'projects' },
+  ];
+  assert.deepEqual([...unreachableZones({ zones })], ['down']);
+  assert.equal(unreachableZones(null).size, 0);
+});
+
+test('fit: shows everything when it stays readable, centered', () => {
+  const v = fitView({ minX: 0, minY: 0, maxX: 400, maxY: 200 }, { left: 0, top: 0, width: 1000, height: 600 }, true);
+  assert.equal(v.z, 1.1);
+  assert.equal(v.x, (1000 - 440) / 2);
+});
+
+test('fit: the first fit of a large canvas keeps the cards readable and starts at the top-left', () => {
+  const bounds = { minX: 100, minY: 50, maxX: 3100, maxY: 4050 };
+  const area = { left: 0, top: 0, width: 1280, height: 520 };
+  assert.ok(fitView(bounds, area).z < READABLE_ZOOM, 'the fit button still shows everything');
+  const v = fitView(bounds, area, true);
+  assert.equal(v.z, READABLE_ZOOM);
+  assert.equal(v.x + bounds.minX * v.z, 48);
+  assert.equal(v.y + bounds.minY * v.z, 48);
+});
+
+test('fit: a tall, narrow canvas keeps its column centered', () => {
+  const v = fitView({ minX: 0, minY: 0, maxX: 300, maxY: 5000 }, { left: 0, top: 0, width: 1280, height: 520 }, true);
+  assert.equal(v.z, READABLE_ZOOM);
+  assert.equal(v.x, (1280 - 300 * READABLE_ZOOM) / 2);
+  assert.equal(v.y, 48);
 });
 
 test('variables view: variables stack on the left by name, resources sit to their right', () => {
@@ -435,3 +586,76 @@ test('server view: a dragged card stops before its group covers another group',
   const [f1, f2] = groupFrames(g.nodes, positions);
   assert.ok(apart(f1, f2), 'the project / environment frames do not overlap');
 });
+
+test('server view: a group dropped as close to another group as a drag allows stays there after a reload', () => {
+  const nodes = [envNode('a', 'application', 'z1', 'prod'), envNode('b', 'application', 'z1', 'staging')];
+  const g = { layout: 'server', zones: [{ id: 'z1', name: 'web' }], nodes, links: [] };
+  const groups = {};
+  const before = layoutServerView(g, groups);
+  const [prod, staging] = groupFrames(nodes, before);
+  // Drag the staging group to the left of the prod group: it stops at the gap the drag keeps.
+  const box = { x: staging.x, y: staging.y, w: staging.width, h: staging.height };
+  const others = [{ x: prod.x, y: prod.y, w: prod.width, h: prod.height }];
+  const { inner } = groups[groupKey([nodes[1]], 'z1')];
+  const spot = freeSpot({ ...box, x: prod.x + 40 }, others, GROUP_GAP, b => b.x >= inner.x && b.y >= inner.y);
+  const dropped = { ...before, b: { x: before.b.x + spot.x - box.x, y: before.b.y + spot.y - box.y } };
+  const shift = id => groups[groupKey([nodes.find(n => n.id === id)], 'z1')].shift;
+  const saved = Object.fromEntries(nodes.map(n => [n.id, { x: dropped[n.id].x - shift(n.id).x, y: dropped[n.id].y - shift(n.id).y }]));
+  const after = layoutServerView({ ...g, nodes: nodes.map(n => ({ ...n, saved: saved[n.id] })) });
+  assert.deepEqual(after, dropped);
+});
+
+test('server view: a dragged card keeps its group as far from another group as the layout does', () => {
+  const g = {
+    layout: 'server',
+    zones: [{ id: 'z1', name: 'web' }],
+    nodes: [srv('a', 'application', 'Shop / prod'), srv('c', 'application', 'Blog / prod')],
+    links: [],
+    positions: {},
+  };
+  const before = layoutServerView(g);
+  const { others, fits } = dragRules(g, before, {}, 'a');
+  const start = { ...before.a, w: CARD_WIDTH, h: estimateNodeHeight(g.nodes[0]) };
+  // The layout puts the groups GROUP_GAP apart: a card cannot move its group closer to the other one.
+  assert.equal(freeSpot({ ...start, x: start.x - 10 }, others, undefined, fits), null);
+});
+
+test('groupKey: a group with only an empty-environment placeholder has no key, so it cannot be moved', () => {
+  const environment = { uuid: 'env', name: 'production' };
+  assert.equal(groupKey([{ id: 'empty:env', type: 'empty', environment }], 'empty'), null);
+  assert.equal(groupKey([{ id: 'a', type: 'application', environment }], 'srv'), 'env:srv');
+});
+
+test('layoutServerView: an empty environment sits right of the other groups of its project, not below them', () => {
+  const shop = { uuid: 'shop', name: 'Shop' };
+  const node = (id, context, extra = {}) => ({ id, type: 'application', zone: 'srv', context, project: shop, environment: { uuid: context }, ...extra });
+  const graph = {
+    layout: 'server',
+    zones: [{ id: 'srv', name: 'srv' }],
+    nodes: [
+      node('a', 'Shop / staging', { saved: { x: 0, y: 0 } }),
+      node('empty:prod', 'Shop / production', { type: 'empty' }),
+    ],
+    links: [],
+  };
+  const out = layoutServerView(graph);
+  assert.equal(out['empty:prod'].y, out.a.y);
+  assert.ok(out['empty:prod'].x >= out.a.x + CARD_WIDTH);
+});
+
+test('variables view: saved environment canvas positions do not push resources away from the variables', () => {
+  const g = {
+    layout: 'connect',
+    zones: [{ id: 'sources', name: 'Server variables', icon: 'variable' }, { id: 'resources', name: 'Other resources', icon: 'service' }],
+    nodes: [
+      node('variable:1', 'variable', 'sources', { name: 'COOLIFY_SERVER_NAME' }),
+      node('app', 'application', 'resources', { context: 'Shop / prod', environment: { uuid: 'e1' }, saved: { x: 900, y: 1200 } }),
+    ],
+    links: [],
+    positions: {},
+  };
+  const [variables, resources] = zoneBoxes(g, layoutGraph(g));
+
+  assert.equal(resources.y, variables.y, 'both zones start at the top');
+  assert.ok(resources.x - (variables.x + variables.width) <= ZONE_GAP * 2, 'resources sit next to the variables');
+});
diff --git a/resources/js/settings-sidebar-accordion.js b/resources/js/settings-sidebar-accordion.js
deleted file mode 100644
index 11dec0c320..0000000000
--- a/resources/js/settings-sidebar-accordion.js
+++ /dev/null
@@ -1,42 +0,0 @@
-// Alpine data provider for the collapsible resource settings sidebar
-// (x-data="settingsSidebarAccordion({ activeGroup, storageKey })").
-//
-// Every group is open by default; each group can be collapsed/expanded and the
-// choice is remembered per resource type. The active group is always forced open
-// on load so the current page stays reachable.
-export function initializeSettingsSidebarAccordionComponent() {
-    window.Alpine.data('settingsSidebarAccordion', (config = {}) => ({
-        activeGroup: config.activeGroup || '',
-        storageKey: config.storageKey || 'coolify.settings-sidebar',
-        groups: {},
-        init() {
-            let stored = {};
-            try {
-                stored = JSON.parse(localStorage.getItem(this.storageKey)) || {};
-            } catch (e) {
-                stored = {};
-            }
-            this.groups = stored && typeof stored === 'object' ? stored : {};
-        },
-        isOpen(group) {
-            // The current page must stay visible, even when this group was
-            // previously stored as collapsed on another page.
-            if (group === this.activeGroup) {
-                return true;
-            }
-
-            if (Object.prototype.hasOwnProperty.call(this.groups, group)) {
-                return this.groups[group];
-            }
-            return true;
-        },
-        toggle(group) {
-            this.groups = { ...this.groups, [group]: !this.isOpen(group) };
-            try {
-                localStorage.setItem(this.storageKey, JSON.stringify(this.groups));
-            } catch (e) {
-                // ignore storage errors (private mode, quota, etc.)
-            }
-        },
-    }));
-}
diff --git a/resources/js/traffic-globe.js b/resources/js/traffic-globe.js
index 49f52ac9ac..ca8fd6a175 100644
--- a/resources/js/traffic-globe.js
+++ b/resources/js/traffic-globe.js
@@ -24,16 +24,26 @@ const THEMES = {
 };
 
 /**
- * Turn country-breakdown rows into cobe markers. Marker size scales with the
- * square root of request volume so a single dominant country doesn't dwarf the rest.
+ * Turn marker rows into cobe markers. A row is placed at its own `lat`/`lon`
+ * (a city) or at the centroid of its ISO-A2 `code` (a country). Marker size
+ * scales with the square root of request volume so one dominant place doesn't
+ * dwarf the rest. City markers are smaller, because cities are close together.
  *
- * @param {Array<{code: string, requests: number}>} data
+ * @param {Array<{code?: string, lat?: number, lon?: number, requests: number}>} data
  * @returns {Array<{location: [number, number], size: number}>}
  */
 function buildMarkers(data) {
     const rows = (data || [])
-        .map((r) => ({ code: String(r.code || '').toUpperCase(), requests: Number(r.requests || 0) }))
-        .filter((r) => r.requests > 0 && CENTROIDS[r.code]);
+        .map((r) => {
+            const city = Number.isFinite(r.lat) && Number.isFinite(r.lon);
+
+            return {
+                city,
+                location: city ? [r.lat, r.lon] : CENTROIDS[String(r.code || '').toUpperCase()],
+                requests: Number(r.requests || 0),
+            };
+        })
+        .filter((r) => r.requests > 0 && r.location);
 
     if (rows.length === 0) {
         return [];
@@ -41,14 +51,29 @@ function buildMarkers(data) {
 
     const max = Math.max(...rows.map((r) => r.requests));
 
-    return rows.map((r) => ({
-        location: CENTROIDS[r.code],
-        size: Math.max(0.03, Math.min(0.11, Math.sqrt(r.requests / max) * 0.11)),
-    }));
+    return rows.map((r) => {
+        const [min, cap] = r.city ? [0.02, 0.07] : [0.03, 0.11];
+
+        return {
+            location: r.location,
+            size: Math.max(min, Math.min(cap, Math.sqrt(r.requests / max) * cap)),
+        };
+    });
 }
 
 const TWO_PI = Math.PI * 2;
 
+const SPIN_SPEED = 0.15; // rad/s
+// Ambient spin is drawn at 30fps. A little under two 60Hz frames, so timestamp
+// jitter does not skip to the third frame.
+const SPIN_FRAME_MS = 1000 / 30 - 4;
+const SETTLE_EPSILON = 0.0005;
+
+// Signed shortest angular distance from `current` to `target`.
+function angleDelta(current, target) {
+    return ((target - current + Math.PI) % TWO_PI + TWO_PI) % TWO_PI - Math.PI;
+}
+
 // cobe orientation for a lat/lng so the point faces the viewer (cobe's own
 // focus example formula). Returns [phi, theta].
 function locationToAngles(lat, lng) {
@@ -58,23 +83,21 @@ function locationToAngles(lat, lng) {
 // Shortest-path angular interpolation, so easing across the 0/2π seam never
 // spins the long way around.
 function lerpAngle(current, target, t) {
-    let delta = ((target - current + Math.PI) % TWO_PI + TWO_PI) % TWO_PI - Math.PI;
-
-    return current + delta * t;
+    return current + angleDelta(current, target) * t;
 }
 
 /**
  * Mount an interactive, drag-to-rotate dotted globe onto a canvas. Returns a
- * controller with `update(data, dark)`, `focus(code)`, `resume()` and
+ * controller with `update(data, dark)`, `focus(target)`, `resume()` and
  * `destroy()`. The globe auto-rotates, pauses while grabbed or while a country
  * is hover-focused, and eases smoothly toward whatever it's pointed at.
  *
  * cobe v2 has no internal render loop or `onRender` callback: createGlobe draws
  * a single frame and returns `{ update, destroy }`. We drive our own rAF loop,
- * calling `globe.update({...})` each frame for rotation and to swap markers/theme.
+ * which draws only while something moves and stops when the canvas is off-screen.
  *
  * @param {HTMLCanvasElement} canvas
- * @param {Array<{code: string, requests: number}>} data
+ * @param {Array<{code?: string, lat?: number, lon?: number, requests: number}>} data
  * @param {boolean} dark
  */
 function mountTrafficGlobe(canvas, data, dark) {
@@ -82,6 +105,9 @@ function mountTrafficGlobe(canvas, data, dark) {
     let width = 0;
     let destroyed = false;
     let rafId = 0;
+    let lastDraw = 0;
+    let dirty = true;
+    let visible = true;
     let markers = buildMarkers(data);
 
     // Ambient spin is decorative; honor reduced-motion by not auto-rotating
@@ -103,6 +129,7 @@ function mountTrafficGlobe(canvas, data, dark) {
         dragStartPhi = targetPhi;
         autoRotate = false;
         canvas.style.cursor = 'grabbing';
+        wake();
     };
     const onPointerUp = () => {
         if (dragging === null) {
@@ -111,10 +138,12 @@ function mountTrafficGlobe(canvas, data, dark) {
         dragging = null;
         autoRotate = ! prefersReduced;
         canvas.style.cursor = 'grab';
+        wake();
     };
     const onPointerMove = (e) => {
         if (dragging !== null) {
             targetPhi = dragStartPhi + (e.clientX - dragging) / 150;
+            wake();
         }
     };
 
@@ -127,7 +156,7 @@ function mountTrafficGlobe(canvas, data, dark) {
         const theme = isDark ? THEMES.dark : THEMES.light;
 
         globe = createGlobe(canvas, {
-            devicePixelRatio: 2,
+            devicePixelRatio: Math.min(window.devicePixelRatio || 1, 2),
             width: width,
             height: width,
             phi: currentPhi,
@@ -144,20 +173,45 @@ function mountTrafficGlobe(canvas, data, dark) {
         });
     };
 
-    // Self-driven animation loop (cobe v2 draws only when we call update()).
-    const tick = () => {
-        if (destroyed) {
+    const schedule = () => {
+        if (! rafId && ! destroyed && globe && visible) {
+            rafId = requestAnimationFrame(tick);
+        }
+    };
+
+    // Request a draw; a no-op while one is already queued.
+    function wake() {
+        dirty = true;
+        schedule();
+    }
+
+    // Draws only while the globe spins or eases toward a target, then goes idle.
+    const tick = (now) => {
+        rafId = 0;
+        if (destroyed || ! globe || width === 0) {
             return;
         }
-        if (globe && width > 0) {
-            if (autoRotate && dragging === null) {
-                targetPhi += 0.0025;
-            }
-            currentPhi = lerpAngle(currentPhi, targetPhi, 0.12);
-            currentTheta += (targetTheta - currentTheta) * 0.12;
-            globe.update({ phi: currentPhi, theta: currentTheta, width: width, height: width, markers });
+        const spinning = autoRotate && dragging === null;
+        const elapsed = now - lastDraw;
+        if (spinning && ! dirty && elapsed < SPIN_FRAME_MS) {
+            schedule();
+
+            return;
+        }
+        if (spinning) {
+            targetPhi += (SPIN_SPEED * Math.min(elapsed, 100)) / 1000;
+        }
+        currentPhi = lerpAngle(currentPhi, targetPhi, 0.12);
+        currentTheta += (targetTheta - currentTheta) * 0.12;
+        globe.update({ phi: currentPhi, theta: currentTheta, width: width, height: width, markers });
+        lastDraw = now;
+        dirty = false;
+
+        const settled = Math.abs(angleDelta(currentPhi, targetPhi)) < SETTLE_EPSILON
+            && Math.abs(targetTheta - currentTheta) < SETTLE_EPSILON;
+        if (spinning || ! settled) {
+            schedule();
         }
-        rafId = requestAnimationFrame(tick);
     };
 
     // cobe needs a non-zero canvas width at creation; inside a freshly-rendered
@@ -170,17 +224,26 @@ function mountTrafficGlobe(canvas, data, dark) {
         }
         width = next;
         create(dark);
-        rafId = requestAnimationFrame(tick);
+        wake();
     };
 
     const resizeObserver = new ResizeObserver(() => {
         if (globe) {
             width = canvas.offsetWidth || width;
+            wake();
         } else {
             ensure();
         }
     });
     resizeObserver.observe(canvas);
+
+    const intersectionObserver = new IntersectionObserver((entries) => {
+        visible = entries[entries.length - 1].isIntersecting;
+        if (visible) {
+            wake();
+        }
+    });
+    intersectionObserver.observe(canvas);
     requestAnimationFrame(ensure);
 
     return {
@@ -203,19 +266,22 @@ function mountTrafficGlobe(canvas, data, dark) {
                 });
             }
         },
-        focus(code) {
-            const c = CENTROIDS[String(code || '').toUpperCase()];
-            if (!c) {
+        // `target` is an ISO-A2 code or a [lat, lon] pair.
+        focus(target) {
+            const c = Array.isArray(target) ? target : CENTROIDS[String(target || '').toUpperCase()];
+            if (!c || !Number.isFinite(c[0]) || !Number.isFinite(c[1])) {
                 return;
             }
             const [phi, theta] = locationToAngles(c[0], c[1]);
             targetPhi = phi;
             targetTheta = theta;
             autoRotate = false;
+            wake();
         },
         resume() {
             if (dragging === null) {
                 autoRotate = ! prefersReduced;
+                wake();
             }
         },
         destroy() {
@@ -225,6 +291,7 @@ function mountTrafficGlobe(canvas, data, dark) {
                 rafId = 0;
             }
             resizeObserver.disconnect();
+            intersectionObserver.disconnect();
             canvas.removeEventListener('pointerdown', onPointerDown);
             window.removeEventListener('pointerup', onPointerUp);
             window.removeEventListener('pointermove', onPointerMove);
diff --git a/resources/js/traffic-table.js b/resources/js/traffic-table.js
new file mode 100644
index 0000000000..0012b65d52
--- /dev/null
+++ b/resources/js/traffic-table.js
@@ -0,0 +1,112 @@
+// Client-side sort and paging for the traffic analytics lists. Each row carries
+// its sort values as JSON in `data-row`. Rows are moved in the DOM, so keyboard
+// and screen-reader order match the visual order. A Livewire morph puts the rows
+// back in server order (they are keyed) and can add or remove rows, so the rows
+// are sorted again after it.
+function compareValues(a, b) {
+    if (typeof a === 'number' && typeof b === 'number') {
+        return a - b;
+    }
+
+    return String(a).localeCompare(String(b), undefined, { numeric: true, sensitivity: 'base' });
+}
+
+function trafficTable({ per = 10, key = 'requests', dir = 'desc' } = {}) {
+    const ranks = new WeakMap();
+    let observer = null;
+    let removeMorphHook = null;
+
+    return {
+        page: 0,
+        per,
+        total: 0,
+        key,
+        dir,
+        tick: 0,
+
+        init() {
+            this.resort();
+            observer = new MutationObserver(() => this.resort());
+            observer.observe(this.$root, {
+                childList: true,
+                subtree: true,
+                attributes: true,
+                attributeFilter: ['data-row'],
+            });
+            if (window.Livewire) {
+                removeMorphHook = window.Livewire.hook('morphed', ({ el }) => {
+                    if (el.contains(this.$root)) {
+                        this.resort();
+                    }
+                });
+            }
+        },
+
+        destroy() {
+            if (observer) {
+                observer.disconnect();
+                observer = null;
+            }
+            if (removeMorphHook) {
+                removeMorphHook();
+                removeMorphHook = null;
+            }
+        },
+
+        // Text columns start ascending, number columns descending.
+        sortBy(next, firstDir = 'desc') {
+            if (this.key === next) {
+                this.dir = this.dir === 'desc' ? 'asc' : 'desc';
+            } else {
+                this.key = next;
+                this.dir = firstDir;
+            }
+            this.page = 0;
+            this.resort();
+        },
+
+        resort() {
+            const sign = this.dir === 'asc' ? 1 : -1;
+            const rows = [...this.$root.querySelectorAll('[data-row]')].map((el, index) => {
+                let values = {};
+                try {
+                    values = JSON.parse(el.dataset.row) || {};
+                } catch {
+                    values = {};
+                }
+
+                const value = values[this.key] ?? null;
+
+                return { el, index, pinned: 'pinned' in el.dataset ? 1 : 0, missing: value === null ? 1 : 0, value };
+            });
+
+            // Pinned rows (the "Other" remainder) stay last in each sort, then rows without a value.
+            rows.sort((a, b) => a.pinned - b.pinned || a.missing - b.missing || compareValues(a.value, b.value) * sign || a.index - b.index);
+            rows.forEach((row, rank) => ranks.set(row.el, rank));
+            // All rows share one parent. Move them only when the order changed: the mutation
+            // that the move causes then finds them sorted, and a focused link is not blurred.
+            if (rows.some((row, rank) => row.index !== rank)) {
+                rows.forEach((row) => row.el.parentElement.appendChild(row.el));
+                observer?.takeRecords();
+            }
+
+            this.total = rows.length;
+            this.page = Math.min(this.page, Math.max(0, Math.ceil(this.total / this.per) - 1));
+            this.tick++;
+        },
+
+        shown(el) {
+            this.tick;
+            const rank = ranks.get(el) ?? 0;
+
+            return rank >= this.page * this.per && rank < (this.page + 1) * this.per;
+        },
+
+        // 'asc', 'desc', or null when the list is sorted by another column.
+        sorted(column) {
+            return this.key === column ? this.dir : null;
+        },
+    };
+}
+
+window.trafficTable = trafficTable;
diff --git a/resources/views/components/application/configuration-sidebar.blade.php b/resources/views/components/application/configuration-sidebar.blade.php
index 6924f0198d..29f56af40d 100644
--- a/resources/views/components/application/configuration-sidebar.blade.php
+++ b/resources/views/components/application/configuration-sidebar.blade.php
@@ -1,4 +1,4 @@
-@props(['application', 'currentRoute', 'flush' => false])
+@props(['application', 'currentRoute', 'flush' => false, 'navOnly' => false])
 
 @php
         $applicationRouteParameters = [
@@ -51,6 +51,12 @@
                 'navigate' => false,
                 'visible' => ! $application->destination->server->isSwarm() && auth()->user()?->can('canAccessTerminal'),
             ],
+            [
+                'label' => 'Files',
+                'route' => 'project.application.files',
+                'active' => $currentRoute === 'project.application.files',
+                'visible' => ! $application->destination->server->isSwarm() && auth()->user()?->can('canAccessTerminal'),
+            ],
             [
                 'label' => 'Deployment Logs',
                 'route' => 'project.application.deployment.index',
@@ -147,12 +153,13 @@
             'Persistent Storage' => 'storages',
             'Backups' => 'database',
             'Terminal' => 'browser-terminal',
+            'Files' => 'folder',
             'Deployment Logs' => 'time-back',
             'Runtime Logs' => 'unordered-list',
             'Git Source' => 'sources',
             'Servers' => 'servers',
             'Scheduled Tasks' => 'calendar',
-            'Webhooks' => 'notifications',
+            'Webhooks' => 'webhook',
             'Preview Deployments' => 'eye',
             'Healthcheck' => 'feedback',
             'Rollback' => 'time-back',
@@ -161,16 +168,17 @@
             'Metrics' => 'graph',
             'Analytics' => 'analytics',
             'Tags' => 'tags',
-            'Danger Zone' => 'shield-alert',
+            'Danger Zone' => 'danger',
         ];
 
         // Discord-style groups for the settings sidebar
         $menuGroups = [
             'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage', 'Advanced', 'Swarm', 'Healthcheck'],
-            'Observe & troubleshoot' => ['Runtime Logs', 'Deployment Logs', 'Terminal', 'Metrics', 'Analytics'],
+            'Observe & troubleshoot' => ['Runtime Logs', 'Deployment Logs', 'Terminal', 'Files', 'Metrics', 'Analytics'],
             'Deploy' => ['Git Source', 'Servers', 'Preview Deployments'],
             'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
-            'Operations' => ['Resource Operations', 'Resource Limits', 'Rollback', 'Tags', 'Danger Zone'],
+            'Operations' => ['Resource Operations', 'Resource Limits', 'Rollback', 'Tags'],
+            'Danger Zone' => ['Danger Zone'],
         ];
         $groupedMenuItems = collect($menuGroups)
             ->map(fn (array $labels) => collect($labels)
@@ -179,9 +187,6 @@
                 ->values())
             ->filter(fn ($items) => $items->isNotEmpty());
 
-        // Group that holds the current page — always kept open, even if collapsed before.
-        $activeGroup = (string) $groupedMenuItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
-
         // In-page sections (cards) shown as sub-items under the active page
         $isComposeApp = $application->build_pack === 'dockercompose';
         $pageSections = [
@@ -247,32 +252,38 @@
         $settingsSearchItems = settingsSearchItems($groupedMenuItems, $applicationRouteParameters, $pageSections);
     @endphp
 
+@php
+    // The main sidebar shows this menu on wide screens (see components/navbar.blade.php).
+    registerMainNavContext(0, 'Dashboard', 'Back to the main menu');
+@endphp
+
+{{-- Rendered twice: in the page (below xl), and teleported into the main sidebar (xl and up).
+     navOnly renders only the sidebar copy, as the parent menu of a deeper page (e.g. a backup). --}}
+@foreach ($navOnly ? ['main-nav'] : ['page', 'main-nav'] as $placement)
+@if ($placement === 'main-nav')
+@teleport('#main-nav-context-0')
+<div class="nav-context-menu">
+@else
 <aside @class([
-    'application-settings-navigation min-w-0 xl:self-start',
+    'application-settings-navigation in-main-nav min-w-0 xl:self-start',
     'is-flush' => $flush,
 ]) data-settings-search-items="{{ json_encode($settingsSearchItems) }}">
+@endif
                 <nav aria-label="Configuration sections"
-                    x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.application' })"
-                    class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+                    @class([
+                        'grid gap-0.5',
+                        'grid-cols-2 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]' => $placement === 'page',
+                        'grid-cols-1' => $placement === 'main-nav',
+                    ])>
                     @foreach ($groupedMenuItems as $groupLabel => $groupItems)
                         @unless ($loop->first)
                             <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
                                 aria-hidden="true"></div>
                         @endunless
-                        <button type="button" class="nav-section-toggle hidden xl:flex"
-                            @click="toggle(@js($groupLabel))" :aria-expanded="isOpen(@js($groupLabel))">
-                            <span>{{ $groupLabel }}</span>
-                            <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                                :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                                stroke="currentColor" stroke-width="2" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                            </svg>
-                        </button>
-                        <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
                         @foreach ($groupItems as $menuItem)
                             @php $sections = $pageSections[$menuItem['route']] ?? []; @endphp
-                            <div wire:key="application-settings-group-{{ str($menuItem['label'])->slug() }}">
-                                <a wire:key="application-settings-link-{{ str($menuItem['label'])->slug() }}"
+                            <div wire:key="{{ $placement }}-application-settings-group-{{ str($menuItem['label'])->slug() }}">
+                                <a wire:key="{{ $placement }}-application-settings-link-{{ str($menuItem['label'])->slug() }}"
                                     @class([
                                         'menu-item',
                                         'menu-item-active' => $menuItem['active'],
@@ -282,10 +293,13 @@
                                     >
                                     <x-reicon :name="$menuIcons[$menuItem['label']] ?? 'settings'" class="menu-item-icon" />
                                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                                    @if ($menuItem['label'] === 'Files')
+                                        <x-beta-badge class="ml-auto shrink-0" />
+                                    @endif
                                     @if ($menuItem['badge'] ?? false)
                                         <span class="shrink-0">
                                             <livewire:project.application.server-status-badge :application="$application"
-                                                :key="'application-server-status-'.$application->uuid" />
+                                                :key="$placement.'-application-server-status-'.$application->uuid" />
                                         </span>
                                     @endif
                                 </a>
@@ -305,7 +319,12 @@
                                 @endif
                             </div>
                         @endforeach
-                        </div>
                     @endforeach
                 </nav>
-            </aside>
+            @if ($placement === 'main-nav')
+</div>
+@endteleport
+@else
+</aside>
+@endif
+@endforeach
diff --git a/resources/views/components/backup-sidebar.blade.php b/resources/views/components/backup-sidebar.blade.php
index be7148c98e..900a0be0b6 100644
--- a/resources/views/components/backup-sidebar.blade.php
+++ b/resources/views/components/backup-sidebar.blade.php
@@ -9,32 +9,24 @@
         'application' => [
             'back' => 'project.application.backup.index',
             'general' => 'project.application.backup.show',
-            's3' => 'project.application.backup.s3',
-            'retention' => 'project.application.backup.retention',
             'executions' => 'project.application.backup.executions',
             'danger' => 'project.application.backup.danger',
         ],
         'service' => [
             'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.database.backup.show',
-            's3' => 'project.service.database.backup.s3',
-            'retention' => 'project.service.database.backup.retention',
             'executions' => 'project.service.database.backup.executions',
             'danger' => 'project.service.database.backup.danger',
         ],
         'service-volume' => [
             'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.volume-backups.show',
-            's3' => 'project.service.volume-backups.s3',
-            'retention' => 'project.service.volume-backups.retention',
             'executions' => 'project.service.volume-backups.executions',
             'danger' => 'project.service.volume-backups.danger',
         ],
         default => [
             'back' => 'project.database.configuration',
             'general' => 'project.database.backup.execution',
-            's3' => 'project.database.backup.s3',
-            'retention' => 'project.database.backup.retention',
             'executions' => 'project.database.backup.executions',
             'danger' => 'project.database.backup.danger',
         ],
@@ -42,12 +34,16 @@
 
     $items = [
         ['key' => 'general', 'label' => 'General', 'icon' => 'settings'],
-        ['key' => 's3', 'label' => 'S3 storage', 'icon' => 'storages'],
-        ['key' => 'retention', 'label' => 'Retention', 'icon' => 'unordered-list'],
         ['key' => 'executions', 'label' => 'Executions', 'icon' => 'browser-terminal'],
-        ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'shield-alert'],
+        ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'danger'],
     ];
     $backLabel = $context === 'database' ? 'Back to database' : 'Back to backups';
+    // The resource menu that the page renders one Back away in the main sidebar.
+    $parentMenu = match ($context) {
+        'application' => 'Application',
+        'database' => 'Database',
+        default => 'Service',
+    };
     $backParameters = match ($context) {
         'database' => collect($parameters)->except('backup_uuid')->all(),
         'service' => collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all(),
@@ -55,17 +51,19 @@
     };
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+<x-main-nav-menu :depth="1" :back-label="$parentMenu" :back-title="'Back to the '.strtolower($parentMenu).' menu'"
     data-settings-search-items="{{ json_encode(settingsSearchItems(['Backup' => collect($items)->map(fn (array $item): array => [...$item, 'route' => $routes[$item['key']]])], $parameters)) }}">
     <nav aria-label="Backup settings"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        <div class="nav-section hidden xl:block">Backup</div>
-        <a class="menu-item" {{ wireNavigate() }} href="{{ route($routes['back'], $backParameters) }}">
+        <a class="menu-item" data-page-only {{ wireNavigate() }} href="{{ route($routes['back'], $backParameters) }}">
             <x-reicon name="logout" class="menu-item-icon rotate-180" />
             <span class="menu-item-label">{{ $backLabel }}</span>
         </a>
 
         @foreach ($items as $item)
+            @if ($item['key'] === 'danger')
+                <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+            @endif
             <a @class([
                 'menu-item',
                 'menu-item-active' => $section === $item['key'],
@@ -76,4 +74,4 @@
             </a>
         @endforeach
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/components/backup-tabs.blade.php b/resources/views/components/backup-tabs.blade.php
index 4898a29ed5..d1c436e09b 100644
--- a/resources/views/components/backup-tabs.blade.php
+++ b/resources/views/components/backup-tabs.blade.php
@@ -8,21 +8,15 @@
     $routes = match ($context) {
         'service-schedule' => [
             'general' => true,
-            's3' => true,
-            'retention' => true,
             'danger' => true,
         ],
         'service' => [
             'general' => 'project.service.database.backup.show',
-            's3' => 'project.service.database.backup.s3',
-            'retention' => 'project.service.database.backup.retention',
             'executions' => 'project.service.database.backup.executions',
             'danger' => 'project.service.database.backup.danger',
         ],
         'service-volume' => [
             'general' => 'project.service.volume-backups.show',
-            's3' => 'project.service.volume-backups.s3',
-            'retention' => 'project.service.volume-backups.retention',
             'executions' => 'project.service.volume-backups.executions',
             'danger' => 'project.service.volume-backups.danger',
         ],
@@ -30,8 +24,6 @@
 
     $items = collect([
         ['key' => 'general', 'label' => 'General'],
-        ['key' => 's3', 'label' => 'S3 storage'],
-        ['key' => 'retention', 'label' => 'Retention'],
         ['key' => 'executions', 'label' => 'Executions'],
         ['key' => 'danger', 'label' => 'Danger Zone'],
     ])->filter(fn (array $item): bool => isset($routes[$item['key']]));
diff --git a/resources/views/components/canvas-view-toggle.blade.php b/resources/views/components/canvas-view-toggle.blade.php
index d3db4e10d0..f27e7bab5a 100644
--- a/resources/views/components/canvas-view-toggle.blade.php
+++ b/resources/views/components/canvas-view-toggle.blade.php
@@ -1,51 +1,49 @@
-@props(['listUrl', 'canvasUrl', 'onCanvas' => false, 'views' => null])
+@props(['listUrl' => null, 'canvasUrl' => null, 'onCanvas' => false, 'views' => null])
 @php
-    $item = 'flex size-7.5 items-center justify-center rounded-md transition-colors';
-    $idle = 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg';
-    $canvasItem = 'relative flex h-7.5 items-center gap-1.5 rounded-md px-2.5 text-[12px] font-medium transition-colors';
+    $idle = 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg dark:hover:bg-white/[0.06] dark:hover:text-fg';
+    $canvasItem = 'relative flex h-7.5 shrink-0 items-center gap-1.5 whitespace-nowrap rounded-md px-2.5 text-[12px] font-medium transition-colors';
     $views ??= ['table' => ['Table view', 'unordered-list'], 'grid' => ['Grid view', 'grid']];
-    // One list view (no table / grid choice): the list page shows it selected.
+    // One list view (no table / grid choice): nothing to switch to on the list page.
     $singleList = count($views) === 1;
 @endphp
 {{-- Table / grid / canvas switcher. On the list page, table and grid switch the
-     parent's Alpine viewMode; on the canvas page they link back to the list
+     parent's Alpine viewMode; the canvas page shows one "List view" link back
      (?view= makes the list the remembered view again, see RemembersCanvasView).
-     Pages with one list view pass :views="['list' => [...]]". --}}
+     Pages with one list view pass :views="['list' => [...]]". Without a
+     canvasUrl it is only a table / grid switcher. --}}
+@if ($onCanvas || ! $singleList || filled($canvasUrl))
 <div {{ $attributes->merge(['class' => 'view-toggle']) }}>
-    @foreach ($views as $mode => [$label, $icon])
-        @if ($onCanvas)
-            <a href="{{ $listUrl }}?view={{ $mode }}" {{ wireNavigate() }} class="{{ $item }} {{ $idle }}"
-                aria-label="{{ $label }}" title="{{ $label }}">
-                <x-reicon :name="$icon" class="size-3.5" />
-            </a>
-        @elseif ($singleList)
-            <span class="{{ $item }} control-selected" aria-current="page" aria-label="{{ $label }}"
-                title="{{ $label }}">
-                <x-reicon :name="$icon" class="size-3.5" />
-            </span>
-        @else
-            <button type="button" x-on:click="setViewMode(@js($mode))" class="{{ $item }}"
-                :class="viewMode === @js($mode) ? 'control-selected' : @js($idle)"
-                aria-label="{{ $label }}" title="{{ $label }}">
-                <x-reicon :name="$icon" class="size-3.5" />
-            </button>
-        @endif
-    @endforeach
     @if ($onCanvas)
-        <span class="{{ $canvasItem }} control-selected" aria-current="page" title="Canvas view (beta)">
-            <x-reicon name="deploy-canvas" class="size-3.5" />
-            Canvas
-        </span>
-    @else
-        {{-- A label and a purple "Try it" badge, so people notice the canvas view. --}}
-        <a href="{{ $canvasUrl }}" {{ wireNavigate() }}
-            class="{{ $canvasItem }} {{ $idle }}" title="Canvas view (beta): see everything and how it connects">
-            <x-reicon name="deploy-canvas" class="size-3.5" />
-            Canvas
-            <span
-                class="ml-0.5 inline-flex items-center rounded-full bg-coollabs px-1.5 py-px text-[10px] leading-4 font-semibold text-white">
-                Try it
-            </span>
+        {{-- On the canvas only the way back: one labelled link to the list (its first view). --}}
+        @php [$label, $icon] = reset($views); @endphp
+        <a href="{{ $listUrl }}?view={{ array_key_first($views) }}" {{ wireNavigate() }} class="{{ $canvasItem }} {{ $idle }}"
+            title="List view">
+            <x-reicon :name="$icon" class="size-3.5" />
+            List view
         </a>
+    @else
+        {{-- Only the views you can switch to, with their names; the current one is not shown. --}}
+        @unless ($singleList)
+            @foreach ($views as $mode => [$label, $icon])
+                <button type="button" x-on:click="setViewMode(@js($mode))" x-show="viewMode !== @js($mode)" x-cloak
+                    class="{{ $canvasItem }} {{ $idle }}" title="{{ $label }}">
+                    <x-reicon :name="$icon" class="size-3.5" />
+                    {{ $label }}
+                </button>
+            @endforeach
+        @endunless
+        @if (filled($canvasUrl))
+            {{-- A label and a purple "Try it" badge, so people notice the canvas view. --}}
+            <a href="{{ $canvasUrl }}" {{ wireNavigate() }}
+                class="{{ $canvasItem }} {{ $idle }}" title="Canvas view (beta): see everything and how it connects">
+                <x-reicon name="deploy-canvas" class="size-3.5" />
+                Canvas
+                <span
+                    class="ml-0.5 inline-flex items-center rounded-full bg-coollabs px-1.5 py-px text-[10px] leading-4 font-semibold text-white">
+                    Try it
+                </span>
+            </a>
+        @endif
     @endif
 </div>
+@endif
diff --git a/resources/views/components/database/configuration-sidebar.blade.php b/resources/views/components/database/configuration-sidebar.blade.php
index 3d3eb054bd..9b17308b85 100644
--- a/resources/views/components/database/configuration-sidebar.blade.php
+++ b/resources/views/components/database/configuration-sidebar.blade.php
@@ -1,4 +1,4 @@
-@props(['database', 'currentRoute'])
+@props(['database', 'currentRoute', 'navOnly' => false])
 
 @php
     $databaseRouteParameters = [
@@ -16,13 +16,14 @@
         ['label' => 'Servers', 'route' => 'project.database.servers', 'icon' => 'servers'],
         ['label' => 'Runtime Logs', 'route' => 'project.database.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.database.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
-        ['label' => 'Webhooks', 'route' => 'project.database.webhooks', 'icon' => 'notifications'],
+        ['label' => 'Files', 'route' => 'project.database.files', 'icon' => 'folder', 'visible' => auth()->user()?->can('canAccessTerminal')],
+        ['label' => 'Webhooks', 'route' => 'project.database.webhooks', 'icon' => 'webhook'],
         ['label' => 'Healthcheck', 'route' => 'project.database.healthcheck', 'icon' => 'feedback'],
         ['label' => 'Resource Limits', 'route' => 'project.database.resource-limits', 'icon' => 'cpu'],
         ['label' => 'Resource Operations', 'route' => 'project.database.resource-operations', 'icon' => 'server-update'],
         ['label' => 'Metrics', 'route' => 'project.database.metrics', 'icon' => 'graph'],
         ['label' => 'Tags', 'route' => 'project.database.tags', 'icon' => 'tags'],
-        ['label' => 'Danger Zone', 'route' => 'project.database.danger', 'icon' => 'shield-alert'],
+        ['label' => 'Danger Zone', 'route' => 'project.database.danger', 'icon' => 'danger'],
     ])->filter(fn (array $item): bool => $item['visible'] ?? true)
         ->map(fn (array $item): array => [
             ...$item,
@@ -33,10 +34,11 @@
 
     $menuGroups = [
         'Settings' => ['General', 'Environment Variables', 'Persistent Storage', 'Healthcheck'],
-        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Metrics'],
+        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Files', 'Metrics'],
         'Deploy' => ['Servers'],
         'Automation' => ['Webhooks', 'Backups', 'Import Backup'],
-        'Operations' => ['Resource Operations', 'Resource Limits', 'Tags', 'Danger Zone'],
+        'Operations' => ['Resource Operations', 'Resource Limits', 'Tags'],
+        'Danger Zone' => ['Danger Zone'],
     ];
 
     $groupedItems = collect($menuGroups)
@@ -46,9 +48,6 @@
             ->values())
         ->filter(fn ($items) => $items->isNotEmpty());
 
-    // Group that holds the current page — always kept open, even if collapsed before.
-    $activeGroup = (string) $groupedItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
-
     $pageSections = $database->type() === 'standalone-postgresql'
         ? [
             ['id' => 'database-details-section', 'label' => 'Database details'],
@@ -63,31 +62,40 @@
         : [];
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+@php
+    // The main sidebar shows this menu on wide screens (see components/navbar.blade.php).
+    registerMainNavContext(0, 'Dashboard', 'Back to the main menu');
+@endphp
+
+{{-- Rendered twice: in the page (below xl), and teleported into the main sidebar (xl and up).
+     navOnly renders only the sidebar copy, as the parent menu of a deeper page (e.g. a backup). --}}
+@foreach ($navOnly ? ['main-nav'] : ['page', 'main-nav'] as $placement)
+@if ($placement === 'main-nav')
+@teleport('#main-nav-context-0')
+<div class="nav-context-menu">
+@else
+<aside class="application-settings-navigation in-main-nav min-w-0 xl:self-start"
     data-settings-search-items="{{ json_encode(settingsSearchItems($groupedItems, $databaseRouteParameters, ['project.database.configuration' => $pageSections])) }}">
+@endif
     <nav aria-label="Database settings"
-        x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.database' })"
-        class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+        @class([
+            'grid gap-0.5',
+            'grid-cols-2 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]' => $placement === 'page',
+            'grid-cols-1' => $placement === 'main-nav',
+        ])>
         @foreach ($groupedItems as $groupLabel => $groupItems)
             @unless ($loop->first)
                 <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
             @endunless
-            <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                :aria-expanded="isOpen(@js($groupLabel))">
-                <span>{{ $groupLabel }}</span>
-                <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                    :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                    stroke="currentColor" stroke-width="2" aria-hidden="true">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                </svg>
-            </button>
-            <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
             @foreach ($groupItems as $menuItem)
                 <a @class(['menu-item', 'menu-item-active' => $menuItem['active']])
                     @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
                     href="{{ route($menuItem['route'], $databaseRouteParameters) }}">
                     <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    @if ($menuItem['label'] === 'Files')
+                        <x-beta-badge class="ml-auto shrink-0" />
+                    @endif
                 </a>
                 @if ($menuItem['active'] && $menuItem['route'] === 'project.database.configuration' && $pageSections !== [])
                     <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
@@ -108,7 +116,12 @@
                     </div>
                 @endif
             @endforeach
-            </div>
         @endforeach
     </nav>
+@if ($placement === 'main-nav')
+</div>
+@endteleport
+@else
 </aside>
+@endif
+@endforeach
diff --git a/resources/views/components/main-nav-menu.blade.php b/resources/views/components/main-nav-menu.blade.php
new file mode 100644
index 0000000000..3dc4687d2e
--- /dev/null
+++ b/resources/views/components/main-nav-menu.blade.php
@@ -0,0 +1,18 @@
+@props(['backLabel', 'backTitle' => 'Back to the main menu', 'depth' => 0, 'navOnly' => false])
+@php
+    // The main sidebar replaces its menu with this one on wide screens (see components/navbar.blade.php).
+    registerMainNavContext($depth, $backLabel, $backTitle);
+@endphp
+{{-- A page menu, rendered twice: in the page (below xl, CSS hides it on xl), and teleported into the
+     main sidebar (xl and up). The slot must not contain Livewire components (they would render twice).
+     navOnly renders only the sidebar copy: a deeper page uses it to keep its parent menu one Back away. --}}
+@unless ($navOnly)
+    <aside {{ $attributes->class('application-settings-navigation in-main-nav min-w-0 xl:self-start') }}>
+        {{ $slot }}
+    </aside>
+@endunless
+@teleport('#main-nav-context-'.$depth)
+    <div class="nav-context-menu">
+        {{ $slot }}
+    </div>
+@endteleport
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index 58f70ab206..b026094ca2 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -60,7 +60,7 @@
                         'sm:h-[40rem]' => $fixedHeight,
                     ])
                     style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
-                    <header class="flex-wrap! sm:flex-nowrap!">
+                    <header class="shrink-0 flex-wrap! sm:flex-nowrap!">
                         <div class="min-w-0 flex-1 py-0.5">
                             <h3 class="truncate">{{ $title }}</h3>
                             @if ($subtitle)
diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index c5171fe29e..190f36ae70 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -1,6 +1,6 @@
-@props(['deploymentsIndicator' => false])
+@props(['desktop' => false])
 
-<nav class="flex flex-col flex-1 bg-white border-r border-neutral-200 dark:border-white/[0.06] dark:bg-panel pt-2"
+<nav class="sidebar-nav flex min-h-0 flex-col flex-1 bg-white border-r border-neutral-200 dark:border-white/[0.06] dark:bg-panel pt-2"
     :class="collapsed ? 'px-2 lg:px-3 sidebar-collapsed' : 'px-2 lg:px-3'"
     @mouseover="
         if (!collapsed) return;
@@ -17,6 +17,14 @@
     @mouseleave="tooltip.show = false"
     x-data="{
         tooltip: { text: '', x: 0, y: 0, show: false },
+        // Label of the open submenu ('' = main menu). It starts on the submenu of the current page
+        // ([data-active-submenu], read in init). Back opens the main menu.
+        submenu: '',
+        // Depth of the open resource menu on wide screens (-1 = main menu or submenu). It starts on the
+        // deepest menu of the current page; Back opens the menu one depth lower.
+        navLevel: -1,
+        // Direction of the last menu swap ('forward' or 'back'); it selects the enter animation of every menu.
+        navSwap: '',
         // macOS/iOS use ⌘; Windows/Linux use Ctrl+
         modKeyLabel: (() => {
             const platform = navigator.userAgentData?.platform || navigator.platform || '';
@@ -24,6 +32,19 @@
             return /Mac|iPhone|iPad|iPod/i.test(platform) || /Mac OS X|Macintosh/i.test(ua) ? '⌘' : 'Ctrl+';
         })(),
         init() {
+                this.submenu = this.$root.querySelector('[data-active-submenu]')?.dataset.activeSubmenu || '';
+                this.navLevel = Number([...this.$root.querySelectorAll('[data-nav-level]')].pop()?.dataset.navLevel ?? -1);
+                if (@js($desktop)) {
+                    // The open resource menu depth is kept across page loads: a page that opens a deeper menu
+                    // (e.g. a backup) plays the forward swap, and a page that opens a lower one plays the back swap.
+                    const previousLevel = sessionStorage.getItem('navLevel');
+                    if (previousLevel !== null && window.matchMedia('(min-width: 80rem)').matches) {
+                        const levelChange = this.navLevel - Number(previousLevel);
+                        this.navSwap = levelChange > 0 ? 'forward' : (levelChange < 0 ? 'back' : '');
+                    }
+                    sessionStorage.setItem('navLevel', this.navLevel);
+                    this.$watch('navLevel', level => sessionStorage.setItem('navLevel', level));
+                }
                 window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', e => {
                     const userSettings = localStorage.getItem('theme');
                     if (userSettings !== 'system') { return; }
@@ -73,168 +94,202 @@
         </div>
     @endif
 
-    <ul role="list" class="-mx-1 flex min-h-0 flex-1 flex-col gap-y-0.5 overflow-y-auto px-1 pb-2 scrollbar">
+    <ul role="list" class="sidebar-menu -mx-1 flex min-h-0 flex-1 flex-col gap-y-0.5 overflow-y-auto px-1 pb-2">
         @if (isSubscribed() || !isCloud())
-            {{-- Workspace --}}
-            <li class="nav-section" :class="collapsed && 'lg:hidden'">Workspace</li>
-            <li>
-                <a title="Dashboard" href="/" {{ wireNavigate() }}
-                    class="{{ request()->is('/') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'">
-                    <x-reicon name="dashboard" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Dashboard</span>
-                </a>
-            </li>
-            <li>
-                <a title="Projects" {{ wireNavigate() }}
-                    class="{{ request()->is('project/*') || request()->is('projects') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="/projects">
-                    <x-reicon name="projects" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Projects</span>
-                </a>
-            </li>
-            <li>
-                <a title="Analytics" {{ wireNavigate() }}
-                    class="{{ request()->is('analytics') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('analytics') }}">
-                    <x-reicon name="analytics" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Analytics</span>
-                </a>
-            </li>
-            <li>
-                <a title="Metrics" {{ wireNavigate() }}
-                    class="{{ request()->is('metrics') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('metrics') }}">
-                    <x-reicon name="graph" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Metrics</span>
-                </a>
-            </li>
-            @can('canAccessTerminal')
-                <li>
-                    <a title="Terminal"
-                        class="{{ request()->is('terminal*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('terminal') }}">
-                        <x-reicon name="browser-terminal" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Terminal</span>
-                    </a>
-                </li>
-            @endcan
-            {{-- Infrastructure --}}
-            <li class="nav-section mt-3" aria-hidden="true"
-                :class="collapsed && 'lg:mx-2.5 lg:my-2 lg:h-0 lg:overflow-hidden lg:border-t lg:border-neutral-200 lg:p-0 lg:text-transparent dark:lg:border-white/10'">
-                Infrastructure</li>
-            <li>
-                <a title="Servers" {{ wireNavigate() }}
-                    class="{{ request()->is('server/*') || request()->is('servers') ? 'menu-item menu-item-active' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="/servers">
-                    <x-reicon name="servers" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Servers</span>
-                </a>
-            </li>
-            <li>
-                <a title="Sources" {{ wireNavigate() }}
-                    class="{{ request()->is('source*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('source.all') }}">
-                    <x-reicon name="sources" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Sources</span>
-                </a>
-            </li>
-            <li>
-                <a title="Destinations" {{ wireNavigate() }}
-                    class="{{ request()->is('destination*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('destination.index') }}">
-                    <x-reicon name="destinations" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Destinations</span>
-                </a>
-            </li>
-            @if (auth()->user()?->isAdmin())
-                <li>
-                    <a title="Registries" {{ wireNavigate() }}
-                        class="{{ request()->is('registries*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('registries.index') }}">
-                        <x-reicon name="layers" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Registries</span>
-                    </a>
-                </li>
-            @endif
-            <li>
-                <a title="S3 Storage" {{ wireNavigate() }}
-                    class="{{ request()->is('storages*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('storage.index') }}">
-                    <x-reicon name="storages" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">S3 Storage</span>
-                </a>
-            </li>
-            <li>
-                <a title="Shared variables" {{ wireNavigate() }}
-                    class="{{ request()->is('shared-variables*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('shared-variables.index') }}">
-                    <x-reicon name="variables" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Shared Variables</span>
-                </a>
-            </li>
+            @php
+                // An entry with children opens a submenu in place of the main menu (back button + its pages).
+                $navSections = collect([
+                    'Workspace' => [
+                        // The dashboard lists projects and links to all of them, so project pages count as Dashboard.
+                        ['label' => 'Dashboard', 'icon' => 'dashboard', 'href' => '/', 'active' => request()->is('/', 'dashboard/*', 'projects', 'projects/*', 'project/*', 'canvas')],
+                        ['label' => 'Monitoring', 'icon' => 'graph', 'children' => [
+                            ['label' => 'Analytics', 'icon' => 'analytics', 'href' => route('analytics'), 'active' => request()->is('analytics')],
+                            ['label' => 'Metrics', 'icon' => 'graph', 'href' => route('metrics'), 'active' => request()->is('metrics')],
+                        ]],
+                        ['label' => 'Terminal', 'icon' => 'browser-terminal', 'href' => route('terminal'), 'active' => request()->is('terminal*'), 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
+                    ],
+                    'Infrastructure' => [
+                        ['label' => 'Servers', 'icon' => 'servers', 'href' => '/servers', 'active' => request()->is('server/*', 'servers', 'servers/*')],
+                        ['label' => 'Integrations', 'icon' => 'link', 'children' => [
+                            ['label' => 'Sources', 'icon' => 'sources', 'href' => route('source.all'), 'active' => request()->is('sources', 'source/*')],
+                            ['label' => 'Destinations', 'icon' => 'destinations', 'href' => route('destination.index'), 'active' => request()->is('destinations', 'destination/*')],
+                            ['label' => 'Registries', 'icon' => 'layers', 'href' => route('registries.index'), 'active' => request()->is('registries'), 'visible' => auth()->user()?->isAdmin()],
+                            ['label' => 'S3 Storage', 'icon' => 'storages', 'href' => route('storage.index'), 'active' => request()->is('storages', 'storages/*')],
+                        ]],
+                        ['label' => 'Shared Variables', 'icon' => 'variables', 'children' => [
+                            ['label' => 'Overview', 'icon' => 'dashboard', 'href' => route('shared-variables.index'), 'active' => request()->is('shared-variables')],
+                            ['label' => 'Team', 'icon' => 'teams', 'href' => route('shared-variables.team.index'), 'active' => request()->is('shared-variables/team*')],
+                            ['label' => 'Projects', 'icon' => 'projects', 'href' => route('shared-variables.project.index'), 'active' => request()->is('shared-variables/projects', 'shared-variables/project/*')],
+                            ['label' => 'Environments', 'icon' => 'layers', 'href' => route('shared-variables.environment.index'), 'active' => request()->is('shared-variables/environments*')],
+                            ['label' => 'Servers', 'icon' => 'servers', 'href' => route('shared-variables.server.index'), 'active' => request()->is('shared-variables/servers', 'shared-variables/server/*')],
+                        ]],
+                    ],
+                    'Manage' => [
+                        ['label' => 'Team', 'icon' => 'teams', 'children' => [
+                            ['label' => 'General', 'icon' => 'settings', 'href' => route('team.index'), 'active' => request()->is('team')],
+                            ['label' => 'Members', 'icon' => 'teams', 'href' => route('team.member.index'), 'active' => request()->is('team/members*')],
+                            ['label' => 'Audit log', 'icon' => 'time-back', 'href' => route('team.audit-log'), 'active' => request()->is('team/audit-log'), 'visible' => auth()->user()?->isAdminOfTeam(currentTeam()->id)],
+                            ['label' => 'Admin View', 'icon' => 'admin', 'href' => route('team.admin-view'), 'active' => request()->is('team/admin'), 'visible' => isInstanceAdmin()],
+                            ['label' => 'Danger Zone', 'icon' => 'danger', 'href' => route('team.danger-zone'), 'active' => request()->is('team/danger'), 'visible' => auth()->user()?->can('delete', currentTeam()), 'sectionStart' => true],
+                        ]],
+                        ['label' => 'Notifications', 'icon' => 'notifications', 'children' => [
+                            ['label' => 'Email', 'icon' => 'mail', 'href' => route('notifications.email'), 'active' => request()->is('notifications/email')],
+                            ['label' => 'Discord', 'brandIcon' => 'discord', 'href' => route('notifications.discord'), 'active' => request()->is('notifications/discord')],
+                            ['label' => 'Telegram', 'brandIcon' => 'telegram', 'href' => route('notifications.telegram'), 'active' => request()->is('notifications/telegram')],
+                            ['label' => 'Slack', 'brandIcon' => 'slack', 'href' => route('notifications.slack'), 'active' => request()->is('notifications/slack')],
+                            ['label' => 'Pushover', 'brandIcon' => 'pushover', 'href' => route('notifications.pushover'), 'active' => request()->is('notifications/pushover')],
+                            ['label' => 'Webhook', 'icon' => 'destinations', 'href' => route('notifications.webhook'), 'active' => request()->is('notifications/webhook')],
+                        ]],
+                        ['label' => 'Keys & Tokens', 'icon' => 'keys', 'children' => [
+                            ['label' => 'Private Keys', 'icon' => 'keys', 'href' => route('security.private-key.index'), 'active' => request()->is('security/private-key*')],
+                            ['label' => 'Cloud Tokens', 'icon' => 'cloud', 'href' => route('security.cloud-tokens'), 'active' => request()->is('security/cloud-tokens*'), 'visible' => auth()->user()?->can('viewAny', App\Models\CloudProviderToken::class)],
+                            ['label' => 'Integration Tokens', 'icon' => 'network', 'href' => route('security.integration-tokens'), 'active' => request()->is('security/integration-tokens'), 'visible' => auth()->user()?->can('viewAny', App\Models\IntegrationToken::class)],
+                            ['label' => 'Cloud-Init Scripts', 'icon' => 'file-content', 'href' => route('security.cloud-init-scripts'), 'active' => request()->is('security/cloud-init-scripts*'), 'visible' => auth()->user()?->can('viewAny', App\Models\CloudInitScript::class)],
+                            ['label' => 'API Tokens', 'icon' => 'code', 'href' => route('security.api-tokens'), 'active' => request()->is('security/api-tokens')],
+                        ]],
+                        ['label' => 'Subscription', 'icon' => 'subscription', 'href' => isCloud() ? route('subscription.show') : '', 'active' => request()->is('subscription*'), 'visible' => isCloud() && auth()->user()->isAdmin()],
+                        ['label' => 'Tags', 'icon' => 'tags', 'href' => route('tags.show'), 'active' => request()->is('tags*', 'canvas/tags')],
+                        ['label' => 'Settings', 'icon' => 'settings', 'visible' => isInstanceAdmin(), 'children' => [
+                            ['label' => 'General', 'icon' => 'settings', 'href' => route('settings.index'), 'active' => request()->is('settings')],
+                            ['label' => 'Advanced', 'icon' => 'grid', 'href' => route('settings.advanced'), 'active' => request()->is('settings/advanced')],
+                            ['label' => 'Updates', 'icon' => 'refresh3', 'href' => route('settings.updates'), 'active' => request()->is('settings/updates')],
+                            ['label' => 'Authentication', 'icon' => 'keys', 'href' => route('settings.oauth'), 'active' => request()->is('settings/oauth*'), 'sectionStart' => true],
+                            ['label' => 'Email', 'icon' => 'mail', 'href' => route('settings.email'), 'active' => request()->is('settings/email')],
+                            ['label' => 'Backup', 'icon' => 'database', 'href' => route('settings.backup'), 'active' => request()->is('settings/backup')],
+                        ]],
+                    ],
+                ])->map(fn (array $items) => collect($items)
+                    ->filter(fn (array $item): bool => (bool) ($item['visible'] ?? true))
+                    ->map(function (array $item): array {
+                        if (! isset($item['children'])) {
+                            return $item;
+                        }
+                        $children = array_values(array_filter($item['children'], fn (array $child): bool => (bool) ($child['visible'] ?? true)));
 
-            {{-- Manage --}}
-            <li class="nav-section mt-3" aria-hidden="true"
-                :class="collapsed && 'lg:mx-2.5 lg:my-2 lg:h-0 lg:overflow-hidden lg:border-t lg:border-neutral-200 lg:p-0 lg:text-transparent dark:lg:border-white/10'">
-                Manage</li>
-            <li>
-                <a title="Team" {{ wireNavigate() }}
-                    class="{{ request()->is('team*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('team.index') }}">
-                    <x-reicon name="teams" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Team</span>
-                </a>
-            </li>
-            <li>
-                <a title="Notifications" {{ wireNavigate() }}
-                    class="{{ request()->is('notifications*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('notifications.email') }}">
-                    <x-reicon name="notifications" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Notifications</span>
-                </a>
-            </li>
-
-            <li>
-                <a title="Keys & Tokens" {{ wireNavigate() }}
-                    class="{{ request()->is('security*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('security.private-key.index') }}">
-                    <x-reicon name="keys" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Keys & Tokens</span>
-                </a>
-            </li>
-            @if (isCloud() && auth()->user()->isAdmin())
-                <li>
-                    <a title="Subscription" {{ wireNavigate() }}
-                        class="{{ request()->is('subscription*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('subscription.show') }}">
-                        <x-reicon name="subscription" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Subscription</span>
-                    </a>
+                        return [...$item, 'children' => $children, 'href' => $children[0]['href'], 'active' => collect($children)->contains('active', true)];
+                    })
+                    ->all());
+                $activeSubmenu = $navSections->flatten(1)->first(fn (array $item): bool => isset($item['children']) && $item['active']);
+                // Resource menus by depth, registered by registerMainNavContext() (e.g. from
+                // components/main-nav-menu.blade.php). Each one teleports itself into #main-nav-context-{depth};
+                // only the desktop sidebar has the slots.
+                $navContext = $desktop ? request()->attributes->get('mainNavContext', []) : [];
+            @endphp
+            {{-- Wide screens on a resource page: the deepest resource menu replaces the main menu. Back shows the
+                 menu one depth lower, and then the main menu (or its submenu), without leaving the page. --}}
+            @foreach ($navContext as $depth => $navMenu)
+                @php
+                    $previousDepth = collect($navContext)->keys()->filter(fn (int $key): bool => $key < $depth)->last() ?? -1;
+                @endphp
+                <li x-show="navLevel === {{ $depth }}" data-nav-level="{{ $depth }}" @unless ($loop->last) x-cloak @endunless
+                    class="hidden xl:contents">
+                    <ul role="list" class="flex flex-col gap-y-0.5" :class="navSwap && 'nav-swap-' + navSwap">
+                        <li class="mb-1">
+                            <button type="button" @click="navLevel = {{ $previousDepth }}; navSwap = 'back'"
+                                title="{{ $navMenu['backTitle'] }}" aria-label="{{ $navMenu['backTitle'] }}"
+                                class="menu-item menu-back bg-transparent! hover:bg-neutral-100! dark:hover:bg-white/[0.06]!" :class="collapsed && 'lg:justify-center lg:px-0'">
+                                <span class="menu-back-icon flex shrink-0 items-center justify-center">
+                                    <x-reicon name="chevron-down" class="size-3 rotate-90 text-neutral-500 dark:text-fg-dim" />
+                                </span>
+                                <span class="flex-1 truncate pr-6 text-center font-medium text-black dark:text-fg"
+                                    :class="collapsed && 'lg:hidden'">{{ $navMenu['label'] }}</span>
+                            </button>
+                        </li>
+                        <li id="main-nav-context-{{ $depth }}" class="nav-context min-w-0"></li>
+                    </ul>
                 </li>
-            @endif
-            <li>
-                <a title="Tags" {{ wireNavigate() }}
-                    class="{{ request()->is('tags*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                    :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('tags.show') }}">
-                    <x-reicon name="tags" class="menu-item-icon" />
-                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Tags</span>
-                </a>
-            </li>
-            @if (isInstanceAdmin())
-                <li>
-                    <a title="Settings" {{ wireNavigate() }}
-                        class="{{ request()->is('settings*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                        :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('settings.index') }}">
-                        <x-reicon name="settings" class="menu-item-icon" />
-                        <span class="menu-item-label" :class="collapsed && 'lg:hidden'">Settings</span>
-                    </a>
+            @endforeach
+            {{-- Submenus: a parent entry opens its submenu in place, and the user picks a page (the mobile
+                 drawer stays open until then). Back shows the main menu without leaving the page. --}}
+            @php
+                $renderedSubmenus = $navSections->flatten(1)->filter(fn (array $item): bool => isset($item['children']));
+            @endphp
+            @foreach ($renderedSubmenus as $submenuItem)
+                <li x-show="submenu === @js($submenuItem['label'])"
+                    @if ($submenuItem['active']) data-active-submenu="{{ $submenuItem['label'] }}" @else x-cloak @endif
+                    @class(['contents', 'xl:hidden' => $navContext]) :class="{ 'xl:hidden': navLevel !== -1 }">
+                    <ul role="list" class="flex flex-col gap-y-0.5" :class="navSwap && 'nav-swap-' + navSwap">
+                        <li class="mb-1">
+                            <button type="button" @click="submenu = ''; navSwap = 'back'" title="Back to the main menu" aria-label="Back to the main menu"
+                                class="menu-item menu-back bg-transparent! hover:bg-neutral-100! dark:hover:bg-white/[0.06]!" :class="collapsed && 'lg:justify-center lg:px-0'">
+                                {{-- As wide as a menu icon (with its tile), so the chevron lines up with the icons below. --}}
+                                <span class="menu-back-icon flex shrink-0 items-center justify-center">
+                                    <x-reicon name="chevron-down" class="size-3 rotate-90 text-neutral-500 dark:text-fg-dim" />
+                                </span>
+                                <span class="flex-1 truncate pr-6 text-center font-medium text-black dark:text-fg"
+                                    :class="collapsed && 'lg:hidden'">{{ $submenuItem['label'] }}</span>
+                            </button>
+                        </li>
+                        @foreach ($submenuItem['children'] as $child)
+                            @if ($child['sectionStart'] ?? false)
+                                <li class="my-2 border-t border-neutral-200 dark:border-white/[0.06]" aria-hidden="true"></li>
+                            @endif
+                            <li>
+                                <a title="{{ $child['label'] }}" href="{{ $child['href'] }}" {{ wireNavigate() }}
+                                    @if ($child['active']) aria-current="page" @endif
+                                    @class(['menu-item', 'menu-item-active' => $child['active']])
+                                    :class="collapsed && 'lg:justify-center lg:px-0'">
+                                    @isset($child['brandIcon'])
+                                        {{-- The mask is on an inner span, so the outer span keeps the icon tile. --}}
+                                        <span class="menu-item-icon">
+                                            <span class="block size-full bg-current"
+                                                style="mask: url('{{ asset('svgs/'.$child['brandIcon'].'.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/'.$child['brandIcon'].'.svg') }}') center / contain no-repeat;"></span>
+                                        </span>
+                                    @else
+                                        <x-reicon :name="$child['icon']" class="menu-item-icon" />
+                                    @endisset
+                                    <span class="menu-item-label" :class="collapsed && 'lg:hidden'">{{ $child['label'] }}</span>
+                                </a>
+                            </li>
+                            @if ($child['active'] && $desktop)
+                                {{-- A page can teleport its own sub-items here (e.g. the OAuth providers). --}}
+                                <li id="main-nav-active-children" class="empty:hidden ml-5 border-l border-neutral-200 pl-2 dark:border-white/[0.08]" :class="collapsed && 'lg:hidden'"></li>
+                            @endif
+                        @endforeach
+                    </ul>
                 </li>
-            @endif
+            @endforeach
+            <li x-show="!submenu" @if ($activeSubmenu) x-cloak @endif @class(['contents', 'xl:hidden' => $navContext]) :class="{ 'xl:hidden': navLevel !== -1 }">
+                <ul role="list" class="flex flex-col gap-y-0.5" :class="navSwap && 'nav-swap-' + navSwap">
+            @foreach ($navSections as $sectionLabel => $sectionItems)
+                @if ($loop->first)
+                    <li class="nav-section" :class="collapsed && 'lg:hidden'">{{ $sectionLabel }}</li>
+                @else
+                    <li class="nav-section mt-3" aria-hidden="true"
+                        :class="collapsed && 'lg:mx-2.5 lg:my-2 lg:h-0 lg:overflow-hidden lg:border-t lg:border-neutral-200 lg:p-0 lg:text-transparent dark:lg:border-white/10'">
+                        {{ $sectionLabel }}</li>
+                @endif
+                @foreach ($sectionItems as $item)
+                    <li>
+                        {{-- A parent entry is a button, not a link: wire:navigate would start a page load on mouse down. --}}
+                        @isset($item['children'])
+                            <button type="button" title="{{ $item['label'] }}" @click="submenu = @js($item['label']); navSwap = 'forward'"
+                                @class(['menu-item w-full', 'menu-item-active' => $item['active']])
+                                :class="collapsed && 'lg:justify-center lg:px-0'">
+                                <x-reicon :name="$item['icon']" class="menu-item-icon" />
+                                <span class="menu-item-label flex-1 text-left" :class="collapsed && 'lg:hidden'">{{ $item['label'] }}</span>
+                                <x-reicon name="chevron-down" class="size-3 -rotate-90 text-fg-faint" ::class="collapsed && 'lg:hidden'" />
+                            </button>
+                        @else
+                            <a title="{{ $item['label'] }}" href="{{ $item['href'] }}"
+                                @if ($item['navigate'] ?? true) {{ wireNavigate() }} @endif
+                                @class(['menu-item', 'menu-item-active' => $item['active']])
+                                :class="collapsed && 'lg:justify-center lg:px-0'">
+                                <x-reicon :name="$item['icon']" class="menu-item-icon" />
+                                <span class="menu-item-label flex-1" :class="collapsed && 'lg:hidden'">{{ $item['label'] }}</span>
+                            </a>
+                        @endisset
+                    </li>
+                @endforeach
+            @endforeach
+                </ul>
+            </li>
             <li class="flex-1" aria-hidden="true"></li>
         @endif
         @if (auth()->id() === 0 && (isCloud() || isDev()))
-            <li>
+            {{-- Part of the main menu: hidden while a submenu or a resource menu shows. --}}
+            <li x-show="!submenu" @if ($activeSubmenu ?? null) x-cloak @endif @class(['xl:hidden' => $navContext ?? []])
+                :class="{ 'xl:hidden': navLevel !== -1 }">
                 <a title="Admin" {{ wireNavigate() }}
                     class="{{ request()->is('admin') ? 'menu-item-active menu-item' : 'menu-item' }}"
                     :class="collapsed && 'lg:justify-center lg:px-0'" href="{{ route('admin.index') }}">
@@ -264,11 +319,9 @@
             @endif
         @endif
     </ul>
-    {{-- Sticky sidebar footer (desktop only; mobile uses a temporary slide-over) --}}
-    <div class="sticky bottom-0 mt-auto -mx-2 hidden flex-col gap-1 bg-white px-2 py-2 dark:bg-panel lg:-mx-3 lg:flex lg:px-3">
-        @if ($deploymentsIndicator)
-            <livewire:deployments-indicator variant="sidebar" />
-        @endif
+    {{-- Sidebar footer (desktop only; mobile uses a temporary slide-over). It stays visible;
+         only the menu above it scrolls on short or zoomed-in screens. --}}
+    <div class="sidebar-footer shrink-0 -mx-2 hidden flex-col gap-1 bg-white px-2 py-2 dark:bg-panel lg:-mx-3 lg:flex lg:px-3">
         <div class="flex items-center gap-1" :class="collapsed ? 'flex-col justify-center' : 'justify-between'">
             <x-top-user-menu sidebar />
             <button type="button" @click="toggleSidebar()" title="Toggle sidebar" aria-label="Toggle sidebar"
diff --git a/resources/views/components/notification/settings-layout.blade.php b/resources/views/components/notification/settings-layout.blade.php
index 5e801a1894..ac7ab44d40 100644
--- a/resources/views/components/notification/settings-layout.blade.php
+++ b/resources/views/components/notification/settings-layout.blade.php
@@ -9,35 +9,15 @@
     ];
 @endphp
 
-<section class="application-settings-workspace w-full max-w-none">
+{{-- These pages are in the Notifications submenu of the main sidebar (components/navbar.blade.php). --}}
+<section class="w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Notifications</h1>
         <p class="settings-mobile-description">Configure how your team receives deployment and system alerts.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Notifications' => $notificationMenuItems], [])) }}">
-            <nav aria-label="Notification settings"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                <div class="nav-section hidden xl:block">Notifications</div>
-                @foreach ($notificationMenuItems as $menuItem)
-                    <a wire:key="notification-settings-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => request()->routeIs($menuItem['route'])])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        @if (isset($menuItem['brandIcon']))
-                            <span class="menu-item-icon bg-current"
-                                style="mask: url('{{ asset('svgs/' . $menuItem['brandIcon'] . '.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/' . $menuItem['brandIcon'] . '.svg') }}') center / contain no-repeat;"></span>
-                        @else
-                            <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        @endif
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the Notifications pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Notifications' => $notificationMenuItems], [])) }}"></div>
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/reicon.blade.php b/resources/views/components/reicon.blade.php
index fb5dffe1c6..220ae57e90 100644
--- a/resources/views/components/reicon.blade.php
+++ b/resources/views/components/reicon.blade.php
@@ -22,6 +22,7 @@
         'storages' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C11.3953 1.25 10.8384 1.40029 10.2288 1.65242C9.64008 1.89588 8.95633 2.25471 8.1049 2.70153L6.03739 3.78651C4.99242 4.33487 4.15616 4.77371 3.51047 5.20491C2.84154 5.65164 2.32632 6.12201 1.95112 6.75918C1.57718 7.39421 1.40896 8.08184 1.32829 8.90072C1.24999 9.69558 1.24999 10.6731 1.25 11.9026V12.0974C1.24999 13.3268 1.24999 14.3044 1.32829 15.0993C1.40896 15.9182 1.57718 16.6058 1.95112 17.2408C2.32632 17.878 2.84154 18.3484 3.51047 18.7951C4.15616 19.2263 4.99241 19.6651 6.03737 20.2135L8.10481 21.2984C8.95628 21.7453 9.64006 22.1041 10.2288 22.3476C10.8384 22.5997 11.3953 22.75 12 22.75C12.6047 22.75 13.1616 22.5997 13.7712 22.3476C14.3599 22.1041 15.0437 21.7453 15.8951 21.2985L17.9626 20.2135C19.0076 19.6651 19.8438 19.2263 20.4895 18.7951C21.1585 18.3484 21.6737 17.878 22.0489 17.2408C22.4228 16.6058 22.591 15.9182 22.6717 15.0993C22.75 14.3044 22.75 13.3269 22.75 12.0975V11.9025C22.75 10.6731 22.75 9.69557 22.6717 8.90072C22.591 8.08184 22.4228 7.39421 22.0489 6.75918C21.6737 6.12201 21.1585 5.65164 20.4895 5.20491C19.8438 4.77371 19.0076 4.33487 17.9626 3.7865L15.8951 2.70154C15.0437 2.25472 14.3599 1.89589 13.7712 1.65242C13.1616 1.40029 12.6047 1.25 12 1.25ZM8.7708 4.04608C9.66052 3.57917 10.284 3.2528 10.802 3.03856C11.3062 2.83004 11.6605 2.75 12 2.75C12.3395 2.75 12.6938 2.83004 13.198 3.03856C13.716 3.2528 14.3395 3.57917 15.2292 4.04608L17.2292 5.09563C18.3189 5.66748 19.0845 6.07032 19.6565 6.45232C19.9387 6.64078 20.1604 6.81578 20.3395 6.99174L17.0088 8.65708L8.50895 4.18349L8.7708 4.04608ZM6.94466 5.00439L6.7708 5.09563C5.68111 5.66747 4.91553 6.07032 4.34352 6.45232C4.06131 6.64078 3.83956 6.81578 3.66054 6.99174L12 11.1615L15.3572 9.48289L7.15069 5.16369C7.07096 5.12173 7.00191 5.06743 6.94466 5.00439ZM2.93768 8.30737C2.88718 8.52125 2.84901 8.76413 2.82106 9.04778C2.75084 9.7606 2.75 10.6644 2.75 11.9415V12.0585C2.75 13.3356 2.75084 14.2394 2.82106 14.9522C2.88974 15.6494 3.02022 16.1002 3.24367 16.4797C3.46587 16.857 3.78727 17.1762 4.34352 17.5477C4.91553 17.9297 5.68111 18.3325 6.7708 18.9044L8.7708 19.9539C9.66052 20.4208 10.284 20.7472 10.802 20.9614C10.9656 21.0291 11.1134 21.0832 11.25 21.1255V12.4635L2.93768 8.30737ZM12.75 21.1255C12.8866 21.0832 13.0344 21.0291 13.198 20.9614C13.716 20.7472 14.3395 20.4208 15.2292 19.9539L17.2292 18.9044C18.3189 18.3325 19.0845 17.9297 19.6565 17.5477C20.2127 17.1762 20.5341 16.857 20.7563 16.4797C20.9798 16.1002 21.1103 15.6494 21.1789 14.9522C21.2492 14.2394 21.25 13.3356 21.25 12.0585V11.9415C21.25 10.6644 21.2492 9.7606 21.1789 9.04778C21.151 8.76412 21.1128 8.52125 21.0623 8.30736L17.75 9.96352V13C17.75 13.4142 17.4142 13.75 17 13.75C16.5858 13.75 16.25 13.4142 16.25 13V10.7135L12.75 12.4635V21.1255Z" fill="currentColor"/>',
         'variables' => '<path d="M16.96 6.17004C18.96 7.56004 20.34 9.77004 20.62 12.32" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M3.48999 12.37C3.74999 9.82997 5.10999 7.61997 7.08999 6.21997" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.19 20.9399C9.35 21.5299 10.67 21.8599 12.06 21.8599C13.4 21.8599 14.66 21.5599 15.79 21.0099" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M12.06 7.70001C13.5954 7.70001 14.84 6.45537 14.84 4.92001C14.84 3.38466 13.5954 2.14001 12.06 2.14001C10.5247 2.14001 9.28003 3.38466 9.28003 4.92001C9.28003 6.45537 10.5247 7.70001 12.06 7.70001Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M4.82999 19.92C6.36534 19.92 7.60999 18.6753 7.60999 17.14C7.60999 15.6046 6.36534 14.36 4.82999 14.36C3.29464 14.36 2.04999 15.6046 2.04999 17.14C2.04999 18.6753 3.29464 19.92 4.82999 19.92Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M19.17 19.92C20.7054 19.92 21.95 18.6753 21.95 17.14C21.95 15.6046 20.7054 14.36 19.17 14.36C17.6347 14.36 16.39 15.6046 16.39 17.14C16.39 18.6753 17.6347 19.92 19.17 19.92Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
         'notifications' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C7.71983 1.25 4.25004 4.71979 4.25004 9V9.7041C4.25004 10.401 4.04375 11.0824 3.65717 11.6622L2.50856 13.3851C1.17547 15.3848 2.19318 18.1028 4.51177 18.7351C5.26738 18.9412 6.02937 19.1155 6.79578 19.2581L6.79768 19.2632C7.56667 21.3151 9.62198 22.75 12 22.75C14.378 22.75 16.4333 21.3151 17.2023 19.2632L17.2042 19.2581C17.9706 19.1155 18.7327 18.9412 19.4883 18.7351C21.8069 18.1028 22.8246 15.3848 21.4915 13.3851L20.3429 11.6622C19.9563 11.0824 19.75 10.401 19.75 9.7041V9C19.75 4.71979 16.2802 1.25 12 1.25ZM15.3764 19.537C13.1335 19.805 10.8664 19.8049 8.62349 19.5369C9.33444 20.5585 10.571 21.25 12 21.25C13.4289 21.25 14.6655 20.5585 15.3764 19.537ZM5.75004 9C5.75004 5.54822 8.54826 2.75 12 2.75C15.4518 2.75 18.25 5.54822 18.25 9V9.7041C18.25 10.6972 18.544 11.668 19.0948 12.4943L20.2434 14.2172C21.0086 15.3649 20.4245 16.925 19.0936 17.288C14.4494 18.5546 9.5507 18.5546 4.90644 17.288C3.57561 16.925 2.99147 15.3649 3.75664 14.2172L4.90524 12.4943C5.45609 11.668 5.75004 10.6972 5.75004 9.7041V9Z" fill="currentColor"/>',
+        'webhook' => '<g stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M18 16.98h-5.99c-1.1 0-1.95.94-2.48 1.9A4 4 0 0 1 2 17c.01-.7.2-1.4.57-2"/><path d="m6 17 3.13-5.78c.53-.97.1-2.18-.5-3.1a4 4 0 1 1 6.89-4.06"/><path d="m12 6 3.13 5.73C15.66 12.7 16.9 13 18 13a4 4 0 0 1 0 8"/></g>',
         'keys' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M15.6809 5.34814C14.0521 5.34814 12.7265 6.66395 12.7265 8.29353C12.7265 9.92311 14.0521 11.2389 15.6809 11.2389C17.3097 11.2389 18.6353 9.92311 18.6353 8.29353C18.6353 6.66395 17.3097 5.34814 15.6809 5.34814ZM14.2265 8.29353C14.2265 7.49816 14.8748 6.84814 15.6809 6.84814C16.487 6.84814 17.1353 7.49816 17.1353 8.29353C17.1353 9.0889 16.487 9.73891 15.6809 9.73891C14.8748 9.73891 14.2265 9.0889 14.2265 8.29353Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M9.52998 20.8783C9.86298 20.414 9.97017 19.9429 9.96222 19.5233C10.3544 19.6387 10.7424 19.6533 11.1141 19.5828C11.8825 19.437 12.4511 18.9512 12.7527 18.5507L12.758 18.5437L12.7631 18.5366C13.2883 17.8043 13.2872 17.0543 13.1586 16.5164C13.0956 16.2528 13.0021 16.0361 12.9245 15.8846C12.8853 15.8081 12.849 15.746 12.8207 15.7005C12.8132 15.6885 12.8063 15.6775 12.7999 15.6677C12.7112 15.5021 12.6111 15.3719 12.5269 15.2737L12.5359 15.2647L13.0001 14.8024C13.3817 14.9849 13.7957 15.0999 14.1583 15.1749C14.744 15.2962 15.3171 15.3369 15.6807 15.3369C19.582 15.3369 22.75 12.1863 22.75 8.29344C22.75 4.40056 19.582 1.25 15.6807 1.25C11.7794 1.25 8.61144 4.40056 8.61144 8.29344C8.61144 9.2105 8.82018 9.99588 9.02588 10.549C9.07825 10.6898 9.13081 10.8166 9.18035 10.9279L1.92511 18.1535C1.66869 18.4089 1.36789 18.853 1.27697 19.4092C1.17837 20.0124 1.34031 20.6829 1.92511 21.2654L2.80687 22.1435C2.82046 22.1571 2.83457 22.1701 2.84916 22.1825C3.10385 22.3999 3.53164 22.6513 4.04572 22.7273C4.59712 22.8088 5.23527 22.6818 5.77579 22.1435L6.34232 21.5793C6.87523 21.8849 7.43853 21.9545 7.95941 21.8548C8.63497 21.7254 9.19686 21.321 9.51964 20.8924L9.5249 20.8854L9.52998 20.8783ZM10.1114 8.29344C10.1114 5.23477 12.602 2.75 15.6807 2.75C18.7594 2.75 21.25 5.23477 21.25 8.29344C21.25 11.3521 18.7594 13.8369 15.6807 13.8369C15.4075 13.8369 14.9372 13.8044 14.4623 13.7061C13.9654 13.6032 13.5752 13.4504 13.3674 13.2779C13.0699 13.031 12.6332 13.0508 12.3592 13.3237L11.4774 14.2019C11.2757 14.4028 11.0818 14.6305 10.9794 14.8933C10.8499 15.2261 10.8912 15.5463 11.0394 15.8121C11.1273 15.9697 11.2689 16.1202 11.3278 16.183L11.3476 16.2042C11.4173 16.2811 11.4555 16.3314 11.4834 16.387L11.5098 16.4397L11.54 16.4817L11.5468 16.4924C11.5558 16.507 11.5712 16.533 11.5895 16.5685C11.6267 16.6412 11.6709 16.7445 11.6997 16.8652C11.7544 17.0937 11.7538 17.3656 11.5494 17.6551C11.4087 17.8384 11.1424 18.0506 10.8345 18.1091C10.5769 18.1579 10.1571 18.1261 9.59673 17.5681C9.30409 17.2766 8.83089 17.2766 8.53825 17.5681L8.24433 17.8608C7.96748 18.1365 7.94891 18.5782 8.20054 18.8761C8.20194 18.8778 8.2058 18.8826 8.2116 18.8903C8.22363 18.9062 8.24339 18.9336 8.2668 18.9704C8.31483 19.0461 8.37128 19.1508 8.41138 19.2706C8.48694 19.4963 8.49882 19.7374 8.31639 19.9966C8.19643 20.1519 7.95303 20.3287 7.67726 20.3815C7.4429 20.4264 7.14284 20.3931 6.8045 20.0562C6.51186 19.7647 6.03866 19.7647 5.74602 20.0562L4.7173 21.0807C4.55241 21.2449 4.4068 21.2643 4.26505 21.2434C4.09729 21.2186 3.93333 21.1293 3.84077 21.0562L2.9836 20.2025C2.74543 19.9653 2.73591 19.7821 2.75733 19.6511C2.78643 19.4731 2.89711 19.3025 2.9836 19.2163L10.6279 11.6033C10.8747 11.3575 10.9185 10.9735 10.7333 10.6784L10.7311 10.6748C10.7284 10.6703 10.7232 10.6615 10.7158 10.6487C10.7012 10.6231 10.6781 10.5814 10.6494 10.5251C10.5918 10.4123 10.5122 10.2423 10.4318 10.0262C10.2701 9.59135 10.1114 8.98632 10.1114 8.29344ZM8.20054 18.8761C8.20192 18.8777 8.2033 18.8793 8.20469 18.881L8.20354 18.8796L8.20054 18.8761Z" fill="currentColor"/>',
         'tags' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M11.2383 2.79888C10.6243 2.88003 9.86602 3.0542 8.7874 3.30311L7.55922 3.58654C6.6482 3.79677 6.02082 3.94252 5.54162 4.10698C5.07899 4.26576 4.81727 4.42228 4.61978 4.61978C4.42228 4.81727 4.26576 5.07899 4.10698 5.54162C3.94252 6.02082 3.79677 6.6482 3.58654 7.55922L3.30311 8.7874C3.0542 9.86602 2.88003 10.6243 2.79888 11.2383C2.71982 11.8365 2.73805 12.2413 2.84358 12.6092C2.94911 12.9772 3.14817 13.3301 3.53226 13.7954C3.92651 14.2731 4.47607 14.8238 5.25882 15.6066L7.08845 17.4362C8.44794 18.7957 9.41533 19.7608 10.247 20.3954C11.0614 21.0167 11.6569 21.25 12.2623 21.25C12.8678 21.25 13.4633 21.0167 14.2776 20.3954C15.1093 19.7608 16.0767 18.7957 17.4362 17.4362C18.7957 16.0767 19.7608 15.1093 20.3954 14.2776C21.0167 13.4633 21.25 12.8678 21.25 12.2623C21.25 11.6569 21.0167 11.0614 20.3954 10.247C19.7608 9.41533 18.7957 8.44794 17.4362 7.08845L15.6066 5.25882C14.8238 4.47607 14.2731 3.92651 13.7954 3.53226C13.3301 3.14817 12.9772 2.94911 12.6092 2.84358C12.2413 2.73805 11.8365 2.71982 11.2383 2.79888ZM11.0418 1.31181C11.7591 1.21701 12.3881 1.21969 13.0227 1.4017C13.6574 1.58372 14.1922 1.91482 14.7502 2.37538C15.2897 2.82061 15.8905 3.4214 16.641 4.17197L18.5368 6.06774C19.8474 7.37835 20.8851 8.41598 21.5879 9.33714C22.311 10.2849 22.75 11.197 22.75 12.2623C22.75 13.3276 22.311 14.2397 21.5879 15.1875C20.8851 16.1087 19.8474 17.1463 18.5368 18.4569L18.4569 18.5368C17.1463 19.8474 16.1087 20.8851 15.1875 21.5879C14.2397 22.311 13.3276 22.75 12.2623 22.75C11.197 22.75 10.2849 22.311 9.33714 21.5879C8.41598 20.8851 7.37833 19.8474 6.06771 18.5368L4.17196 16.641C3.4214 15.8905 2.82061 15.2897 2.37538 14.7502C1.91482 14.1922 1.58372 13.6574 1.4017 13.0227C1.21969 12.3881 1.21701 11.7591 1.31181 11.0418C1.40345 10.3484 1.59451 9.52048 1.83319 8.48622L2.13385 7.18334C2.33302 6.32023 2.49543 5.61639 2.68821 5.05469C2.88955 4.46806 3.14313 3.9751 3.55912 3.55912C3.9751 3.14313 4.46806 2.88955 5.05469 2.68821C5.61639 2.49543 6.32023 2.33302 7.18335 2.13385L8.48622 1.83319C9.52047 1.59451 10.3484 1.40345 11.0418 1.31181ZM9.49094 7.99514C9.00278 7.50699 8.21133 7.50699 7.72317 7.99514C7.23502 8.4833 7.23502 9.27476 7.72317 9.76291C8.21133 10.2511 9.00278 10.2511 9.49094 9.76291C9.97909 9.27476 9.97909 8.4833 9.49094 7.99514ZM6.66251 6.93448C7.73645 5.86054 9.47766 5.86054 10.5516 6.93448C11.6255 8.00843 11.6255 9.74963 10.5516 10.8236C9.47766 11.8975 7.73645 11.8975 6.66251 10.8236C5.58857 9.74963 5.58857 8.00843 6.66251 6.93448ZM19.0511 10.9902C19.344 11.2831 19.344 11.7579 19.0511 12.0508L12.0721 19.0301C11.7792 19.323 11.3043 19.323 11.0114 19.0301C10.7185 18.7372 10.7185 18.2623 11.0114 17.9694L17.9904 10.9902C18.2833 10.6973 18.7582 10.6973 19.0511 10.9902Z" fill="currentColor"/>',
         'time-back' => '<path d="M12 2.75C9.91677 2.75 7.99633 3.43778 6.45042 4.59896C5.82246 5.07064 5.11166 5.77778 4.48433 6.50232C4.26205 6.75904 4.0557 7.01164 3.87142 7.25H7.5C7.91421 7.25 8.25 7.58579 8.25 8C8.25 8.41421 7.91421 8.75 7.5 8.75H2.47183C2.46206 8.75019 2.45227 8.75019 2.44247 8.75H2C1.58579 8.75 1.25 8.41421 1.25 8V2.5C1.25 2.08579 1.58579 1.75 2 1.75C2.41421 1.75 2.75 2.08579 2.75 2.5L2.75 6.24861C2.93794 6.00859 3.14013 5.76324 3.35033 5.52046C4.01529 4.75246 4.80449 3.95925 5.54955 3.39961C7.3463 2.05002 9.58081 1.25 12 1.25C17.9371 1.25 22.75 6.06294 22.75 12C22.75 17.9371 17.9371 22.75 12 22.75C7.18541 22.75 3.11189 19.5854 1.74227 15.2247C1.61816 14.8296 1.83789 14.4086 2.23307 14.2845C2.62825 14.1603 3.04923 14.3801 3.17335 14.7753C4.35226 18.5288 7.85932 21.25 12 21.25C17.1086 21.25 21.25 17.1086 21.25 12C21.25 6.89137 17.1086 2.75 12 2.75Z" fill="currentColor"/><path d="M12.75 7C12.75 6.58579 12.4142 6.25 12 6.25C11.5858 6.25 11.25 6.58579 11.25 7V12C11.25 12.2586 11.3832 12.4989 11.6025 12.636L14.8025 14.636C15.1538 14.8555 15.6165 14.7488 15.836 14.3975C16.0555 14.0462 15.9488 13.5835 15.5975 13.364L12.75 11.5843V7Z" fill="currentColor"/>',
@@ -58,17 +59,21 @@
         'unordered-list' => '<g transform="scale(1.33333)"><circle cx="3.75" cy="5.25" r="2" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></circle><circle cx="3.75" cy="12.75" r="2" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></circle><line x1="8.75" y1="5.25" x2="16.25" y2="5.25" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><line x1="8.75" y1="12.75" x2="16.25" y2="12.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line></g>',
         'file' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12.25 2.83422C11.7896 2.75598 11.162 2.75005 10.0298 2.75005C8.11311 2.75005 6.75075 2.75163 5.71785 2.88987C4.70596 3.0253 4.12453 3.27933 3.7019 3.70195C3.27869 4.12516 3.02502 4.70481 2.88976 5.7109C2.75159 6.73856 2.75 8.09323 2.75 10.0001V14.0001C2.75 15.9069 2.75159 17.2615 2.88976 18.2892C3.02502 19.2953 3.27869 19.8749 3.7019 20.2981C4.12511 20.7214 4.70476 20.975 5.71085 21.1103C6.73851 21.2485 8.09318 21.2501 10 21.2501H14C15.9068 21.2501 17.2615 21.2485 18.2892 21.1103C19.2952 20.975 19.8749 20.7214 20.2981 20.2981C20.7213 19.8749 20.975 19.2953 21.1102 18.2892C21.2484 17.2615 21.25 15.9069 21.25 14.0001V13.5629C21.25 12.0269 21.2392 11.2988 21.0762 10.7501H17.9463C16.8135 10.7501 15.8877 10.7501 15.1569 10.6518C14.3929 10.5491 13.7306 10.3268 13.2019 9.79815C12.6732 9.26945 12.4509 8.60712 12.3482 7.84317C12.25 7.1123 12.25 6.18657 12.25 5.05374V2.83422ZM13.75 3.6095V5.00005C13.75 6.19976 13.7516 7.0241 13.8348 7.64329C13.9152 8.24091 14.059 8.53395 14.2626 8.73749C14.4661 8.94103 14.7591 9.08486 15.3568 9.16521C15.976 9.24846 16.8003 9.25005 18 9.25005H20.0195C19.723 8.9625 19.3432 8.61797 18.85 8.17407L14.8912 4.61117C14.4058 4.17433 14.0446 3.85187 13.75 3.6095ZM10.1755 1.25002C11.5601 1.24965 12.4546 1.24942 13.2779 1.56535C14.1012 1.88129 14.7632 2.47735 15.7873 3.39955C15.8226 3.43139 15.8584 3.46361 15.8947 3.49623L19.8534 7.05912C19.8956 7.09705 19.9372 7.1345 19.9783 7.17149C21.162 8.23614 21.9274 8.92458 22.3391 9.84902C22.7508 10.7734 22.7505 11.8029 22.75 13.3949C22.75 13.4502 22.75 13.5062 22.75 13.5629V14.0565C22.75 15.8942 22.75 17.3499 22.5969 18.4891C22.4392 19.6615 22.1071 20.6104 21.3588 21.3588C20.6104 22.1072 19.6614 22.4393 18.489 22.5969C17.3498 22.7501 15.8942 22.7501 14.0564 22.7501H9.94359C8.10583 22.7501 6.65019 22.7501 5.51098 22.5969C4.33856 22.4393 3.38961 22.1072 2.64124 21.3588C1.89288 20.6104 1.56076 19.6615 1.40314 18.4891C1.24997 17.3499 1.24998 15.8942 1.25 14.0565V9.94363C1.24998 8.10587 1.24997 6.65024 1.40314 5.51103C1.56076 4.33861 1.89288 3.38966 2.64124 2.64129C3.39019 1.89235 4.34232 1.56059 5.51887 1.40313C6.66283 1.25002 8.1257 1.25003 9.97352 1.25005L10.0298 1.25005C10.0789 1.25005 10.1275 1.25004 10.1755 1.25002Z" fill="currentColor"/>',
         'file-content' => '<g transform="scale(1.33333)"><line x1="5.75" y1="6.75" x2="7.75" y2="6.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><line x1="5.75" y1="9.75" x2="12.25" y2="9.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><line x1="5.75" y1="12.75" x2="12.25" y2="12.75" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></line><path d="M2.75,14.25V3.75c0-1.105,.895-2,2-2h5.586c.265,0,.52,.105,.707,.293l3.914,3.914c.188,.188,.293,.442,.293,.707v7.586c0,1.105-.895,2-2,2H4.75c-1.105,0-2-.895-2-2Z" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></path><path d="M15.16,6.25h-3.41c-.552,0-1-.448-1-1V1.852" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></path></g>',
+        'folder-filled' => '<path d="M2 6.5A2.5 2.5 0 0 1 4.5 4h4.38c.53 0 1.04.21 1.42.59L11.7 6h7.8A2.5 2.5 0 0 1 22 8.5v9a2.5 2.5 0 0 1-2.5 2.5h-15A2.5 2.5 0 0 1 2 17.5v-11Z" fill="currentColor"/>',
         'folder' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M6.85929 1.25001C6.88904 1.25001 6.91919 1.25002 6.94976 1.25002L6.98675 1.25001C7.33818 1.24999 7.56433 1.24998 7.78542 1.27065C8.7367 1.35961 9.63905 1.73337 10.3746 2.34313C10.5456 2.48485 10.7055 2.64477 10.954 2.89329L11.5303 3.46969C12.3761 4.3154 12.7012 4.6311 13.0768 4.84005C13.2948 4.96134 13.526 5.05713 13.766 5.12552C14.1793 5.24333 14.6324 5.25002 15.8284 5.25002L16.253 5.25002C17.526 5.25 18.5521 5.24998 19.364 5.35206C20.2054 5.45784 20.9204 5.68358 21.5077 6.21185C21.6061 6.30032 21.6997 6.39394 21.7882 6.49231C22.3165 7.07965 22.5422 7.79459 22.648 8.63601C22.75 9.4479 22.75 10.4741 22.75 11.747V14.0564C22.75 15.8942 22.75 17.3498 22.5969 18.489C22.4393 19.6615 22.1071 20.6104 21.3588 21.3588C20.6104 22.1071 19.6615 22.4393 18.489 22.5969C17.3498 22.75 15.8942 22.75 14.0564 22.75H9.94361C8.10584 22.75 6.65021 22.75 5.51099 22.5969C4.33857 22.4393 3.38962 22.1071 2.64126 21.3588C1.8929 20.6104 1.56078 19.6615 1.40315 18.489C1.24999 17.3498 1.25 15.8942 1.25002 14.0564L1.25002 6.94976C1.25002 6.91919 1.25001 6.88904 1.25001 6.85929C1.2499 6.06338 1.24982 5.55685 1.33237 5.11935C1.6949 3.19788 3.19788 1.6949 5.11935 1.33237C5.55685 1.24982 6.06338 1.2499 6.85929 1.25001ZM6.94976 2.75002C6.03312 2.75002 5.67873 2.75329 5.39746 2.80636C4.08277 3.05441 3.05441 4.08277 2.80636 5.39746C2.75329 5.67873 2.75002 6.03312 2.75002 6.94976V14C2.75002 15.9068 2.75161 17.2615 2.88978 18.2892C3.02504 19.2953 3.27871 19.8749 3.70192 20.2981C4.12513 20.7213 4.70478 20.975 5.71087 21.1103C6.73853 21.2484 8.0932 21.25 10 21.25H14C15.9068 21.25 17.2615 21.2484 18.2892 21.1103C19.2953 20.975 19.8749 20.7213 20.2981 20.2981C20.7213 19.8749 20.975 19.2953 21.1103 18.2892C21.2484 17.2615 21.25 15.9068 21.25 14V11.7979C21.25 10.4621 21.2486 9.5305 21.1597 8.82312C21.0731 8.13448 20.9141 7.76356 20.6729 7.49539C20.6198 7.43637 20.5637 7.3802 20.5046 7.32712C20.2365 7.08592 19.8656 6.92692 19.1769 6.84034C18.4695 6.75141 17.538 6.75002 16.2021 6.75002H15.8284C15.7912 6.75002 15.7545 6.75002 15.7182 6.75003C14.6702 6.75025 13.9944 6.75038 13.3548 6.56806C13.0041 6.46811 12.6661 6.32811 12.3475 6.15083C11.7663 5.82747 11.2885 5.3495 10.5476 4.60833C10.522 4.58265 10.496 4.55666 10.4697 4.53035L9.91943 3.98009C9.63616 3.69682 9.52778 3.58951 9.41731 3.49793C8.91403 3.08073 8.29664 2.825 7.64576 2.76413C7.50289 2.75077 7.35038 2.75002 6.94976 2.75002ZM12.25 10C12.25 9.5858 12.5858 9.25002 13 9.25002H18C18.4142 9.25002 18.75 9.5858 18.75 10C18.75 10.4142 18.4142 10.75 18 10.75H13C12.5858 10.75 12.25 10.4142 12.25 10Z" fill="currentColor"/>',
         'alert-triangle' => '<path d="M12 7.25C12.4142 7.25 12.75 7.58579 12.75 8V13C12.75 13.4142 12.4142 13.75 12 13.75C11.5858 13.75 11.25 13.4142 11.25 13V8C11.25 7.58579 11.5858 7.25 12 7.25Z" fill="currentColor"/><path d="M12 17C12.5523 17 13 16.5523 13 16C13 15.4477 12.5523 15 12 15C11.4477 15 11 15.4477 11 16C11 16.5523 11.4477 17 12 17Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M8.2944 4.47643C9.36631 3.11493 10.5018 2.25 12 2.25C13.4981 2.25 14.6336 3.11493 15.7056 4.47643C16.7598 5.81544 17.8769 7.79622 19.3063 10.3305L19.7418 11.1027C20.9234 13.1976 21.8566 14.8523 22.3468 16.1804C22.8478 17.5376 22.9668 18.7699 22.209 19.8569C21.4736 20.9118 20.2466 21.3434 18.6991 21.5471C17.1576 21.75 15.0845 21.75 12.4248 21.75H11.5752C8.91552 21.75 6.84239 21.75 5.30082 21.5471C3.75331 21.3434 2.52637 20.9118 1.79099 19.8569C1.03318 18.7699 1.15218 17.5376 1.65314 16.1804C2.14334 14.8523 3.07658 13.1977 4.25818 11.1027L4.69361 10.3307C6.123 7.79629 7.24019 5.81547 8.2944 4.47643ZM9.47297 5.40432C8.49896 6.64148 7.43704 8.51988 5.96495 11.1299L5.60129 11.7747C4.37507 13.9488 3.50368 15.4986 3.06034 16.6998C2.6227 17.8855 2.68338 18.5141 3.02148 18.9991C3.38202 19.5163 4.05873 19.8706 5.49659 20.0599C6.92858 20.2484 8.9026 20.25 11.6363 20.25H12.3636C15.0974 20.25 17.0714 20.2484 18.5034 20.0599C19.9412 19.8706 20.6179 19.5163 20.9785 18.9991C21.3166 18.5141 21.3773 17.8855 20.9396 16.6998C20.4963 15.4986 19.6249 13.9488 18.3987 11.7747L18.035 11.1299C16.5629 8.51987 15.501 6.64148 14.527 5.40431C13.562 4.17865 12.8126 3.75 12 3.75C11.1874 3.75 10.4379 4.17865 9.47297 5.40432Z" fill="currentColor"/>',
         'alert-circle' => '<path d="M12 6.25C12.4142 6.25 12.75 6.58579 12.75 7V13C12.75 13.4142 12.4142 13.75 12 13.75C11.5858 13.75 11.25 13.4142 11.25 13V7C11.25 6.58579 11.5858 6.25 12 6.25Z" fill="currentColor"/><path d="M12 17C12.5523 17 13 16.5523 13 16C13 15.4477 12.5523 15 12 15C11.4477 15 11 15.4477 11 16C11 16.5523 11.4477 17 12 17Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M1.25 12C1.25 6.06294 6.06294 1.25 12 1.25C17.9371 1.25 22.75 6.06294 22.75 12C22.75 17.9371 17.9371 22.75 12 22.75C6.06294 22.75 1.25 17.9371 1.25 12ZM12 2.75C6.89137 2.75 2.75 6.89137 2.75 12C2.75 17.1086 6.89137 21.25 12 21.25C17.1086 21.25 21.25 17.1086 21.25 12C21.25 6.89137 17.1086 2.75 12 2.75Z" fill="currentColor"/>',
         'check-circle' => '<path d="M16.0303 10.0303C16.3232 9.73744 16.3232 9.26256 16.0303 8.96967C15.7374 8.67678 15.2626 8.67678 14.9697 8.96967L10.5 13.4393L9.03033 11.9697C8.73744 11.6768 8.26256 11.6768 7.96967 11.9697C7.67678 12.2626 7.67678 12.7374 7.96967 13.0303L9.96967 15.0303C10.2626 15.3232 10.7374 15.3232 11.0303 15.0303L16.0303 10.0303Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C6.06294 1.25 1.25 6.06294 1.25 12C1.25 17.9371 6.06294 22.75 12 22.75C17.9371 22.75 22.75 17.9371 22.75 12C22.75 6.06294 17.9371 1.25 12 1.25ZM2.75 12C2.75 6.89137 6.89137 2.75 12 2.75C17.1086 2.75 21.25 6.89137 21.25 12C21.25 17.1086 17.1086 21.25 12 21.25C6.89137 21.25 2.75 17.1086 2.75 12Z" fill="currentColor"/>',
         'info-circle' => '<path d="M12 17.75C12.4142 17.75 12.75 17.4142 12.75 17V11C12.75 10.5858 12.4142 10.25 12 10.25C11.5858 10.25 11.25 10.5858 11.25 11V17C11.25 17.4142 11.5858 17.75 12 17.75Z" fill="currentColor"/><path d="M12 7C12.5523 7 13 7.44772 13 8C13 8.55228 12.5523 9 12 9C11.4477 9 11 8.55228 11 8C11 7.44772 11.4477 7 12 7Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M1.25 12C1.25 6.06294 6.06294 1.25 12 1.25C17.9371 1.25 22.75 6.06294 22.75 12C22.75 17.9371 17.9371 22.75 12 22.75C6.06294 22.75 1.25 17.9371 1.25 12ZM12 2.75C6.89137 2.75 2.75 6.89137 2.75 12C2.75 17.1086 6.89137 21.25 12 21.25C17.1086 21.25 21.25 17.1086 21.25 12C21.25 6.89137 17.1086 2.75 12 2.75Z" fill="currentColor"/>',
         'arrow-right' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M13.4697 5.46967C13.7626 5.17678 14.2374 5.17678 14.5303 5.46967L20.5303 11.4697C20.8232 11.7626 20.8232 12.2374 20.5303 12.5303L14.5303 18.5303C14.2374 18.8232 13.7626 18.8232 13.4697 18.5303C13.1768 18.2374 13.1768 17.7626 13.4697 17.4697L18.1893 12.75H4C3.58579 12.75 3.25 12.4142 3.25 12C3.25 11.5858 3.58579 11.25 4 11.25H18.1893L13.4697 6.53033C13.1768 6.23744 13.1768 5.76256 13.4697 5.46967Z" fill="currentColor"/>',
+        'edit' => '<path d="M11 2H9C4 2 2 4 2 9V15C2 20 4 22 9 22H15C20 22 22 20 22 15V13" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M16.04 3.02001L8.16 10.9C7.86 11.2 7.56 11.79 7.5 12.22L7.07 15.23C6.91 16.32 7.68 17.08 8.77 16.93L11.78 16.5C12.2 16.44 12.79 16.14 13.1 15.84L20.98 7.96001C22.34 6.60001 22.98 5.02001 20.98 3.02001C18.98 1.02001 17.4 1.66001 16.04 3.02001Z" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/><path d="M14.91 4.1499C15.58 6.5399 17.45 8.4099 19.85 9.0899" stroke="currentColor" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>',
+        'download' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1.25C12.4142 1.25 12.75 1.58579 12.75 2V12.9726L14.4306 11.0119C14.7001 10.6974 15.1736 10.661 15.4881 10.9306C15.8026 11.2001 15.839 11.6736 15.5694 11.9881L12.5694 15.4881C12.427 15.6543 12.2189 15.75 12 15.75C11.7811 15.75 11.573 15.6543 11.4306 15.4881L8.43056 11.9881C8.16099 11.6736 8.19741 11.2001 8.51191 10.9306C8.8264 10.661 9.29988 10.6974 9.56944 11.0119L11.25 12.9726V2C11.25 1.58579 11.5858 1.25 12 1.25ZM6.99583 8.25196C7.41003 8.24966 7.74768 8.58357 7.74999 8.99778C7.7523 9.41199 7.41838 9.74964 7.00418 9.75194C5.91068 9.75803 5.1356 9.78643 4.54735 9.89448C3.98054 9.99859 3.65246 10.1658 3.40901 10.4092C3.13225 10.686 2.9518 11.0746 2.85315 11.8083C2.75159 12.5637 2.75 13.5648 2.75 15.0002V16.0002C2.75 17.4356 2.75159 18.4367 2.85315 19.1921C2.9518 19.9259 3.13225 20.3144 3.40901 20.5912C3.68577 20.868 4.07435 21.0484 4.80812 21.1471C5.56347 21.2486 6.56458 21.2502 8 21.2502H16C17.4354 21.2502 18.4365 21.2486 19.1919 21.1471C19.9257 21.0484 20.3142 20.868 20.591 20.5912C20.8678 20.3144 21.0482 19.9259 21.1469 19.1921C21.2484 18.4367 21.25 17.4356 21.25 16.0002V15.0002C21.25 13.5648 21.2484 12.5637 21.1469 11.8083C21.0482 11.0746 20.8678 10.686 20.591 10.4092C20.3475 10.1658 20.0195 9.99859 19.4527 9.89448C18.8644 9.78643 18.0893 9.75803 16.9958 9.75194C16.5816 9.74964 16.2477 9.41199 16.25 8.99778C16.2523 8.58357 16.59 8.24966 17.0042 8.25196C18.0857 8.25799 18.9871 8.28387 19.7236 8.41916C20.4816 8.55839 21.1267 8.82364 21.6517 9.34857C22.2536 9.95048 22.5125 10.7084 22.6335 11.6085C22.75 12.4754 22.75 13.5778 22.75 14.9453V16.0551C22.75 17.4227 22.75 18.525 22.6335 19.392C22.5125 20.2921 22.2536 21.0499 21.6517 21.6519C21.0497 22.2538 20.2919 22.5127 19.3918 22.6337C18.5248 22.7503 17.4225 22.7502 16.0549 22.7502H7.94513C6.57754 22.7502 5.47522 22.7503 4.60825 22.6337C3.70814 22.5127 2.95027 22.2538 2.34835 21.6519C1.74643 21.0499 1.48754 20.2921 1.36652 19.392C1.24996 18.525 1.24998 17.4227 1.25 16.0551V14.9453C1.24998 13.5778 1.24996 12.4754 1.36652 11.6085C1.48754 10.7084 1.74643 9.95048 2.34835 9.34857C2.87328 8.82363 3.51835 8.55839 4.27635 8.41916C5.01291 8.28387 5.9143 8.25798 6.99583 8.25196Z" fill="currentColor"/>',
         'upload' => '<path d="M11.4697 3.46967C11.7626 3.17678 12.2374 3.17678 12.5303 3.46967L16.5303 7.46967C16.8232 7.76256 16.8232 8.23744 16.5303 8.53033C16.2374 8.82322 15.7626 8.82322 15.4697 8.53033L12.75 5.81066V14C12.75 14.4142 12.4142 14.75 12 14.75C11.5858 14.75 11.25 14.4142 11.25 14V5.81066L8.53033 8.53033C8.23744 8.82322 7.76256 8.82322 7.46967 8.53033C7.17678 8.23744 7.17678 7.76256 7.46967 7.46967L11.4697 3.46967Z" fill="currentColor"/><path d="M4 14.25C4.41421 14.25 4.75 14.5858 4.75 15V17C4.75 18.5188 5.98122 19.75 7.5 19.75H16.5C18.0188 19.75 19.25 18.5188 19.25 17V15C19.25 14.5858 19.5858 14.25 20 14.25C20.4142 14.25 20.75 14.5858 20.75 15V17C20.75 19.3472 18.8472 21.25 16.5 21.25H7.5C5.15279 21.25 3.25 19.3472 3.25 17V15C3.25 14.5858 3.58579 14.25 4 14.25Z" fill="currentColor"/>',
         'x' => '<path d="M18.4697 19.5303C18.7626 19.8232 19.2374 19.8232 19.5303 19.5303C19.8232 19.2374 19.8232 18.7626 19.5303 18.4697L13.0607 12L19.5303 5.53033C19.8232 5.23744 19.8232 4.76256 19.5303 4.46967C19.2374 4.17678 18.7626 4.17678 18.4697 4.46967L12 10.9393L5.53033 4.46967C5.23744 4.17678 4.76256 4.17678 4.46967 4.46967C4.17678 4.76256 4.17678 5.23744 4.46967 5.53033L10.9393 12L4.46967 18.4697C4.17678 18.7626 4.17678 19.2374 4.46967 19.5303C4.76256 19.8232 5.23744 19.8232 5.53033 19.5303L12 13.0607L18.4697 19.5303Z" fill="currentColor"/>',
         'check' => '<path d="M21.5303 5.46967C21.8232 5.76256 21.8232 6.23744 21.5303 6.53033L9.53033 18.5303C9.23744 18.8232 8.76256 18.8232 8.46967 18.5303L2.46967 12.5303C2.17678 12.2374 2.17678 11.7626 2.46967 11.4697C2.76256 11.1768 3.23744 11.1768 3.53033 11.4697L9 16.9393L20.4697 5.46967C20.7626 5.17678 21.2374 5.17678 21.5303 5.46967Z" fill="currentColor"/>',
         'copy' => '<path d="M8 8.75H6.5A2.25 2.25 0 0 0 4.25 11v6.5a2.25 2.25 0 0 0 2.25 2.25H13a2.25 2.25 0 0 0 2.25-2.25V16" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><rect x="8.75" y="4.25" width="11" height="11" rx="2.25" stroke="currentColor" stroke-width="1.5"/>',
         'chevron-down' => '<polyline points="5 9 12 16 19 9" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></polyline>',
+        'dots-horizontal' => '<circle cx="5" cy="12" r="1.6" fill="currentColor"/><circle cx="12" cy="12" r="1.6" fill="currentColor"/><circle cx="19" cy="12" r="1.6" fill="currentColor"/>',
         'trash' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M15.0924 1.25H8.90788C7.33861 1.24998 6.08032 1.24996 5.10577 1.38767C4.09802 1.53007 3.25979 1.83575 2.64218 2.55292C2.02457 3.27008 1.84661 4.14438 1.85528 5.1621C1.86366 6.1463 2.05033 7.39066 2.28314 8.94256L3.49937 17.0508C3.67587 18.2275 3.81878 19.1804 4.02849 19.9262C4.24683 20.7027 4.56045 21.3453 5.13662 21.8415C5.71279 22.3377 6.39485 22.5525 7.19513 22.6533C7.96377 22.75 8.92732 22.75 10.1173 22.75H13.883C15.073 22.75 16.0365 22.75 16.8052 22.6533C17.6054 22.5525 18.2875 22.3377 18.8637 21.8415C19.4398 21.3453 19.7535 20.7027 19.9718 19.9262C20.1815 19.1805 20.3244 18.2276 20.5009 17.0509L21.7172 8.94253C21.95 7.39065 22.1366 6.14629 22.145 5.1621C22.1537 4.14438 21.9757 3.27008 21.3581 2.55292C20.7405 1.83575 19.9023 1.53007 18.8945 1.38767C17.92 1.24996 16.6617 1.24998 15.0924 1.25ZM3.77879 3.53175C4.05882 3.20658 4.47927 2.9911 5.31565 2.87292C6.17295 2.75177 7.32479 2.75 8.96727 2.75H15.033C16.6755 2.75 17.8273 2.75177 18.6846 2.87292C19.521 2.9911 19.9415 3.20658 20.2215 3.53175C20.5015 3.85692 20.6523 4.30468 20.6451 5.14933C20.6448 5.18248 20.6443 5.21604 20.6435 5.25H20.5005C20.5003 5.25 20.5007 5.25 20.5005 5.25H7.00045C7.00025 5.25 7.00065 5.25 7.00045 5.25H3.35678C3.35603 5.21603 3.35551 5.18248 3.35522 5.14933C3.34803 4.30468 3.49876 3.85692 3.77879 3.53175ZM5.18949 6.75H3.48546C3.53687 7.15852 3.60161 7.61096 3.67631 8.1155L3.75015 8.18934L5.18949 6.75ZM4.05013 10.6106L4.6686 14.7338L6.37599 12.9365L4.05013 10.6106ZM5.15659 17.9593C5.17275 18.0594 5.18872 18.1563 5.20463 18.25H5.39887L5.15659 17.9593ZM6.99527 19.75C6.99879 19.75 7.00232 19.75 7.00584 19.75H13.9972C13.9991 19.75 14.0009 19.75 14.0027 19.75H18.4577C18.299 20.2287 18.1176 20.5044 17.8848 20.7049C17.6171 20.9355 17.261 21.0841 16.6178 21.165C15.9538 21.2486 15.0849 21.25 13.833 21.25H10.1673C8.91538 21.25 8.04651 21.2486 7.38247 21.165C6.73934 21.0841 6.38321 20.9355 6.11546 20.7049C5.88266 20.5044 5.70127 20.2287 5.54256 19.75H6.99527ZM15.7131 18.25H18.1895L16.9018 16.9623L15.7131 18.25ZM19.0007 16.9399C19.0087 16.8869 19.0168 16.8332 19.0249 16.7788L19.404 14.2515L17.92 15.8592L19.0007 16.9399ZM19.856 11.2381L20.2249 8.77879C20.3197 8.14673 20.4033 7.5881 20.4704 7.09045L18.16 9.40079L19.856 11.2381ZM18.6895 6.75H15.7131L17.1418 8.2977L18.6895 6.75ZM12.2532 6.75H8.81081L10.5761 8.51531L12.2532 6.75ZM11.6895 18.25H9.31081L10.5002 17.0607L11.6895 18.25ZM7.40946 11.8486L4.81081 9.25L7.00015 7.06066L9.54266 9.60317L7.40946 11.8486ZM8.47047 12.9097L10.6037 10.6642L12.6895 12.75L10.5002 14.9393L8.47047 12.9097ZM11.5608 16L13.7502 13.8107L15.8403 15.9008L13.7385 18.1777L11.5608 16ZM14.8108 12.75L16.8585 14.7977L18.9795 12.5L17.0985 10.4623L14.8108 12.75ZM13.7502 11.6893L16.0803 9.35921L13.9923 7.09721L11.6371 9.57632L13.7502 11.6893ZM7.437 13.9975L9.43949 16L7.27782 18.1617L5.50363 16.0326L7.437 13.9975Z" fill="currentColor"/>',
         'external-link' => '<path d="M13 11L21.2 2.80005" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M22 6.8V2H17.2" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M11 2H9C4 2 2 4 2 9V15C2 20 4 22 9 22H15C20 22 22 20 22 15V13" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
         'server-update' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M9.94358 2.25H14.0564C15.8942 2.24998 17.3498 2.24997 18.489 2.40314C19.6614 2.56076 20.6104 2.89288 21.3588 3.64124C22.1071 4.38961 22.4392 5.33856 22.5969 6.51098C22.75 7.65019 22.75 9.10583 22.75 10.9436V13C22.75 13.4142 22.4142 13.75 22 13.75C21.5858 13.75 21.25 13.4142 21.25 13V12.75H2.75V13C2.75 14.9068 2.75159 16.2615 2.88976 17.2892C3.02502 18.2952 3.27869 18.8749 3.7019 19.2981C4.12511 19.7213 4.70476 19.975 5.71085 20.1102C6.73851 20.2484 8.09318 20.25 10 20.25H13C13.4142 20.25 13.75 20.5858 13.75 21C13.75 21.4142 13.4142 21.75 13 21.75H9.94359C8.10583 21.75 6.65019 21.75 5.51098 21.5969C4.33856 21.4392 3.38961 21.1071 2.64124 20.3588C1.89288 19.6104 1.56076 18.6614 1.40314 17.489C1.24997 16.3498 1.24998 14.8942 1.25 13.0564V10.9436C1.24998 9.10582 1.24997 7.65019 1.40314 6.51098C1.56076 5.33856 1.89288 4.38961 2.64124 3.64124C3.38961 2.89288 4.33856 2.56076 5.51098 2.40314C6.65019 2.24997 8.10582 2.24998 9.94358 2.25ZM2.75 11.25H21.25V11C21.25 9.09318 21.2484 7.73851 21.1102 6.71085C20.975 5.70476 20.7213 5.12511 20.2981 4.7019C19.8749 4.27869 19.2952 4.02502 18.2892 3.88976C17.2615 3.75159 15.9068 3.75 14 3.75H10C8.09318 3.75 6.73851 3.75159 5.71085 3.88976C4.70476 4.02502 4.12511 4.27869 3.7019 4.7019C3.27869 5.12511 3.02502 5.70476 2.88976 6.71085C2.75159 7.73851 2.75 9.09318 2.75 11V11.25ZM6 5.75C6.41421 5.75 6.75 6.08579 6.75 6.5V8.5C6.75 8.91421 6.41421 9.25 6 9.25C5.58579 9.25 5.25 8.91421 5.25 8.5V6.5C5.25 6.08579 5.58579 5.75 6 5.75ZM9 5.75C9.41421 5.75 9.75 6.08579 9.75 6.5V8.5C9.75 8.91421 9.41421 9.25 9 9.25C8.58579 9.25 8.25 8.91421 8.25 8.5V6.5C8.25 6.08579 8.58579 5.75 9 5.75ZM12.75 7.5C12.75 7.08579 13.0858 6.75 13.5 6.75H18C18.4142 6.75 18.75 7.08579 18.75 7.5C18.75 7.91421 18.4142 8.25 18 8.25H13.5C13.0858 8.25 12.75 7.91421 12.75 7.5ZM14.9286 16.7534C15.3176 15.2559 16.8529 14.25 18.5048 14.25C19.782 14.25 20.945 14.8304 21.6108 15.7648C21.8512 16.1021 21.7726 16.5704 21.4352 16.8108C21.0979 17.0512 20.6296 16.9726 20.3892 16.6352C20.0295 16.1304 19.3411 15.75 18.5048 15.75C17.5383 15.75 16.8181 16.2319 16.5056 16.8299C16.592 16.8734 16.6713 16.9343 16.738 17.0123C17.0074 17.327 16.9706 17.8004 16.656 18.0698L16.0718 18.5698C15.7911 18.8101 15.3772 18.8101 15.0964 18.5698L14.5123 18.0698C14.1976 17.8004 14.1609 17.327 14.4302 17.0123C14.5618 16.8586 14.742 16.7712 14.9286 16.7534ZM6 14.75C6.41421 14.75 6.75 15.0858 6.75 15.5V17.5C6.75 17.9142 6.41421 18.25 6 18.25C5.58579 18.25 5.25 17.9142 5.25 17.5V15.5C5.25 15.0858 5.58579 14.75 6 14.75ZM9 14.75C9.41421 14.75 9.75 15.0858 9.75 15.5V17.5C9.75 17.9142 9.41421 18.25 9 18.25C8.58579 18.25 8.25 17.9142 8.25 17.5V15.5C8.25 15.0858 8.58579 14.75 9 14.75ZM20.9282 17.4302C21.2089 17.1899 21.6228 17.1899 21.9036 17.4302L22.4877 17.9302C22.8024 18.1996 22.8391 18.673 22.5698 18.9877C22.4382 19.1414 22.258 19.2288 22.0714 19.2466C21.6824 20.7441 20.1471 21.75 18.4952 21.75C17.218 21.75 16.055 21.1696 15.3892 20.2352C15.1488 19.8979 15.2274 19.4296 15.5648 19.1892C15.9021 18.9488 16.3704 19.0274 16.6108 19.3648C16.9705 19.8696 17.6589 20.25 18.4952 20.25C19.4617 20.25 20.1819 19.7681 20.4944 19.1701C20.408 19.1266 20.3287 19.0657 20.262 18.9877C19.9926 18.673 20.0294 18.1996 20.344 17.9302L20.9282 17.4302Z" fill="currentColor"/>',
@@ -82,10 +87,12 @@
         'network' => '<g transform="scale(0.09375)"><path d="M240,120a8,8,0,0,1-8,8H200v32h8a16,16,0,0,1,16,16v32a16,16,0,0,1-16,16H176a16,16,0,0,1-16-16V176a16,16,0,0,1,16-16h8V128H72v32h8a16,16,0,0,1,16,16v32a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V176a16,16,0,0,1,16-16h8V128H24a8,8,0,0,1,0-16h96V88h-8A16,16,0,0,1,96,72V40a16,16,0,0,1,16-16h32a16,16,0,0,1,16,16V72a16,16,0,0,1-16,16h-8v24h96A8,8,0,0,1,240,120Z" fill="currentColor"/></g>',
     ];
 
-    $svg = $icons[$name] ?? '';
+    // 'danger' is the shield-alert glyph in the error color, for Danger Zone menu items.
+    $isDanger = $name === 'danger';
+    $svg = $icons[$isDanger ? 'shield-alert' : $name] ?? '';
 @endphp
 
-<svg {{ $attributes->merge(['class' => 'size-4']) }} viewBox="0 0 24 24" fill="none"
+<svg {{ $attributes->class(['size-4', 'text-error' => $isDanger]) }} viewBox="0 0 24 24" fill="none"
     xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
     {!! $svg !!}
 </svg>
diff --git a/resources/views/components/section-heading-link.blade.php b/resources/views/components/section-heading-link.blade.php
new file mode 100644
index 0000000000..ce5bdbfebe
--- /dev/null
+++ b/resources/views/components/section-heading-link.blade.php
@@ -0,0 +1,8 @@
+{{-- The "View all" link of x-section-heading (uses its $href, $actionLabel, and $icon). --}}
+<a href="{{ $href }}" {{ wireNavigate() }}
+    class="group inline-flex shrink-0 items-center gap-0.5 text-[11px] text-neutral-500 hover:text-black hover:underline dark:text-fg-faint dark:hover:text-fg">
+    {{ $actionLabel }}
+    @if ($icon)
+        <x-reicon :name="$icon" class="size-3 transition-transform duration-150 ease-out group-hover:translate-x-0.5" />
+    @endif
+</a>
diff --git a/resources/views/components/section-heading.blade.php b/resources/views/components/section-heading.blade.php
index 6872dc1a30..c96b40a7c7 100644
--- a/resources/views/components/section-heading.blade.php
+++ b/resources/views/components/section-heading.blade.php
@@ -3,29 +3,38 @@
     'subtitle' => null,
     'href' => null,
     'actionLabel' => 'View all',
-    'icon' => 'arrow-right',
+    'icon' => null,
 ])
 
 {{--
     Shared section heading: a 14px title, an optional 11px muted subtitle, and an
-    optional right-aligned action. Pass `href` for the default "View all"
-    button, or an `<x-slot:actions>` for a custom control.
+    optional action. Pass `href` for a small "View all" link and an
+    `<x-slot:actions>` for a right-aligned control; with both, the link sits
+    before the control, otherwise next to the title. `<x-slot:titleAction>`
+    puts a small control (such as a + button) right after the title.
 --}}
 <div {{ $attributes->merge(['class' => 'mb-3 min-w-0']) }}>
-    <div class="flex items-center justify-between gap-4">
-        <h2 class="min-w-0 truncate text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
-            {{ $title }}
-        </h2>
+    <div class="flex flex-wrap items-center justify-between gap-x-4 gap-y-2">
+        <div class="flex min-w-0 items-baseline gap-2">
+            <div class="flex min-w-0 items-center gap-1">
+                <h2 class="min-w-0 truncate text-[14px]! leading-5! font-semibold! text-black dark:text-fg">
+                    {{ $title }}
+                </h2>
+                @isset($titleAction)
+                    {{ $titleAction }}
+                @endisset
+            </div>
+            @if (filled($href) && ! isset($actions))
+                @include('components.section-heading-link')
+            @endif
+        </div>
         @isset($actions)
-            <div class="shrink-0">{{ $actions }}</div>
-        @elseif (filled($href))
-            <a href="{{ $href }}" {{ wireNavigate() }}
-                class="button group">
-                {{ $actionLabel }}
-                @if ($icon)
-                    <x-reicon :name="$icon" class="size-3 opacity-70 transition-transform duration-150 ease-out group-hover:translate-x-0.5" />
+            <div class="ml-auto flex shrink-0 items-center gap-3">
+                @if (filled($href))
+                    @include('components.section-heading-link')
                 @endif
-            </a>
+                {{ $actions }}
+            </div>
         @endisset
     </div>
     @if (filled($subtitle))
diff --git a/resources/views/components/security/settings-layout.blade.php b/resources/views/components/security/settings-layout.blade.php
index 809a8d32a1..3985e6b413 100644
--- a/resources/views/components/security/settings-layout.blade.php
+++ b/resources/views/components/security/settings-layout.blade.php
@@ -33,35 +33,20 @@
     ])->filter();
 @endphp
 
-<section class="application-settings-workspace w-full max-w-none">
+{{-- These pages are in the Keys & Tokens submenu of the main sidebar (components/navbar.blade.php). --}}
+<section class="w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Keys & Tokens</h1>
         <p class="settings-mobile-description">Manage SSH keys, cloud credentials, and API access tokens.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Keys & Tokens' => $securityMenuItems], [])) }}">
-            <nav aria-label="Keys and tokens"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                <div class="nav-section hidden xl:block">Keys & Tokens</div>
-                @foreach ($securityMenuItems as $menuItem)
-                    <a wire:key="security-settings-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            @isset($actions)
-                <div class="mb-3 flex min-h-8 flex-wrap items-center justify-end gap-2">
-                    {{ $actions }}
-                </div>
-            @endisset
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the Keys & Tokens pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Keys & Tokens' => $securityMenuItems], [])) }}"></div>
+    <div class="min-w-0">
+        @isset($actions)
+            <div class="mb-3 flex min-h-8 flex-wrap items-center justify-end gap-2">
+                {{ $actions }}
+            </div>
+        @endisset
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 02a854497b..5aae3d3ef4 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -77,7 +77,7 @@
         [
             'label' => 'Sentinel',
             'route' => 'server.sentinel',
-            'active' => request()->routeIs('server.sentinel', 'server.sentinel.*'),
+            'active' => $activeMenu === 'sentinel',
             'icon' => 'shield-star',
             'group' => 'Platform',
             'visible' => ! $server->isSwarm() && $server->canHostResources() && auth()->user()?->can('viewSentinel', $server),
@@ -85,8 +85,8 @@
             'warning' => $server->isSentinelEnabled() && $sentinelStatus === 'out_of_sync',
             'tracks_sentinel_status' => true,
             'children' => [
-                ['label' => 'Configuration', 'route' => 'server.sentinel', 'active' => request()->routeIs('server.sentinel'), 'icon' => 'settings'],
-                ['label' => 'Logs', 'route' => 'server.sentinel.logs', 'active' => request()->routeIs('server.sentinel.logs'), 'icon' => 'file-content'],
+                ['label' => 'Configuration', 'route' => 'server.sentinel', 'active' => $activeSubMenu === 'configuration', 'icon' => 'settings'],
+                ['label' => 'Logs', 'route' => 'server.sentinel.logs', 'active' => $activeSubMenu === 'logs', 'icon' => 'file-content'],
             ],
         ],
         [
@@ -182,13 +182,13 @@
         [
             'label' => 'Security',
             'route' => 'server.security.patches',
-            'active' => request()->routeIs('server.security.*'),
+            'active' => $activeMenu === 'security',
             'icon' => 'shield-alert',
             'group' => 'Security',
             'visible' => auth()->user()?->can('update', $server),
             'children' => [
-                ['label' => 'Server Patching', 'route' => 'server.security.patches', 'active' => request()->routeIs('server.security.patches'), 'icon' => 'bandage'],
-                ['label' => 'Terminal Access', 'route' => 'server.security.terminal-access', 'active' => request()->routeIs('server.security.terminal-access'), 'icon' => 'browser-terminal', 'navigate' => false],
+                ['label' => 'Server Patching', 'route' => 'server.security.patches', 'active' => $activeSubMenu === 'patches', 'icon' => 'bandage'],
+                ['label' => 'Terminal Access', 'route' => 'server.security.terminal-access', 'active' => $activeSubMenu === 'terminal-access', 'icon' => 'browser-terminal', 'navigate' => false],
             ],
         ],
         [
@@ -196,15 +196,16 @@
             'route' => 'server.transfer',
             'active' => $activeMenu === 'transfer',
             'icon' => 'arrow-right',
+            'beta' => true,
             'group' => 'Operations',
-            'visible' => isDev() && ! $server->isLocalhost() && auth()->user()?->can('view', $server),
+            'visible' => ! $server->isLocalhost() && auth()->user()?->can('update', $server),
         ],
         [
-            'label' => 'Danger',
+            'label' => 'Danger Zone',
             'route' => 'server.delete',
             'active' => $activeMenu === 'danger',
-            'icon' => 'shield-alert',
-            'group' => 'Danger zone',
+            'icon' => 'danger',
+            'group' => 'Danger Zone',
             // Coolify host (id 0) cannot be deleted. Other servers may still use
             // host.docker.internal (e.g. Lima VMs) and must keep the Danger menu.
             'visible' => ! $server->is_coolify_host,
@@ -215,16 +216,44 @@
         ->filter(fn (array $item): bool => $item['visible'] ?? true)
         ->values();
     $groupedServerMenuItems = $serverMenuItems->groupBy('group');
-
-    // Group that holds the current page (item or nested child) — always kept
-    // open, even if collapsed before.
-    $activeGroup = (string) $groupedServerMenuItems->search(fn ($items) => $items->contains(
-        fn ($item) => ($item['active'] ?? false)
-            || collect($item['children'] ?? [])->contains(fn ($child) => $child['active'] ?? false)
-    ));
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+@php
+    // The main sidebar shows this menu on wide screens (see components/navbar.blade.php).
+    registerMainNavContext(0, 'Servers', 'Back to the main menu');
+@endphp
+
+{{-- Rendered twice: in the page (below xl), and teleported into the main sidebar (xl and up).
+     Both copies keep their own warning state (proxy, Sentinel). --}}
+@foreach (['page', 'main-nav'] as $placement)
+@if ($placement === 'main-nav')
+@teleport('#main-nav-context-0')
+<div class="nav-context-menu"
+    x-data="{
+        proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
+        traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo()),
+        proxyNotRunning: @js($proxyNotRunning),
+        sentinelOutOfSync: @js($server->isSentinelEnabled() && $sentinelStatus === 'out_of_sync'),
+        sentinelExpiryTimer: null,
+        scheduleSentinelExpiry(delay) {
+            clearTimeout(this.sentinelExpiryTimer);
+            if (!this.sentinelOutOfSync) {
+                this.sentinelExpiryTimer = setTimeout(() => this.sentinelOutOfSync = true, delay);
+            }
+        }
+    }"
+    x-init="scheduleSentinelExpiry(@js($sentinelExpiresInMilliseconds))"
+    @proxy-configuration-state-changed.window="
+        proxyConfigurationPending = $event.detail.pending;
+        traefikOutdated = $event.detail.traefikOutdated;
+        proxyNotRunning = $event.detail.proxyNotRunning;
+    "
+    @sentinel-status-changed.window="
+        sentinelOutOfSync = $event.detail.outOfSync;
+        scheduleSentinelExpiry($event.detail.expiresInMilliseconds);
+    ">
+@else
+<aside class="application-settings-navigation in-main-nav min-w-0 xl:self-start"
     data-settings-search-items="{{ json_encode(settingsSearchItems($groupedServerMenuItems, $serverRouteParameters)) }}"
     x-data="{
         proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
@@ -249,27 +278,21 @@
         sentinelOutOfSync = $event.detail.outOfSync;
         scheduleSentinelExpiry($event.detail.expiresInMilliseconds);
     ">
+@endif
     <nav aria-label="Server configuration sections"
-        x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.server' })"
-        class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
+        @class([
+            'grid gap-0.5',
+            'grid-cols-2 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]' => $placement === 'page',
+            'grid-cols-1' => $placement === 'main-nav',
+        ])>
         @foreach ($groupedServerMenuItems as $groupLabel => $groupItems)
             @unless ($loop->first)
                 <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
                     aria-hidden="true"></div>
             @endunless
-            <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                :aria-expanded="isOpen(@js($groupLabel))">
-                <span>{{ $groupLabel }}</span>
-                <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                    :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                    stroke="currentColor" stroke-width="2" aria-hidden="true">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                </svg>
-            </button>
-            <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
             @foreach ($groupItems as $menuItem)
                 @if ($menuItem['disabled'] ?? false)
-                    <span wire:key="server-settings-link-{{ str($menuItem['label'])->slug() }}"
+                    <span wire:key="{{ $placement }}-server-settings-link-{{ str($menuItem['label'])->slug() }}"
                         class="menu-item cursor-not-allowed opacity-40" aria-disabled="true"
                         title="Validate the server connection first.">
                         <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
@@ -277,7 +300,7 @@
                     </span>
                     @continue
                 @endif
-                <a wire:key="server-settings-link-{{ str($menuItem['label'])->slug() }}"
+                <a wire:key="{{ $placement }}-server-settings-link-{{ str($menuItem['label'])->slug() }}"
                     @class([
                         'menu-item',
                         'menu-item-active' => $menuItem['active'],
@@ -303,7 +326,7 @@
                 @if ($menuItem['active'] && isset($menuItem['children']))
                     <div class="col-span-full grid grid-cols-2 gap-0.5 border-l border-neutral-200 pl-2 sm:grid-cols-3 xl:grid-cols-1 dark:border-white/[0.08]">
                         @foreach (collect($menuItem['children'])->filter(fn (array $child): bool => $child['visible'] ?? true) as $child)
-                            <a wire:key="server-settings-child-{{ str($menuItem['label'].'-'.$child['label'])->slug() }}"
+                            <a wire:key="{{ $placement }}-server-settings-child-{{ str($menuItem['label'].'-'.$child['label'])->slug() }}"
                                 @class(['menu-item', 'menu-item-active' => $child['active']])
                                 @if ($child['navigate'] ?? true) {{ wireNavigate() }} @endif
                                 href="{{ route($child['route'], $serverRouteParameters) }}">
@@ -314,7 +337,12 @@
                     </div>
                 @endif
             @endforeach
-            </div>
         @endforeach
     </nav>
+@if ($placement === 'main-nav')
+</div>
+@endteleport
+@else
 </aside>
+@endif
+@endforeach
diff --git a/resources/views/components/server/status-summary.blade.php b/resources/views/components/server/status-summary.blade.php
index ea2306397e..854c2525f8 100644
--- a/resources/views/components/server/status-summary.blade.php
+++ b/resources/views/components/server/status-summary.blade.php
@@ -47,8 +47,8 @@
         </span>
     </x-status-badge>
 
-    <div x-cloak x-show="open" x-transition.origin.top.right
-        class="listbox-panel top-8! right-0! left-auto! z-[90]! w-64! min-w-64!" role="menu">
+    <div x-cloak x-show="open" x-transition.origin.top.left
+        class="listbox-panel top-8! right-auto! left-0! z-[90]! w-64! min-w-64!" role="menu">
         <div class="flex items-center gap-1 px-3 py-2 text-[11px] font-medium text-neutral-400 dark:text-fg-faint">
             <span>System status</span>
             @if ($server->proxySet())
diff --git a/resources/views/components/service-database/sidebar.blade.php b/resources/views/components/service-database/sidebar.blade.php
index c101619109..b3af548d0b 100644
--- a/resources/views/components/service-database/sidebar.blade.php
+++ b/resources/views/components/service-database/sidebar.blade.php
@@ -3,11 +3,10 @@
     'serviceDatabase',
 ])
 
-<aside class="application-settings-navigation min-w-0 xl:self-start">
+<x-main-nav-menu :depth="1" back-label="Service" back-title="Back to the service menu">
     <nav aria-label="Compose resource settings"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        <div class="nav-section hidden xl:block">Compose resource</div>
-        <a class="menu-item" {{ wireNavigate() }}
+        <a class="menu-item" data-page-only {{ wireNavigate() }}
             href="{{ route('project.service.configuration', [...$parameters, 'stack_service_uuid' => null]) }}">
             <x-reicon name="logout" class="menu-item-icon rotate-180" />
             <span class="menu-item-label">Back to service</span>
@@ -19,4 +18,4 @@
             <span class="menu-item-label">General</span>
         </a>
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/components/service/configuration-sidebar.blade.php b/resources/views/components/service/configuration-sidebar.blade.php
index 24918e5315..5682c8c282 100644
--- a/resources/views/components/service/configuration-sidebar.blade.php
+++ b/resources/views/components/service/configuration-sidebar.blade.php
@@ -1,4 +1,4 @@
-@props(['service', 'currentRoute'])
+@props(['service', 'currentRoute', 'navOnly' => false, 'storageSections' => collect()])
 
 @php
     $serviceRouteParameters = [
@@ -16,12 +16,13 @@
         ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
         ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
+        ['label' => 'Files', 'route' => 'project.service.files', 'icon' => 'folder', 'visible' => auth()->user()?->can('canAccessTerminal')],
         ['label' => 'Analytics', 'route' => 'project.service.analytics', 'icon' => 'analytics'],
         ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
-        ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'notifications'],
+        ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'webhook'],
         ['label' => 'Resource Operations', 'route' => 'project.service.resource-operations', 'icon' => 'server-update'],
         ['label' => 'Tags', 'route' => 'project.service.tags', 'icon' => 'tags'],
-        ['label' => 'Danger Zone', 'route' => 'project.service.danger', 'icon' => 'shield-alert'],
+        ['label' => 'Danger Zone', 'route' => 'project.service.danger', 'icon' => 'danger'],
     ])->filter(fn (array $item): bool => $item['visible'] ?? true)
         ->map(fn (array $item): array => [
             ...$item,
@@ -36,9 +37,10 @@
 
     $menuGroups = [
         'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
-        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics'],
+        'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Files', 'Analytics'],
         'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
-        'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
+        'Operations' => ['Resource Operations', 'Tags'],
+        'Danger Zone' => ['Danger Zone'],
     ];
 
     $groupedItems = collect($menuGroups)
@@ -47,42 +49,43 @@
             ->filter()
             ->values())
         ->filter(fn ($items) => $items->isNotEmpty());
-
-    // Group that holds the current page — always kept open, even if collapsed before.
-    $activeGroup = (string) $groupedItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+<x-main-nav-menu back-label="Dashboard" :nav-only="$navOnly"
     data-settings-search-items="{{ json_encode(settingsSearchItems($groupedItems, $serviceRouteParameters)) }}">
     <nav aria-label="Service settings"
-        x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.service' })"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
         @foreach ($groupedItems as $groupLabel => $groupItems)
             @unless ($loop->first)
                 <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
             @endunless
-            <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                :aria-expanded="isOpen(@js($groupLabel))">
-                <span>{{ $groupLabel }}</span>
-                <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                    :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                    stroke="currentColor" stroke-width="2" aria-hidden="true">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                </svg>
-            </button>
-            <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
-                @foreach ($groupItems as $menuItem)
-                    <a @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                        href="{{ route($menuItem['route'], $serviceRouteParameters) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                        @if ($menuItem['hasWarning'] ?? false)
-                            <span class="ml-auto size-2 shrink-0 rounded-full bg-error" title="Required environment variables missing"></span>
-                        @endif
-                    </a>
-                @endforeach
-            </div>
+            @foreach ($groupItems as $menuItem)
+                <a @class(['menu-item', 'menu-item-active' => $menuItem['active']])
+                    @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
+                    href="{{ route($menuItem['route'], $serviceRouteParameters) }}">
+                    <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
+                    <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    @if ($menuItem['label'] === 'Files')
+                        <x-beta-badge class="ml-auto shrink-0" />
+                    @endif
+                    @if ($menuItem['hasWarning'] ?? false)
+                        <span class="ml-auto size-2 shrink-0 rounded-full bg-error" title="Required environment variables missing"></span>
+                    @endif
+                </a>
+                @if ($menuItem['active'] && $menuItem['route'] === 'project.service.storages' && $storageSections->isNotEmpty())
+                    <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
+                        x-data="{ activeSection: '' }">
+                        @foreach ($storageSections as $section)
+                            <button type="button" class="menu-subitem"
+                                :class="activeSection === '{{ $section['id'] }}' && 'menu-subitem-active'"
+                                @click="activeSection = '{{ $section['id'] }}'; window.scrollToSettingsSection?.('{{ $section['id'] }}')">
+                                <span class="menu-item-label truncate text-left"
+                                    title="{{ $section['label'] }}">{{ $section['label'] }}</span>
+                            </button>
+                        @endforeach
+                    </div>
+                @endif
+            @endforeach
         @endforeach
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/components/settings/layout.blade.php b/resources/views/components/settings/layout.blade.php
index 72aec39bb0..d8e4ae9f28 100644
--- a/resources/views/components/settings/layout.blade.php
+++ b/resources/views/components/settings/layout.blade.php
@@ -6,47 +6,28 @@
             ['label' => 'Updates', 'route' => 'settings.updates', 'icon' => 'refresh3'],
         ],
         'Instance' => [
-            ['label' => 'Backup', 'route' => 'settings.backup', 'icon' => 'database'],
-            ['label' => 'Email', 'route' => 'settings.email', 'icon' => 'mail'],
             ['label' => 'Authentication', 'route' => 'settings.oauth', 'icon' => 'keys'],
+            ['label' => 'Email', 'route' => 'settings.email', 'icon' => 'mail'],
+            ['label' => 'Backup', 'route' => 'settings.backup', 'icon' => 'database'],
         ],
     ];
 @endphp
 
+{{-- The pages are in the Settings submenu of the main sidebar (components/navbar.blade.php). --}}
 <section class="application-settings-workspace w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Instance Settings</h1>
         <p class="settings-mobile-description">Configure global settings for this Coolify instance.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems($settingsMenuSections, [])) }}">
-            <nav aria-label="Instance settings"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                @foreach ($settingsMenuSections as $section => $menuItems)
-                    <div @class([
-                        'nav-section col-span-full hidden xl:block',
-                        'mt-5 border-t border-neutral-200 pt-4 dark:border-white/[0.06]' => !$loop->first,
-                    ])>{{ $section }}</div>
-                    @foreach ($menuItems as $menuItem)
-                        <a wire:key="instance-settings-{{ str($menuItem['label'])->slug() }}"
-                            @class(['menu-item', 'menu-item-active' => request()->routeIs($menuItem['route'])])
-                            {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                            <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                            <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                        </a>
-                        @if ($menuItem['route'] === 'settings.oauth' && isset($submenu))
-                            <div class="col-span-full ml-5 border-l border-neutral-200 pl-2 dark:border-white/[0.08]">
-                                {{ $submenu }}
-                            </div>
-                        @endif
-                    @endforeach
-                @endforeach
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the settings pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems($settingsMenuSections, [])) }}"></div>
+    @isset($submenu)
+        {{-- Sub-items of the current page, under its entry in the main sidebar. --}}
+        @teleport('#main-nav-active-children')
+            <div>{{ $submenu }}</div>
+        @endteleport
+    @endisset
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/shared-variables/layout.blade.php b/resources/views/components/shared-variables/layout.blade.php
index eaac292b09..85e287f82c 100644
--- a/resources/views/components/shared-variables/layout.blade.php
+++ b/resources/views/components/shared-variables/layout.blade.php
@@ -4,11 +4,8 @@
         <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">Reusable environment variables across resources</p>
     </header>
 
-    <div class="grid min-w-0 gap-8 xl:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-10">
-        <x-shared-variables.sidebar />
-
-        <div class="min-w-0 xl:mt-3">
-            {{ $slot }}
-        </div>
+    <x-shared-variables.sidebar />
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/shared-variables/sidebar.blade.php b/resources/views/components/shared-variables/sidebar.blade.php
index 6088d3b367..4b36d07411 100644
--- a/resources/views/components/shared-variables/sidebar.blade.php
+++ b/resources/views/components/shared-variables/sidebar.blade.php
@@ -8,17 +8,6 @@
     ];
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
-    data-settings-search-items="{{ json_encode(settingsSearchItems(['Shared variables' => $sharedVariablesMenuItems], [])) }}">
-    <nav aria-label="Shared variables"
-        class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-5 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        @foreach ($sharedVariablesMenuItems as $menuItem)
-            <a wire:key="shared-variables-{{ str($menuItem['label'])->slug() }}"
-                @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-            </a>
-        @endforeach
-    </nav>
-</aside>
+{{-- The pages are in the Shared Variables submenu of the main sidebar (components/navbar.blade.php);
+     this only feeds the page search. --}}
+<div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Shared variables' => $sharedVariablesMenuItems], [])) }}"></div>
diff --git a/resources/views/components/shared-variables/view-controls.blade.php b/resources/views/components/shared-variables/view-controls.blade.php
index 4a1dcbc0a0..c0d7fe1445 100644
--- a/resources/views/components/shared-variables/view-controls.blade.php
+++ b/resources/views/components/shared-variables/view-controls.blade.php
@@ -13,19 +13,15 @@
         </button>
     </div>
 
-    <div
-        class="view-toggle w-fit">
-        <button type="button" @click="viewMode = 'list'; localStorage.setItem('{{ $storageKey }}', 'list')"
-            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-            :class="viewMode === 'list' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-            aria-label="List view" title="List view">
-            <x-reicon name="unordered-list" class="size-3.5" />
-        </button>
-        <button type="button" @click="viewMode = 'grid'; localStorage.setItem('{{ $storageKey }}', 'grid')"
-            class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-            :class="viewMode === 'grid' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-            aria-label="Grid view" title="Grid view">
-            <x-reicon name="grid" class="size-3.5" />
-        </button>
+    {{-- Only the view you can switch to, with its name (as components/canvas-view-toggle.blade.php). --}}
+    <div class="view-toggle w-fit">
+        @foreach (['list' => ['List view', 'unordered-list'], 'grid' => ['Grid view', 'grid']] as $mode => [$viewLabel, $icon])
+            <button type="button" @click="viewMode = '{{ $mode }}'; localStorage.setItem('{{ $storageKey }}', '{{ $mode }}')"
+                x-show="viewMode !== '{{ $mode }}'" x-cloak title="{{ $viewLabel }}"
+                class="relative flex h-7.5 items-center gap-1.5 rounded-md px-2.5 text-[12px] font-medium text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                <x-reicon :name="$icon" class="size-3.5" />
+                {{ $viewLabel }}
+            </button>
+        @endforeach
     </div>
 </div>
diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index e6bc1518f5..d3c9f3a453 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -17,6 +17,9 @@
         this.open = true;
         this.$nextTick(() => this.updatePosition());
     },
+    close() {
+        this.open = false;
+    },
     updatePosition() {
         const trigger = this.$refs.trigger.getBoundingClientRect();
         const panel = this.$refs.panel.getBoundingClientRect();
@@ -29,7 +32,7 @@
 
         this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px; min-width: 0;`;
     }
-}" @click.outside="open = false" @keydown.escape.window="open = false"
+}" @click.outside="close()" @keydown.escape.window="close()"
     x-on:resize.window="if (open) updatePosition()" x-on:scroll.window="if (open) updatePosition()">
     <div x-ref="trigger" @click="toggle()">
         {{ $trigger }}
diff --git a/resources/views/components/team/settings-layout.blade.php b/resources/views/components/team/settings-layout.blade.php
index 8ea7232ae6..af6e103489 100644
--- a/resources/views/components/team/settings-layout.blade.php
+++ b/resources/views/components/team/settings-layout.blade.php
@@ -28,41 +28,21 @@
             'label' => 'Danger Zone',
             'route' => 'team.danger-zone',
             'active' => request()->routeIs('team.danger-zone'),
-            'icon' => 'shield-alert',
+            'icon' => 'danger',
             'sectionStart' => true,
         ] : null,
     ])->filter();
 @endphp
 
-<section class="application-settings-workspace w-full max-w-none">
+{{-- The team pages are in the Team submenu of the main sidebar (components/navbar.blade.php). --}}
+<section class="w-full max-w-none">
     <header class="settings-mobile-header xl:hidden">
         <h1 class="settings-mobile-title">Team</h1>
         <p class="settings-mobile-description">Manage your team, members, and access settings.</p>
     </header>
-    <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <aside class="application-settings-navigation min-w-0 xl:self-start"
-            data-settings-search-items="{{ json_encode(settingsSearchItems(['Team' => $teamMenuItems], [])) }}">
-            <nav aria-label="Team settings"
-                class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                <div class="nav-section hidden xl:block">Team</div>
-                @foreach ($teamMenuItems as $menuItem)
-                    @if ($menuItem['sectionStart'] ?? false)
-                        <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
-                            aria-hidden="true"></div>
-                    @endif
-                    <a wire:key="team-settings-{{ str($menuItem['label'])->slug() }}"
-                        @class(['menu-item', 'menu-item-active' => $menuItem['active']])
-                        {{ wireNavigate() }} href="{{ route($menuItem['route']) }}">
-                        <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                        <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                    </a>
-                @endforeach
-
-            </nav>
-        </aside>
-
-        <div class="min-w-0">
-            {{ $slot }}
-        </div>
+    {{-- Feeds the page search with the team pages. --}}
+    <div hidden data-settings-search-items="{{ json_encode(settingsSearchItems(['Team' => $teamMenuItems], [])) }}"></div>
+    <div class="min-w-0">
+        {{ $slot }}
     </div>
 </section>
diff --git a/resources/views/components/theme-controls/picker.blade.php b/resources/views/components/theme-controls/picker.blade.php
index f4b1ede294..4f8dcc4537 100644
--- a/resources/views/components/theme-controls/picker.blade.php
+++ b/resources/views/components/theme-controls/picker.blade.php
@@ -19,7 +19,9 @@
     <label class="flex cursor-pointer items-center gap-2.5 rounded-lg border border-neutral-200 p-2 transition-colors hover:border-neutral-300 dark:border-white/[0.08] dark:hover:border-white/[0.14]">
         <span class="relative size-8 shrink-0 overflow-hidden rounded-md border border-black/10 shadow-sm dark:border-white/15">
             <span class="absolute inset-0" :style="`background: ${themeColor}`"></span>
-            <input type="color" :value="themeColor" @input="previewThemeColor($event.target.value)"
+            {{-- autocomplete="off": Firefox session restore otherwise replays this
+                 value with an input event and switches the theme to custom (#11813). --}}
+            <input type="color" autocomplete="off" :value="themeColor" @input="previewThemeColor($event.target.value)"
                 @change="saveThemeColor($event.target.value)" aria-label="Custom theme color"
                 class="absolute inset-0 h-full w-full cursor-pointer opacity-0" />
         </span>
diff --git a/resources/views/components/top-breadcrumb.blade.php b/resources/views/components/top-breadcrumb.blade.php
index d2751296dd..7d18f67b17 100644
--- a/resources/views/components/top-breadcrumb.blade.php
+++ b/resources/views/components/top-breadcrumb.blade.php
@@ -102,33 +102,6 @@
         request()->routeIs('admin.*') => 'Admin',
         default => null,
     };
-    // Workspace destinations require an active plan on cloud; unsubscribed users
-    // only keep profile/appearance and must not see this switcher.
-    $canUseWorkspaceNav = isSubscribed() || ! isCloud();
-    $pageDestinations = $canUseWorkspaceNav
-        ? collect([
-            ['label' => 'Dashboard', 'href' => url('/')],
-            ['label' => 'Projects', 'href' => url('/projects')],
-            auth()->user()?->can('canAccessTerminal')
-                ? ['label' => 'Terminal', 'href' => route('terminal')]
-                : null,
-            ['label' => 'Servers', 'href' => url('/servers')],
-            ['label' => 'Sources', 'href' => route('source.all')],
-            ['label' => 'Destinations', 'href' => route('destination.index')],
-            auth()->user()?->isAdmin()
-                ? ['label' => 'Registries', 'href' => route('registries.index')]
-                : null,
-            ['label' => 'S3 Storage', 'href' => route('storage.index')],
-            ['label' => 'Shared Variables', 'href' => route('shared-variables.index')],
-            ['label' => 'Team', 'href' => route('team.index')],
-            ['label' => 'Notifications', 'href' => route('notifications.email')],
-            ['label' => 'Keys & Tokens', 'href' => route('security.private-key.index')],
-            ['label' => 'Tags', 'href' => route('tags.show')],
-            isInstanceAdmin()
-                ? ['label' => 'Settings', 'href' => route('settings.index')]
-                : null,
-        ])->filter()
-        : collect();
 @endphp
 <div class="flex min-w-0 items-center gap-0.5 text-[13px]">
     {{-- Team --}}
@@ -136,33 +109,7 @@
         <livewire:switch-team />
     </div>
 
-    @if (!$currentProject && $dashboardContext && $canUseWorkspaceNav)
-        <span class="shrink-0 px-0.5 text-neutral-300 dark:text-fg-faint">/</span>
-        <div class="relative min-w-0 shrink" x-data="{ open: false }" @keydown.escape.window="open = false">
-            <button type="button" @click="open = !open" @click.outside="open = false" title="Switch page"
-                class="flex h-8 min-w-0 items-center gap-1.5 rounded-md px-2 opacity-70 transition-[background-color,opacity] hover:bg-neutral-100 hover:opacity-100 dark:hover:bg-white/[0.05]">
-                <span class="min-w-0 truncate font-semibold text-black dark:text-fg">{{ $dashboardContext }}</span>
-                <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24"
-                    fill="none">
-                    <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6"
-                        stroke-linecap="round" stroke-linejoin="round" />
-                </svg>
-            </button>
-            <div x-show="open" x-cloak x-transition.opacity.duration.120ms
-                class="listbox-panel scrollbar left-0! z-[90]! max-h-80! min-w-52">
-                <div class="px-2 py-1 text-[10px] font-semibold uppercase tracking-wide text-neutral-400 dark:text-fg-faint">
-                    Pages
-                </div>
-                @foreach ($pageDestinations as $destination)
-                    <a href="{{ $destination['href'] }}" {{ wireNavigate() }} @click="open = false"
-                        class="listbox-option {{ $destination['label'] === $dashboardContext ? 'bg-neutral-100 font-medium text-black dark:bg-white/[0.07] dark:text-fg' : '' }}">
-                        <span class="min-w-0 flex-1 truncate">{{ $destination['label'] }}</span>
-                    </a>
-                @endforeach
-            </div>
-        </div>
-    @elseif (!$currentProject && $dashboardContext)
-        {{-- Static context label only — no links to paid workspace pages. --}}
+    @if (!$currentProject && $dashboardContext)
         <span class="shrink-0 px-0.5 text-neutral-300 dark:text-fg-faint">/</span>
         <span
             class="flex h-8 min-w-0 items-center truncate px-2 font-semibold text-black opacity-70 dark:text-fg">{{ $dashboardContext }}</span>
@@ -247,7 +194,7 @@
         {{-- Project switcher --}}
         <div class="relative min-w-0 shrink" x-data="{ open: false }" @keydown.escape.window="open = false">
             <button type="button" @click="open = !open" @click.outside="open = false" title="Switch project"
-                class="flex items-center gap-1.5 min-w-0 h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
+                class="flex items-center gap-1.5 min-w-0 max-w-full h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
                 <span class="min-w-0 truncate font-semibold text-black dark:text-fg">{{ $currentProject->name }}</span>
                 <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24" fill="none">
                     <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" />
@@ -273,7 +220,7 @@
         {{-- Environment switcher --}}
         <div class="relative min-w-0 shrink" x-data="{ open: false }" @keydown.escape.window="open = false">
             <button type="button" @click="open = !open" @click.outside="open = false" title="Switch environment"
-                class="flex items-center gap-1.5 min-w-0 h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
+                class="flex items-center gap-1.5 min-w-0 max-w-full h-8 px-2 rounded-md opacity-70 transition-[background-color,opacity] hover:opacity-100 hover:bg-neutral-100 dark:hover:bg-white/[0.05]">
                 <span class="min-w-0 truncate font-semibold text-black dark:text-fg">{{ $currentEnvironment->name }}</span>
                 <svg class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" viewBox="0 0 24 24" fill="none">
                     <path d="M8 9l4-4 4 4M8 15l4 4 4-4" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" />
diff --git a/resources/views/components/top-user-menu.blade.php b/resources/views/components/top-user-menu.blade.php
index 1e1770a251..49f79e7b6a 100644
--- a/resources/views/components/top-user-menu.blade.php
+++ b/resources/views/components/top-user-menu.blade.php
@@ -21,7 +21,7 @@
     },
 }" @avatar-updated.window="avatarUrl = $event.detail.url" @keydown.escape.window="closePanel()"
     @click.outside="closePanel()">
-    <button type="button" @click="open ? closePanel() : openPanel()"
+    <button type="button" x-ref="userMenuButton" @click="open ? closePanel() : openPanel()"
         title="{{ $userName }}" aria-label="Account menu for {{ $userName }}"
         @if ($sidebar) :class="collapsed ? 'w-8 px-0' : 'w-full'" @endif
         @class([
@@ -44,7 +44,9 @@
         </svg>
     </button>
 
+    {{-- In the sidebar the panel is fixed to the button, so the scrolling sidebar does not clip it. --}}
     <div x-show="open" x-cloak
+        @if ($sidebar) x-anchor.top-start.fixed.offset.4="$refs.userMenuButton" @endif
         x-transition:enter="transition ease-out duration-150"
         x-transition:enter-start="opacity-0 scale-95" x-transition:enter-end="opacity-100 scale-100"
         x-transition:leave="transition ease-in duration-100"
@@ -52,7 +54,6 @@
         @class([
             'top-user-menu-panel listbox-panel z-[90]! max-h-none! w-52! min-w-0! overflow-visible!',
             'right-0! left-auto!' => ! $sidebar,
-            'bottom-full! left-0! right-auto! top-auto! mb-1!' => $sidebar,
             'origin-bottom-left' => $sidebar,
             'origin-top-right' => ! $sidebar,
         ])>
@@ -84,22 +85,6 @@
             <x-theme-controls variant="menu" />
         </div>
 
-        <button type="button" class="listbox-option w-full" @click="toggleAutoCollapse()"
-            :aria-pressed="autoCollapse" title="Collapse the sidebar on pages that have a settings menu">
-            <span class="flex items-center gap-2">
-                <svg class="size-4 opacity-80" viewBox="0 0 24 24" fill="none" aria-hidden="true">
-                    <rect x="3" y="5" width="18" height="14" rx="4" stroke="currentColor" stroke-width="1.6" />
-                    <path d="M16 9v6" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" />
-                </svg>
-                Auto-collapse sidebar
-            </span>
-            <svg x-show="autoCollapse" x-cloak class="size-4 shrink-0 text-black dark:text-fg" viewBox="0 0 24 24"
-                fill="none" aria-hidden="true">
-                <path d="M5 12l5 5L20 7" stroke="currentColor" stroke-width="2" stroke-linecap="round"
-                    stroke-linejoin="round" />
-            </svg>
-        </button>
-
         <div class="my-1 h-px bg-neutral-200 dark:bg-white/[0.07]"></div>
 
         <livewire:settings-dropdown trigger="account-menu" />
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index 256717db01..3b2a560974 100644
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -9,51 +9,22 @@
     @auth
         <div x-data="{
             open: false,
-            hasSidebarPreference: localStorage.getItem('sidebarCollapsed') !== null,
-            userCollapsed: localStorage.getItem('sidebarCollapsed') === 'true',
-            autoCollapse: localStorage.getItem('sidebarAutoCollapse') !== 'false',
-            hasSecondBar: false,
-            collapsed: false,
+            // New users start expanded.
+            collapsed: localStorage.getItem('sidebarCollapsed') === 'true',
             pageWidth: localStorage.getItem('pageWidth') || 'centered',
             sidebarReady: false,
             init() {
-                this.applyCollapsed(false);
                 this.$nextTick(() => {
                     requestAnimationFrame(() => {
                         this.sidebarReady = true;
                     });
                 });
             },
-            targetCollapsed() {
-                this.hasSecondBar = !!document.querySelector('.application-settings-navigation');
-                // New users start collapsed; auto-collapse still applies on pages with a settings menu.
-                const preferred = this.hasSidebarPreference ? this.userCollapsed : true;
-                return preferred || (this.autoCollapse && this.hasSecondBar);
-            },
-            applyCollapsed(animate) {
-                const target = this.targetCollapsed();
-                if (target === this.collapsed) return;
-                if (animate) {
-                    // Let the new page paint at the current width, then animate the
-                    // slide a frame later so the auto-collapse reads as a motion.
-                    this.sidebarReady = true;
-                    requestAnimationFrame(() => requestAnimationFrame(() => { this.collapsed = target; }));
-                } else {
-                    this.collapsed = target;
-                }
-            },
             toggleSidebar() {
                 this.collapsed = !this.collapsed;
-                this.hasSidebarPreference = true;
-                this.userCollapsed = this.collapsed;
-                localStorage.setItem('sidebarCollapsed', this.userCollapsed);
-            },
-            toggleAutoCollapse() {
-                this.autoCollapse = !this.autoCollapse;
-                localStorage.setItem('sidebarAutoCollapse', this.autoCollapse);
-                this.applyCollapsed(true);
+                localStorage.setItem('sidebarCollapsed', this.collapsed);
             }
-        }" @open-global-search.window="open = false" @page-width-changed.window="pageWidth = $event.detail" x-on:livewire:navigated.window="applyCollapsed(true)"
+        }" @open-global-search.window="open = false" @page-width-changed.window="pageWidth = $event.detail"
             :style="{ '--sidebar-w': collapsed ? '4rem' : '14rem' }" x-cloak
             @class(['app-shell dark:text-inherit text-black', 'flex h-dvh flex-col' => $fullBleed ?? false])>
             {{-- ============ DESKTOP TOP BAR ============ --}}
@@ -68,15 +39,15 @@
                 {{-- Brand (width tracks sidebar) --}}
                 <div class="flex items-center gap-2 h-full shrink-0 border-r border-neutral-200 dark:border-white/[0.06] transition-[width] duration-200"
                     :class="collapsed ? 'w-16 justify-center px-0' : 'w-56 px-4'">
-                    <div class="flex shrink-0 items-baseline gap-1.5 min-w-0">
+                    <div class="flex items-baseline gap-1.5 min-w-0">
                         <a href="/" {{ wireNavigate() }} title="Coolify"
-                            class="flex items-center hover:opacity-80 transition-opacity">
+                            class="flex shrink-0 items-center hover:opacity-80 transition-opacity">
                             <img x-show="collapsed" x-cloak src="/coolify-logo.svg" alt="Coolify"
                                 class="size-5" />
                             <span x-show="!collapsed" class="text-[15px] font-semibold tracking-tight text-black dark:text-white">Coolify</span>
                         </a>
-                        <x-version x-show="!collapsed"
-                            class="!text-[10.5px] font-medium text-neutral-400 dark:text-fg-faint !opacity-100 hover:!opacity-100 dark:hover:text-fg hover:text-black" />
+                        <x-version x-show="!collapsed" title="v{{ config('constants.coolify.version') }}"
+                            class="min-w-0 truncate !text-[10.5px] font-medium text-neutral-400 dark:text-fg-faint !opacity-100 hover:!opacity-100 dark:hover:text-fg hover:text-black" />
                     </div>
                     @if (isInstanceAdmin() && !isCloud())
                         <div x-show="!collapsed" class="ml-auto shrink-0">
@@ -98,6 +69,7 @@
                     {{-- Page toolbars (the canvases) dock here on desktop. --}}
                     <div id="page-toolbar-slot" class="flex shrink-0 items-center empty:hidden"></div>
                     <div id="configuration-warning-hud-slot" class="relative shrink-0"></div>
+                    <livewire:deployments-indicator variant="topbar" />
                     {{-- Resource actions dock here on desktop. --}}
                     <div id="resource-action-hud-slot" x-ref="resourceActions" class="hidden shrink-0 items-center xl:flex"></div>
                 </div>
@@ -149,8 +121,8 @@
             {{-- ============ DESKTOP SIDEBAR (below top bar) ============ --}}
             <div class="app-sidebar hidden lg:fixed lg:top-12 lg:bottom-0 lg:left-0 lg:z-40 lg:flex lg:flex-col min-w-0"
                 :class="[collapsed ? 'lg:w-16' : 'lg:w-56', sidebarReady ? 'transition-[width] duration-200' : '']">
-                <div class="flex grow min-w-0 flex-col overflow-visible">
-                    <x-navbar deployments-indicator />
+                <div class="flex min-h-0 grow min-w-0 flex-col overflow-visible">
+                    <x-navbar desktop />
                 </div>
             </div>
 
diff --git a/resources/views/livewire/analytics-placeholder.blade.php b/resources/views/livewire/analytics-placeholder.blade.php
index 767f0f46ac..e33bf19353 100644
--- a/resources/views/livewire/analytics-placeholder.blade.php
+++ b/resources/views/livewire/analytics-placeholder.blade.php
@@ -52,8 +52,16 @@
         <x-skeleton.table :rows="6" flush />
     </x-application.settings-section>
 
-    <x-application.settings-section id="analytics-country-section" title="Countries" flush>
-        <x-skeleton class="h-64 w-full" />
+    <x-application.settings-section id="analytics-country-section" title="Locations" flush>
+        <x-slot:actions>
+            <x-skeleton class="h-9 w-36 rounded-lg" />
+        </x-slot:actions>
+        <div class="grid grid-cols-1 items-start gap-4 p-4 lg:grid-cols-[2fr_3fr]">
+            <div class="flex items-center justify-center">
+                <x-skeleton class="aspect-square w-full max-w-[320px] rounded-full" />
+            </div>
+            <x-skeleton.table :rows="7" flush />
+        </div>
     </x-application.settings-section>
     @endif
 </div>
diff --git a/resources/views/livewire/analytics.blade.php b/resources/views/livewire/analytics.blade.php
index c326ac29d5..f383f56506 100644
--- a/resources/views/livewire/analytics.blade.php
+++ b/resources/views/livewire/analytics.blade.php
@@ -254,14 +254,15 @@ $appListboxOptions = array_merge(
                             icon-name="unordered-list" />
                     @else
                         @php $maxAppRequests = max(1, (int) collect($topApps)->max('requests')); @endphp
-                        <div x-data="{ page: 0, per: 10, total: {{ count($topApps) }} }">
-                            <div class="flex items-center gap-3 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:border-white/[0.07] dark:text-fg-dim">
-                                <span class="min-w-0 flex-1">Application / service</span>
-                                <span class="hidden w-16 shrink-0 text-right sm:inline" title="Request volume relative to the busiest row in this list">Volume</span>
-                                <span class="w-16 shrink-0 text-right">Requests</span>
-                                <span class="hidden w-16 shrink-0 text-right sm:inline" title="Total response data sent">Bandwidth</span>
+                        <div x-data="trafficTable()">
+                            <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+                                @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Application / service', 'text' => true, 'class' => 'min-w-0 flex-1'])
+                                <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+                                @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+                                @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
                                 <span class="size-3.5 shrink-0" aria-hidden="true"></span>
                             </div>
+                            <div class="flex flex-col">
                             @foreach ($topApps as $row)
                                 @php
                                     $appHref = $row['link'] ?? null;
@@ -269,11 +270,9 @@ $appListboxOptions = array_merge(
                                 @endphp
                                 <{{ $appHref ? 'a' : 'div' }} wire:key="analytics-app-{{ $row['uuid'] }}"
                                     @if ($appHref) href="{{ $appHref }}" {{ wireNavigate() }} @endif
-                                    x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                                    @class([
-                                        'flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]',
-                                        'transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.03]' => $appHref,
-                                    ])>
+                                    data-row="{{ json_encode(['name' => (string) $row['name'], 'requests' => (int) $row['requests'], 'bytesOut' => (int) $row['bandwidth']]) }}"
+                                    x-show="shown($el)"
+                                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
                                     <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
                                         <span class="truncate text-[12px] text-black dark:text-fg">{{ $row['name'] }}</span>
                                         @if (! empty($row['isService']))
@@ -299,6 +298,7 @@ $appListboxOptions = array_merge(
                                     @endif
                                 </{{ $appHref ? 'a' : 'div' }}>
                             @endforeach
+                            </div>
                             @include('livewire.traffic._pager')
                         </div>
                     @endif
@@ -312,14 +312,12 @@ $appListboxOptions = array_merge(
             @include('livewire.traffic._paths-list', ['paths' => $topPaths])
         </x-application.settings-section>
 
-        {{-- Countries --}}
-        <x-application.settings-section id="analytics-country-section" title="Countries"
-            helper="Request volume by visitor country for the selected range." flush>
-            @include('livewire.traffic._geo', [
-                'countries' => data_get($breakdowns, 'country', []),
-                'attribution' => $attribution,
-            ])
-        </x-application.settings-section>
+        {{-- Locations (countries and cities) --}}
+        @include('livewire.traffic._geo', [
+            'countries' => data_get($breakdowns, 'country', []),
+            'cities' => trafficCityRows(data_get($breakdowns, 'city', [])),
+            'attribution' => $attribution,
+        ])
 
         {{-- Requests by device type (donut) + HTTP versions / cache / status. --}}
         <div class="grid grid-cols-1 gap-6 lg:grid-cols-2">
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index 5de545df33..352060701a 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -12,6 +12,38 @@
         $dashboardProjects = $projects->sortBy('name', SORT_NATURAL)->take($dashboardItemLimit);
         $dashboardServers = $servers->sortBy('name', SORT_NATURAL)->take($dashboardItemLimit);
         $hasTrafficAnalytics = $servers->contains(fn ($server) => $server->isTrafficAnalyticsEnabled());
+        $projectResourceCounts = $dashboardProjects->mapWithKeys(fn ($project) => [$project->id => collect([
+            $project->applications_count,
+            $project->services_count,
+            $project->postgresqls_count,
+            $project->redis_count,
+            $project->keydbs_count,
+            $project->dragonflies_count,
+            $project->clickhouses_count,
+            $project->mongodbs_count,
+            $project->mysqls_count,
+            $project->mariadbs_count,
+            $project->sqlites_count,
+        ])->sum()]);
+        $serverStatuses = $dashboardServers->mapWithKeys(function ($server) {
+            $proxyNeedsAttention = $server->proxySet() && ($server->proxy->status !== 'running' || $server->hasCurrentTraefikOutdatedInfo());
+            $sentinelNeedsAttention = $server->isSentinelEnabled() && $server->sentinelStatus() === 'out_of_sync';
+
+            return [$server->id => match (true) {
+                $server->settings->force_disabled => ['Disabled', 'error'],
+                ! $server->settings->is_reachable && ! $server->settings->is_usable => ['Unavailable', 'error'],
+                ! $server->settings->is_reachable => ['Unreachable', 'error'],
+                ! $server->settings->is_usable => ['Not ready', 'warning'],
+                $proxyNeedsAttention || $sentinelNeedsAttention => ['Attention required', 'warning'],
+                default => ['Ready', 'success'],
+            }];
+        });
+        $iconButton = 'flex size-6.5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg';
+        // Same look as $iconButton, sized to the 20px section title it sits next to.
+        $titleIconButton = 'flex size-5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg';
+        $tableShell = 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]';
+        $tableHead = 'border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint';
+        $tableRow = 'min-h-14 items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.025]';
     @endphp
 
     <div class="flex min-w-0 flex-col gap-8">
@@ -32,38 +64,59 @@
             </div>
         @endif
 
+        {{-- Wide screens: activity takes the left third, projects and servers the other two thirds.
+             It stays one column while the left side has no section (no deployments, no traffic). --}}
+        <div class="grid min-w-0 gap-8 xl:items-start xl:has-[.dashboard-activity_section]:grid-cols-[minmax(0,1fr)_minmax(0,2fr)]">
+        <div class="dashboard-activity hidden min-w-0 has-[section]:flex flex-col gap-8">
         <livewire:dashboard.active-deployments />
 
         @if ($hasTrafficAnalytics)
             <livewire:dashboard.traffic-analytics />
         @endif
+        </div>
 
-        <section class="mb-0! min-w-0">
-            <x-section-heading title="Projects" subtitle="Your deployment workspaces"
-                :href="route('project.index')" />
+        <div class="flex min-w-0 flex-col gap-8">
+        <section class="@container mb-0! min-w-0" x-data="{
+            viewMode: @js($this->listView('dashboard_projects', 'table')),
+            setViewMode(mode) {
+                this.viewMode = mode;
+                $wire.saveListView('dashboard_projects', mode);
+            }
+        }">
+            <x-section-heading title="Projects"
+                :href="$projects->count() > $dashboardItemLimit ? route('project.index') : null">
+                {{-- Projects has no sidebar entry, so the dashboard is where new projects start. --}}
+                @can('createAnyResource')
+                    <x-slot:titleAction>
+                        <x-modal-input title="New Project">
+                            <x-slot:content>
+                                <button type="button" class="{{ $titleIconButton }}" title="New project"
+                                    aria-label="New project">
+                                    <x-reicon name="plus" class="size-3" />
+                                </button>
+                            </x-slot:content>
+                            <livewire:project.add-empty />
+                        </x-modal-input>
+                    </x-slot:titleAction>
+                @endcan
+                {{-- The dashboard canvas link lives here, so it never adds a row above the page. --}}
+                <x-slot:actions>
+                    <x-canvas-view-toggle :views="$dashboardProjects->isNotEmpty() ? null : []"
+                        :list-url="route('dashboard')" :canvas-url="route('dashboard.canvas')" />
+                </x-slot:actions>
+            </x-section-heading>
 
             @if ($dashboardProjects->isEmpty())
                 <x-empty title="No projects yet"
-                    description="Create your first deployment workspace from Projects."
+                    description="Create your first deployment workspace."
                     icon-name="projects" size="sm" />
             @else
-                <div class="grid min-w-0 grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                <div x-cloak x-show="viewMode === 'grid'"
+                    class="grid min-w-0 grid-cols-1 gap-3 @lg:grid-cols-2 @4xl:grid-cols-4">
                     @foreach ($dashboardProjects as $project)
                         @php
                             $firstEnvironment = $project->environments->first();
-                            $resourceCount = collect([
-                                $project->applications_count,
-                                $project->services_count,
-                                $project->postgresqls_count,
-                                $project->redis_count,
-                                $project->keydbs_count,
-                                $project->dragonflies_count,
-                                $project->clickhouses_count,
-                                $project->mongodbs_count,
-                                $project->mysqls_count,
-                                $project->mariadbs_count,
-                                $project->sqlites_count,
-                            ])->sum();
+                            $resourceCount = $projectResourceCounts[$project->id];
                         @endphp
 
                         <article
@@ -118,7 +171,7 @@
                                                 'environment_uuid' => $firstEnvironment->uuid,
                                             ]) }}"
                                                 {{ wireNavigate() }}
-                                                class="flex size-6.5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                                                class="{{ $iconButton }}"
                                                 title="Add resource"
                                                 aria-label="Add resource to {{ $project->name }}">
                                                 <x-reicon name="plus" class="size-3" />
@@ -128,7 +181,7 @@
                                     @can('update', $project)
                                         <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
                                             {{ wireNavigate() }}
-                                            class="flex size-6.5 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                                            class="{{ $iconButton }}"
                                             title="Project settings"
                                             aria-label="Open settings for {{ $project->name }}">
                                             <x-reicon name="settings" class="size-3" />
@@ -139,12 +192,101 @@
                         </article>
                     @endforeach
                 </div>
+
+                <div x-show="viewMode === 'table'" class="{{ $tableShell }}">
+                    <div class="grid grid-cols-[minmax(0,1fr)_7rem_4rem] gap-4 @2xl:min-w-[560px] @2xl:grid-cols-[minmax(0,1.2fr)_7rem_minmax(0,1.5fr)_4rem] {{ $tableHead }}">
+                        <div>Project</div>
+                        <div>Contents</div>
+                        <div class="hidden @2xl:block">Description</div>
+                        <div></div>
+                    </div>
+                    @foreach ($dashboardProjects as $project)
+                        @php
+                            $firstEnvironment = $project->environments->first();
+                        @endphp
+                        <div wire:key="dashboard-project-row-{{ $project->uuid }}"
+                            class="relative grid grid-cols-[minmax(0,1fr)_7rem_4rem] gap-4 @2xl:min-w-[560px] @2xl:grid-cols-[minmax(0,1.2fr)_7rem_minmax(0,1.5fr)_4rem] {{ $tableRow }}">
+                            <a href="{{ $project->navigateTo() }}" {{ wireNavigate() }}
+                                class="absolute inset-0" aria-label="Open {{ $project->name }}"></a>
+                            <div class="flex min-w-0 items-center gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.035] dark:text-fg-dim">
+                                    @if ($project->icon_path)
+                                        <img src="{{ project_icon_url($project) }}" alt="{{ $project->name }} icon"
+                                            class="h-full w-full rounded-lg object-cover">
+                                    @else
+                                        <x-reicon name="projects" class="size-4" />
+                                    @endif
+                                </div>
+                                <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
+                                    {{ $project->name }}
+                                </p>
+                            </div>
+                            <div class="relative z-10 flex w-fit items-center gap-3 font-medium text-neutral-600 dark:text-fg-dim">
+                                <span class="inline-flex items-center gap-1" data-tooltip="Environments"
+                                    aria-label="Environments">
+                                    <x-reicon name="layers" class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+                                    {{ $project->environments->count() }}
+                                </span>
+                                <span class="inline-flex items-center gap-1" data-tooltip="Resources"
+                                    aria-label="Resources">
+                                    <x-reicon name="grid" class="size-3.5 text-neutral-400 dark:text-fg-faint" />
+                                    {{ $projectResourceCounts[$project->id] }}
+                                </span>
+                            </div>
+                            <p class="hidden truncate text-neutral-500 @2xl:block dark:text-fg-dim">
+                                {{ filled($project->description) ? $project->description : '-' }}
+                            </p>
+                            <div class="relative z-10 flex items-center justify-end gap-0.5">
+                                @if ($firstEnvironment)
+                                    @can('createAnyResource')
+                                        <a href="{{ route('project.resource.create', [
+                                            'project_uuid' => $project->uuid,
+                                            'environment_uuid' => $firstEnvironment->uuid,
+                                        ]) }}"
+                                            {{ wireNavigate() }} class="{{ $iconButton }}" title="Add resource"
+                                            aria-label="Add resource to {{ $project->name }}">
+                                            <x-reicon name="plus" class="size-3" />
+                                        </a>
+                                    @endcan
+                                @endif
+                                @can('update', $project)
+                                    <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
+                                        {{ wireNavigate() }} class="{{ $iconButton }}" title="Project settings"
+                                        aria-label="Open settings for {{ $project->name }}">
+                                        <x-reicon name="settings" class="size-3" />
+                                    </a>
+                                @endcan
+                            </div>
+                        </div>
+                    @endforeach
+                </div>
             @endif
         </section>
 
-        <section class="mb-0! min-w-0">
-            <x-section-heading title="Servers" subtitle="Infrastructure available for deployments"
-                :href="route('server.index')" />
+        <section class="@container mb-0! min-w-0" x-data="{
+            viewMode: @js($this->listView('dashboard_servers', 'table')),
+            setViewMode(mode) {
+                this.viewMode = mode;
+                $wire.saveListView('dashboard_servers', mode);
+            }
+        }">
+            <x-section-heading title="Servers"
+                :href="$servers->count() > $dashboardItemLimit ? route('server.index') : null">
+                @can('createAnyResource')
+                    <x-slot:titleAction>
+                        <a href="{{ route('server.create') }}" {{ wireNavigate() }} class="{{ $titleIconButton }}"
+                            title="New server" aria-label="New server">
+                            <x-reicon name="plus" class="size-3" />
+                        </a>
+                    </x-slot:titleAction>
+                @endcan
+                @if ($dashboardServers->isNotEmpty())
+                    <x-slot:actions>
+                        <x-canvas-view-toggle />
+                    </x-slot:actions>
+                @endif
+            </x-section-heading>
 
             @if ($dashboardServers->isEmpty())
                 @if ($privateKeys->isEmpty())
@@ -177,20 +319,11 @@
                     </x-empty>
                 @endif
             @else
-                <div class="grid min-w-0 grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                <div x-cloak x-show="viewMode === 'grid'"
+                    class="grid min-w-0 grid-cols-1 gap-3 @lg:grid-cols-2 @4xl:grid-cols-4">
                     @foreach ($dashboardServers as $server)
                         @php
-                            $proxyNeedsAttention = $server->proxySet() && ($server->proxy->status !== 'running' || $server->hasCurrentTraefikOutdatedInfo());
-                            $sentinelNeedsAttention = $server->isSentinelEnabled() && $server->sentinelStatus() === 'out_of_sync';
-
-                            [$serverStatus, $serverStatusType] = match (true) {
-                                $server->settings->force_disabled => ['Disabled', 'error'],
-                                ! $server->settings->is_reachable && ! $server->settings->is_usable => ['Unavailable', 'error'],
-                                ! $server->settings->is_reachable => ['Unreachable', 'error'],
-                                ! $server->settings->is_usable => ['Not ready', 'warning'],
-                                $proxyNeedsAttention || $sentinelNeedsAttention => ['Attention required', 'warning'],
-                                default => ['Ready', 'success'],
-                            };
+                            [$serverStatus, $serverStatusType] = $serverStatuses[$server->id];
                         @endphp
 
                         <a href="{{ route('server.show', ['server_uuid' => $server->uuid]) }}"
@@ -232,7 +365,46 @@
                         </a>
                     @endforeach
                 </div>
+                <div x-show="viewMode === 'table'" class="{{ $tableShell }}">
+                    <div class="grid grid-cols-[minmax(0,1fr)_9.5rem] gap-4 @2xl:min-w-[480px] @2xl:grid-cols-[minmax(0,1fr)_minmax(0,1.5fr)_9.5rem] {{ $tableHead }}">
+                        <div>Server</div>
+                        <div class="hidden @2xl:block">Description</div>
+                        <div>Status</div>
+                    </div>
+                    @foreach ($dashboardServers as $server)
+                        @php
+                            [$serverStatus, $serverStatusType] = $serverStatuses[$server->id];
+                        @endphp
+                        <a href="{{ route('server.show', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}
+                            wire:key="dashboard-server-row-{{ $server->uuid }}"
+                            class="grid grid-cols-[minmax(0,1fr)_9.5rem] gap-4 @2xl:min-w-[480px] @2xl:grid-cols-[minmax(0,1fr)_minmax(0,1.5fr)_9.5rem] hover:no-underline {{ $tableRow }}">
+                            <div class="flex min-w-0 items-center gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.035] dark:text-fg-dim">
+                                    <x-reicon name="servers" class="size-4" />
+                                </div>
+                                <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
+                                    {{ $server->name }}
+                                </p>
+                            </div>
+                            <p class="hidden truncate text-neutral-500 @2xl:block dark:text-fg-dim">
+                                {{ filled($server->description) ? $server->description : '-' }}
+                            </p>
+                            <div class="flex items-center gap-2 text-[11px] font-medium text-neutral-600 dark:text-fg-dim">
+                                <span @class([
+                                    'size-2 shrink-0 rounded-full',
+                                    'bg-green-500 dark:bg-green-400' => $serverStatusType === 'success',
+                                    'bg-orange-500 dark:bg-warning' => $serverStatusType === 'warning',
+                                    'bg-red-500 dark:bg-red-400' => $serverStatusType === 'error',
+                                ])></span>
+                                {{ $serverStatus }}
+                            </div>
+                        </a>
+                    @endforeach
+                </div>
             @endif
         </section>
+        </div>
+        </div>
     </div>
 </div>
diff --git a/resources/views/livewire/dashboard/active-deployments.blade.php b/resources/views/livewire/dashboard/active-deployments.blade.php
index cea0489a20..7d2e88b2ff 100644
--- a/resources/views/livewire/dashboard/active-deployments.blade.php
+++ b/resources/views/livewire/dashboard/active-deployments.blade.php
@@ -24,10 +24,11 @@
     $hasAnyDeployments = $hasActiveDeployments || $hasRecentDeployments;
 @endphp
 
-<div wire:poll.3000ms="refreshDeployments" @class(['mb-0! min-w-0' => $hasAnyDeployments, 'hidden' => ! $hasAnyDeployments])>
+<div wire:poll.3000ms="refreshDeployments" @class(['min-w-0', 'mb-0!' => $hasAnyDeployments, 'hidden' => ! $hasAnyDeployments])>
     @if ($hasAnyDeployments)
-        <section class="mb-0! min-w-0">
-            <x-section-heading title="Deployments" subtitle="Active and recent deployment activity" />
+        {{-- Container breakpoints: the table needs room, which the dashboard column may not have. --}}
+        <section class="@container mb-0! min-w-0">
+            <x-section-heading title="Deployments" />
 
             <div class="flex min-w-0 flex-col gap-4">
                 @if ($hasActiveDeployments)
@@ -43,7 +44,7 @@
                         </div>
 
                         <div
-                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 @2xl:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <span>Application</span>
                             <span>Environment</span>
                             <span>Server</span>
@@ -61,7 +62,7 @@
 
                             <a wire:key="dashboard-active-deployment-{{ $deployment->deployment_uuid }}"
                                 href="{{ $deployment->deployment_url }}" {{ wireNavigate() }}
-                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 md:grid md:items-center md:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
+                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 @2xl:grid @2xl:items-center @2xl:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
                                 <div class="min-w-0">
                                     <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
                                         {{ $deployment->application_name }}
@@ -73,20 +74,20 @@
                                     @endif
                                 </div>
 
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $environmentPath ?: '-' }}
                                 </p>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->server_name ?: '-' }}
                                 </p>
-                                <span class="hidden md:block">
+                                <span class="hidden @2xl:block">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                 </span>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->created_at?->diffForHumans() ?? '-' }}
                                 </p>
 
-                                <div class="mt-3 flex min-w-0 items-center gap-3 md:hidden">
+                                <div class="mt-3 flex min-w-0 items-center gap-3 @2xl:hidden">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                     <p class="min-w-0 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
                                         {{ $environmentPath ?: '-' }}
@@ -112,7 +113,7 @@
                         </div>
 
                         <div
-                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 md:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
+                            class="dashboard-deployment-table-grid hidden items-center gap-4 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 @2xl:grid dark:border-white/[0.08] dark:bg-white/[0.05] dark:text-fg-faint">
                             <span>Application</span>
                             <span>Environment</span>
                             <span>Server</span>
@@ -130,7 +131,7 @@
 
                             <a wire:key="dashboard-recent-deployment-{{ $deployment->deployment_uuid }}"
                                 href="{{ $deployment->deployment_url }}" {{ wireNavigate() }}
-                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 md:grid md:items-center md:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
+                                class="dashboard-deployment-table-grid group block border-b border-neutral-200 px-4 py-3 transition-colors last:border-b-0 hover:bg-neutral-50 focus-visible:z-10 focus-visible:bg-warning/10 focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-warning focus-visible:ring-offset-0 @2xl:grid @2xl:items-center @2xl:gap-4 dark:border-white/[0.08] dark:hover:bg-white/[0.025] dark:focus-visible:bg-warning/10">
                                 <div class="min-w-0">
                                     <p class="truncate text-[13px] font-semibold text-black dark:text-fg">
                                         {{ $deployment->application_name }}
@@ -142,20 +143,20 @@
                                     @endif
                                 </div>
 
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $environmentPath ?: '-' }}
                                 </p>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->server_name ?: '-' }}
                                 </p>
-                                <span class="hidden md:block">
+                                <span class="hidden @2xl:block">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                 </span>
-                                <p class="hidden truncate text-[12px] text-neutral-500 md:block dark:text-fg-dim">
+                                <p class="hidden truncate text-[12px] text-neutral-500 @2xl:block dark:text-fg-dim">
                                     {{ $deployment->created_at?->diffForHumans() ?? '-' }}
                                 </p>
 
-                                <div class="mt-3 flex min-w-0 items-center gap-3 md:hidden">
+                                <div class="mt-3 flex min-w-0 items-center gap-3 @2xl:hidden">
                                     <x-status-badge :status="$deploymentStatus" :type="$deploymentStatusType" />
                                     <p class="min-w-0 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
                                         {{ $environmentPath ?: '-' }}
diff --git a/resources/views/livewire/dashboard/canvas.blade.php b/resources/views/livewire/dashboard/canvas.blade.php
new file mode 100644
index 0000000000..f943859ecc
--- /dev/null
+++ b/resources/views/livewire/dashboard/canvas.blade.php
@@ -0,0 +1,14 @@
+<div class="flex h-full flex-col">
+    <x-slot:title>
+        Dashboard > Canvas | Coolify
+    </x-slot>
+    {{-- data-poll: deployments start without a broadcast event, so the canvas reloads while it is open. --}}
+    <div data-environment-canvas data-endpoint="/dashboard/canvas" data-poll="5"
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}" class="relative min-h-0 flex-1" wire:ignore>
+        {{-- The canvas moves this group into its toolbar. --}}
+        <div data-ec-views class="flex items-center gap-2">
+            <x-canvas-view-toggle on-canvas :views="['list' => ['List view', 'unordered-list']]"
+                :list-url="route('dashboard')" :canvas-url="route('dashboard.canvas')" />
+        </div>
+    </div>
+</div>
diff --git a/resources/views/livewire/deployments-indicator.blade.php b/resources/views/livewire/deployments-indicator.blade.php
index 95967096ba..ff1927e6aa 100644
--- a/resources/views/livewire/deployments-indicator.blade.php
+++ b/resources/views/livewire/deployments-indicator.blade.php
@@ -1,18 +1,19 @@
-{{-- Rendered twice: in the desktop sidebar footer and in the mobile top bar. `.visible` pauses
+{{-- Rendered twice: in the desktop top bar and in the mobile top bar. `.visible` pauses
      polling for the copy hidden by the current breakpoint (a display:none element has no box). --}}
 <div wire:poll.3000ms.visible x-data="{ expanded: false }" x-on:click.outside="expanded = false"
-    x-on:keydown.escape.window="expanded = false" @class(['relative' => $variant === 'sidebar'])>
-    @if ($this->deploymentCount > 0)
+    x-on:keydown.escape.window="expanded = false" @class(['relative' => $variant === 'topbar'])>
+    @if ($this->deploymentCount > 0 && ! $this->isOnlyCurrentApplicationDeploying)
         @php
             $deploymentLabel = $this->deploymentCount.' '.Str::plural('deployment', $this->deploymentCount);
         @endphp
-        {{-- Deployment list: opens beside the sidebar on desktop. On mobile the root is not positioned,
-             so the list anchors to the sticky top bar and spans its width. --}}
+        {{-- Deployment list: on desktop it opens below the button, aligned to its right edge.
+             On mobile the root is not positioned, so the list anchors to the sticky top bar
+             and spans its width. --}}
         <div x-show="expanded" x-cloak x-transition.opacity.duration.150ms
             @class([
-                'surface-popover absolute z-60 overflow-hidden rounded-xl',
-                'bottom-0 left-full ml-5 w-[22rem]' => $variant === 'sidebar',
-                'inset-x-4 top-full mt-2' => $variant === 'mobile',
+                'surface-popover absolute top-full z-60 mt-2 overflow-hidden rounded-xl',
+                'right-0 w-[22rem]' => $variant === 'topbar',
+                'inset-x-4' => $variant === 'mobile',
             ])>
             <div class="max-h-96 space-y-1 overflow-y-auto p-2 scrollbar">
                 @foreach ($this->deployments as $deployment)
@@ -69,38 +70,18 @@
                 @endforeach
             </div>
         </div>
-
-        @if ($variant === 'sidebar')
-            <button type="button" x-on:click="expanded = !expanded" title="{{ $deploymentLabel }}"
-                aria-label="Active deployments" :aria-expanded="expanded.toString()"
-                class="menu-item w-full text-left text-coollabs dark:text-warning"
-                :class="[collapsed && 'lg:justify-center lg:px-0', expanded && 'menu-item-active']">
-                <span class="relative inline-flex">
-                    <svg class="menu-item-icon animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                        aria-hidden="true">
-                        <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-                        <path class="opacity-75" fill="currentColor"
-                            d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z">
-                        </path>
-                    </svg>
-                    <span x-show="collapsed" x-cloak
-                        class="absolute -right-1.5 -top-1.5 flex min-w-3.5 items-center justify-center rounded-full bg-coollabs px-1 text-[9px] font-semibold leading-3.5 text-white dark:bg-warning dark:text-black">{{ $this->deploymentCount }}</span>
-                </span>
-                <span class="menu-item-label" :class="collapsed && 'lg:hidden'">{{ $deploymentLabel }}</span>
-            </button>
-        @else
-            <button type="button" x-on:click="expanded = !expanded" title="{{ $deploymentLabel }}"
-                aria-label="Active deployments" :aria-expanded="expanded.toString()"
-                class="flex h-9 items-center gap-1.5 rounded-md px-2 text-[13px] font-medium text-coollabs transition-colors hover:bg-neutral-100 dark:text-warning dark:hover:bg-white/[0.06]">
-                <svg class="size-3.5 shrink-0 animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                    aria-hidden="true">
-                    <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-                    <path class="opacity-75" fill="currentColor"
-                        d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z">
-                    </path>
-                </svg>
-                <span>{{ $this->deploymentCount }}</span>
-            </button>
-        @endif
+        <button type="button" x-on:click="expanded = !expanded" title="{{ $deploymentLabel }}"
+            aria-label="Active deployments" :aria-expanded="expanded.toString()"
+            :class="expanded && 'bg-neutral-100 dark:bg-white/[0.06]'"
+            class="flex h-9 items-center gap-1.5 rounded-md px-2 text-[13px] font-medium text-coollabs transition-colors hover:bg-neutral-100 dark:text-warning dark:hover:bg-white/[0.06]">
+            <svg class="size-3.5 shrink-0 animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
+                aria-hidden="true">
+                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+                <path class="opacity-75" fill="currentColor"
+                    d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z">
+                </path>
+            </svg>
+            <span>{{ $this->deploymentCount }}</span>
+        </button>
     @endif
 </div>
diff --git a/resources/views/livewire/destination/index.blade.php b/resources/views/livewire/destination/index.blade.php
index c5c97a4d0e..e9d1a46341 100644
--- a/resources/views/livewire/destination/index.blade.php
+++ b/resources/views/livewire/destination/index.blade.php
@@ -58,7 +58,7 @@
                 localStorage.setItem('coolify-destinations-view', mode);
             }
         }">
-            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search destinations', 'singular' => 'destination', 'plural' => 'destinations'])
+            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search destinations'])
 
         <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($destinations as $destination)
diff --git a/resources/views/livewire/destination/sidebar.blade.php b/resources/views/livewire/destination/sidebar.blade.php
index b48717e247..2185785061 100644
--- a/resources/views/livewire/destination/sidebar.blade.php
+++ b/resources/views/livewire/destination/sidebar.blade.php
@@ -17,17 +17,19 @@
             'label' => 'Danger Zone',
             'route' => 'destination.danger',
             'active' => request()->routeIs('destination.danger'),
-            'icon' => 'shield-alert',
+            'icon' => 'danger',
         ],
     ])->filter();
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start"
+<x-main-nav-menu back-label="Destinations" back-title="Back to Integrations"
     data-settings-search-items="{{ json_encode(settingsSearchItems(['Destination' => $destinationMenuItems], $destinationRouteParameters)) }}">
     <nav aria-label="Destination settings"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-        <div class="nav-section hidden xl:block">Settings</div>
         @foreach ($destinationMenuItems as $menuItem)
+            @if ($menuItem['label'] === 'Danger Zone')
+                <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+            @endif
             <a wire:key="destination-settings-{{ str($menuItem['label'])->slug() }}"
                 @class(['menu-item', 'menu-item-active' => $menuItem['active']])
                 {{ wireNavigate() }} href="{{ route($menuItem['route'], $destinationRouteParameters) }}">
@@ -36,4 +38,4 @@
             </a>
         @endforeach
     </nav>
-</aside>
+</x-main-nav-menu>
diff --git a/resources/views/livewire/fleet/metrics.blade.php b/resources/views/livewire/fleet/metrics.blade.php
index 4ff5b14ddb..79103f6de2 100644
--- a/resources/views/livewire/fleet/metrics.blade.php
+++ b/resources/views/livewire/fleet/metrics.blade.php
@@ -81,12 +81,21 @@ $serverListboxOptions = array_merge(
 
     @if ($servers->isEmpty())
         <x-empty size="sm" title="No server metrics yet"
-            description="Enable metrics on a server to see fleet resource usage here."
+            description="{{ empty($enableableServers) ? 'Enable metrics on a server to see fleet resource usage here.' : 'Enable metrics to collect CPU, memory, disk, and network history. This starts Sentinel; your applications keep running.' }}"
             icon-name="graph">
             <x-slot:contents>
-                <a class="button" href="{{ route('server.index') }}" {{ wireNavigate() }}>
-                    View servers
-                </a>
+                <div class="flex flex-wrap items-center justify-center gap-3">
+                    @if (! empty($enableableServers))
+                        <x-forms.button isHighlighted wire:click="enableMetrics">
+                            {{ count($enableableServers) === 1
+                                ? 'Enable metrics on '.\Illuminate\Support\Str::limit($enableableServers[0], 24)
+                                : 'Enable metrics on '.count($enableableServers).' servers' }}
+                        </x-forms.button>
+                    @endif
+                    <a class="button" href="{{ route('server.index') }}" {{ wireNavigate() }}>
+                        View servers
+                    </a>
+                </div>
             </x-slot:contents>
         </x-empty>
     @else
@@ -226,41 +235,55 @@ $serverListboxOptions = array_merge(
         </div>
 
         {{-- Servers table --}}
-        <x-application.settings-section title="Servers" flush
-            helper="Per-server resource pressure. Sorted by CPU, highest first.">
-            <div class="data-table">
-                <div class="data-table-header fleet-servers-table-grid">
-                    <span>Server</span>
-                    <span>CPU</span>
-                    <span>Memory</span>
-                    <span>Disk</span>
-                    <span>Load</span>
-                    <span>Network</span>
-                    <span class="text-right">Containers</span>
+        <x-application.settings-section id="metrics-servers-section" title="Servers" flush
+            helper="Per-server resource pressure. Select a column header to sort.">
+            <div class="data-table" x-data="trafficTable({ per: Number.MAX_SAFE_INTEGER, key: 'cpu' })">
+                <div class="data-table-header fleet-servers-table-grid border-b-0!">
+                    @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Server', 'text' => true, 'class' => 'justify-self-start'])
+                    @foreach (['cpu' => 'CPU', 'memory' => 'Memory', 'disk' => 'Disk', 'load' => 'Load', 'network' => 'Network'] as $column => $label)
+                        @include('livewire.traffic._sort-header', ['column' => $column, 'label' => $label, 'text' => true, 'dir' => 'desc', 'class' => 'justify-self-start'])
+                    @endforeach
+                    @include('livewire.traffic._sort-header', ['column' => 'containers', 'label' => 'Containers', 'class' => 'justify-self-end'])
                 </div>
-                @foreach (collect($serverRows)->sortByDesc(fn ($r) => $r['cpu'] ?? -1) as $row)
-                    <div wire:key="fleet-server-{{ $row['uuid'] }}"
-                        class="data-table-row fleet-servers-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
-                        <div class="flex min-w-0 items-center gap-2">
-                            <a href="{{ route('server.metrics', ['server_uuid' => $row['uuid']]) }}"
-                                class="min-w-0 truncate text-[13px] font-medium text-black hover:underline dark:text-fg" {{ wireNavigate() }}>{{ $row['name'] }}</a>
-                            @unless ($row['online'])
-                                <span class="table-badge table-badge-warning shrink-0">Offline</span>
-                            @endunless
+                <div class="flex flex-col">
+                    @foreach (collect($serverRows)->sortByDesc(fn ($r) => $r['cpu'] ?? -1) as $row)
+                        @php
+                            $memPercent = ($row['memTotal'] ?? 0) ? round($row['memUsed'] / $row['memTotal'] * 100, 1) : null;
+                            $sortValues = [
+                                'name' => $row['name'],
+                                'cpu' => $row['cpu'],
+                                'memory' => $memPercent,
+                                'disk' => $row['diskPercent'],
+                                'load' => $row['load1'],
+                                'network' => $row['netRx'] === null ? null : $row['netRx'] + $row['netTx'],
+                                'containers' => $row['containers'],
+                            ];
+                        @endphp
+                        {{-- Offline servers have no values, so they stay last in each sort. --}}
+                        <div wire:key="fleet-server-{{ $row['uuid'] }}" data-row="{{ json_encode($sortValues) }}" @unless ($row['online']) data-pinned @endunless
+                            x-show="shown($el)"
+                            class="data-table-row fleet-servers-table-grid border-t border-neutral-200 dark:border-white/[0.07]">
+                            <div class="flex min-w-0 items-center gap-2">
+                                <a href="{{ route('server.metrics', ['server_uuid' => $row['uuid']]) }}"
+                                    class="min-w-0 truncate text-[13px] font-medium text-black hover:underline dark:text-fg" {{ wireNavigate() }}>{{ $row['name'] }}</a>
+                                @unless ($row['online'])
+                                    <span class="table-badge table-badge-warning shrink-0">Offline</span>
+                                @endunless
+                            </div>
+                            <div>@include('livewire.fleet._usage-cell', ['percent' => $row['cpu'], 'kind' => 'cpu'])</div>
+                            <div>@include('livewire.fleet._usage-cell', ['percent' => $memPercent, 'kind' => 'memory'])</div>
+                            <div>@include('livewire.fleet._usage-cell', ['percent' => $row['diskPercent'], 'kind' => 'disk'])</div>
+                            <div class="text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['load1'] === null ? '-' : number_format($row['load1'], 2) }}</div>
+                            <div class="text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['netRx'] === null ? '-' : formatBytes($row['netRx'] + $row['netTx']).'/s' }}</div>
+                            <div class="text-right text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['containers'] ?? '-' }}</div>
                         </div>
-                        <div>@include('livewire.fleet._usage-cell', ['percent' => $row['cpu'], 'kind' => 'cpu'])</div>
-                        <div>@include('livewire.fleet._usage-cell', ['percent' => ($row['memTotal'] ?? 0) ? round($row['memUsed'] / $row['memTotal'] * 100, 1) : null, 'kind' => 'memory'])</div>
-                        <div>@include('livewire.fleet._usage-cell', ['percent' => $row['diskPercent'], 'kind' => 'disk'])</div>
-                        <div class="text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['load1'] === null ? '-' : number_format($row['load1'], 2) }}</div>
-                        <div class="text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['netRx'] === null ? '-' : formatBytes($row['netRx'] + $row['netTx']).'/s' }}</div>
-                        <div class="text-right text-[13px] tabular-nums text-neutral-600 dark:text-fg-dim">{{ $row['containers'] ?? '-' }}</div>
-                    </div>
-                @endforeach
+                    @endforeach
+                </div>
             </div>
         </x-application.settings-section>
 
         {{-- Hottest containers --}}
-        <x-application.settings-section title="Hottest containers" flush
+        <x-application.settings-section id="metrics-containers-section" title="Hottest containers" flush
             helper="{{ $scoped ? 'Busiest containers on this server, ranked by the selected metric.' : 'Busiest containers across the fleet, ranked by the selected metric.' }}">
             <x-slot:actions>
                 <div class="flex items-center gap-2">
@@ -294,47 +317,51 @@ $serverListboxOptions = array_merge(
                     $maxMetric = max(1, collect($topContainers)->map($metricOf)->max());
                 @endphp
                 <div class="data-table transition-opacity" wire:loading.class="pointer-events-none opacity-50"
-                    wire:target="containerMetric">
-                    <div class="data-table-header fleet-containers-table-grid">
+                    wire:target="containerMetric" x-data="trafficTable({ per: Number.MAX_SAFE_INTEGER, key: 'value' })">
+                    <div class="data-table-header fleet-containers-table-grid border-b-0!">
                         <span class="text-center">#</span>
-                        <span>Container</span>
-                        <span>Server</span>
-                        <span class="text-right">{{ ['cpu' => 'CPU', 'memory' => 'Memory', 'disk' => 'Disk', 'network' => 'Network'][$containerMetric] }}</span>
+                        @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Container', 'text' => true, 'class' => 'justify-self-start'])
+                        @include('livewire.traffic._sort-header', ['column' => 'server', 'label' => 'Server', 'text' => true, 'class' => 'justify-self-start'])
+                        @include('livewire.traffic._sort-header', ['column' => 'value', 'label' => ['cpu' => 'CPU', 'memory' => 'Memory', 'disk' => 'Disk', 'network' => 'Network'][$containerMetric], 'class' => 'justify-self-end'])
                     </div>
-                    @foreach ($topContainers as $c)
-                        @php
-                            $meta = $this->containerMeta($c['id']);
-                            $pct = min(100, round($metricOf($c) / $maxMetric * 100, 1));
-                            $display = match ($containerMetric) {
-                                'memory' => formatBytes($c['memUsed'] ?? 0),
-                                'disk' => formatBytes($c['diskBytes'] ?? 0),
-                                'network' => formatBytes($c['net'] ?? 0).'/s',
-                                default => round($c['cpu'] ?? 0).'%',
-                            };
-                        @endphp
-                        <div wire:key="fleet-container-{{ $c['serverUuid'] ?? $c['server'] }}-{{ $c['id'] }}"
-                            class="data-table-row fleet-containers-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
-                            <div class="self-center text-center text-[12px] tabular-nums text-neutral-400 dark:text-fg-faint">{{ $loop->iteration }}</div>
-                            <div class="flex min-w-0 flex-col">
-                                @if ($meta['link'])
-                                    <a href="{{ $meta['link'] }}" class="truncate text-[13px] font-medium text-black hover:underline dark:text-fg" {{ wireNavigate() }}>{{ $meta['name'] }}</a>
-                                @else
-                                    <span class="truncate text-[13px] font-medium text-black dark:text-fg">{{ $meta['name'] }}</span>
-                                @endif
-                                @if ($meta['image'])
-                                    <span class="truncate font-mono text-[11px] text-neutral-400 dark:text-fg-faint">{{ $meta['image'] }}</span>
-                                @endif
-                            </div>
-                            <div class="min-w-0 self-center truncate text-[12px] text-neutral-500 dark:text-fg-dim">{{ $c['server'] }}</div>
-                            <div class="flex items-center justify-end gap-2.5 self-center">
-                                <div class="hidden h-1.5 w-full max-w-[6rem] overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
-                                    title="{{ $pct }}% of the busiest">
-                                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)] transition-[width] duration-700 ease-out" style="width: {{ $pct }}%"></div>
+                    <div class="flex flex-col">
+                        @foreach ($topContainers as $c)
+                            @php
+                                $meta = $this->containerMeta($c['id']);
+                                $pct = min(100, round($metricOf($c) / $maxMetric * 100, 1));
+                                $display = match ($containerMetric) {
+                                    'memory' => formatBytes($c['memUsed'] ?? 0),
+                                    'disk' => formatBytes($c['diskBytes'] ?? 0),
+                                    'network' => formatBytes($c['net'] ?? 0).'/s',
+                                    default => round($c['cpu'] ?? 0).'%',
+                                };
+                            @endphp
+                            <div wire:key="fleet-container-{{ $c['serverUuid'] ?? $c['server'] }}-{{ $c['id'] }}"
+                                data-row="{{ json_encode(['name' => $meta['name'], 'server' => $c['server'], 'value' => $metricOf($c)]) }}"
+                                x-show="shown($el)"
+                                class="data-table-row fleet-containers-table-grid border-t border-neutral-200 dark:border-white/[0.07]">
+                                <div class="self-center text-center text-[12px] tabular-nums text-neutral-400 dark:text-fg-faint">{{ $loop->iteration }}</div>
+                                <div class="flex min-w-0 flex-col">
+                                    @if ($meta['link'])
+                                        <a href="{{ $meta['link'] }}" class="truncate text-[13px] font-medium text-black hover:underline dark:text-fg" {{ wireNavigate() }}>{{ $meta['name'] }}</a>
+                                    @else
+                                        <span class="truncate text-[13px] font-medium text-black dark:text-fg">{{ $meta['name'] }}</span>
+                                    @endif
+                                    @if ($meta['image'])
+                                        <span class="truncate font-mono text-[11px] text-neutral-400 dark:text-fg-faint">{{ $meta['image'] }}</span>
+                                    @endif
+                                </div>
+                                <div class="min-w-0 self-center truncate text-[12px] text-neutral-500 dark:text-fg-dim">{{ $c['server'] }}</div>
+                                <div class="flex items-center justify-end gap-2.5 self-center">
+                                    <div class="hidden h-1.5 w-full max-w-[6rem] overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
+                                        title="{{ $pct }}% of the busiest">
+                                        <div class="h-full rounded-full bg-[var(--chart-status-3xx)] transition-[width] duration-700 ease-out" style="width: {{ $pct }}%"></div>
+                                    </div>
+                                    <span class="w-20 shrink-0 whitespace-nowrap text-right text-[13px] tabular-nums text-black dark:text-fg">{{ $display }}</span>
                                 </div>
-                                <span class="w-20 shrink-0 whitespace-nowrap text-right text-[13px] tabular-nums text-black dark:text-fg">{{ $display }}</span>
                             </div>
-                        </div>
-                    @endforeach
+                        @endforeach
+                    </div>
                 </div>
             @endif
         </x-application.settings-section>
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index b2ada6f238..33a072a6af 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -8,117 +8,6 @@
     @close-email-change-modal.window="emailModalOpen = false">
     <x-slot:title>Profile | Coolify</x-slot>
     <div class="mt-8 flex w-full max-w-none flex-col gap-6 lg:mt-3">
-        <section class="application-settings-section" x-data="{
-            preview: null,
-            processing: false,
-            uploadError: null,
-            async prepareAvatar(event) {
-                const file = event.target.files?.[0];
-                if (!file) return;
-                this.processing = true;
-                this.uploadError = null;
-
-                try {
-                    const dataUrl = await new Promise((resolve, reject) => {
-                        const reader = new FileReader();
-                        reader.onload = () => resolve(reader.result);
-                        reader.onerror = reject;
-                        reader.readAsDataURL(file);
-                    });
-                    const image = await new Promise((resolve, reject) => {
-                        const element = new Image();
-                        element.onload = () => resolve(element);
-                        element.onerror = reject;
-                        element.src = dataUrl;
-                    });
-                    const cropSize = Math.min(image.naturalWidth, image.naturalHeight);
-                    const canvas = document.createElement('canvas');
-                    canvas.width = 256;
-                    canvas.height = 256;
-                    const context = canvas.getContext('2d');
-                    context.fillStyle = '#ffffff';
-                    context.fillRect(0, 0, 256, 256);
-                    context.drawImage(
-                        image,
-                        (image.naturalWidth - cropSize) / 2,
-                        (image.naturalHeight - cropSize) / 2,
-                        cropSize,
-                        cropSize,
-                        0,
-                        0,
-                        256,
-                        256,
-                    );
-                    const blob = await new Promise((resolve, reject) => {
-                        canvas.toBlob(value => value ? resolve(value) : reject(new Error('JPEG compression failed')), 'image/jpeg', 0.8);
-                    });
-                    const previewUrl = URL.createObjectURL(blob);
-                    const compressed = new File([blob], 'avatar.jpg', { type: 'image/jpeg' });
-                    this.$wire.upload('avatar', compressed, async () => {
-                        try {
-                            const uploaded = await this.$wire.uploadAvatar();
-                            if (uploaded) {
-                                if (this.preview) URL.revokeObjectURL(this.preview);
-                                this.preview = previewUrl;
-                            } else {
-                                URL.revokeObjectURL(previewUrl);
-                            }
-                        } catch (error) {
-                            URL.revokeObjectURL(previewUrl);
-                            this.uploadError = 'The image could not be uploaded.';
-                        } finally {
-                            this.processing = false;
-                        }
-                    }, () => {
-                        URL.revokeObjectURL(previewUrl);
-                        this.processing = false;
-                        this.uploadError = 'The image could not be uploaded.';
-                    });
-                } catch (error) {
-                    this.processing = false;
-                    this.uploadError = 'The image could not be processed in this browser.';
-                }
-            },
-        }">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>Profile picture</h2>
-                    <p>Upload a JPG, PNG, or WebP image.</p>
-                </div>
-            </div>
-            <div class="application-settings-section-body flex flex-col gap-4 sm:flex-row sm:items-center">
-                <div class="flex size-20 shrink-0 items-center justify-center overflow-hidden rounded-full bg-neutral-200 text-2xl font-semibold text-neutral-700 dark:bg-white/[0.1] dark:text-fg">
-                    <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
-                        class="h-full w-full object-cover">
-                    @if (auth()->user()->avatar_path)
-                        <img src="{{ profile_avatar_url(auth()->user()) }}"
-                            x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
-                    @else
-                        <span x-show="!preview">
-                            {{ strtoupper(mb_substr(auth()->user()->name ?: auth()->user()->email, 0, 1)) }}
-                        </span>
-                    @endif
-                </div>
-                <div class="flex min-w-0 flex-1 flex-col gap-3">
-                    <div class="flex flex-wrap items-center gap-2">
-                        <input x-ref="avatarInput" type="file" x-on:change="prepareAvatar($event)"
-                            accept="image/jpeg,image/png,image/webp" class="hidden">
-                        <x-forms.button type="button" x-on:click="$refs.avatarInput.click()"
-                            x-bind:disabled="processing">
-                            <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
-                        </x-forms.button>
-                        @if (auth()->user()->avatar_path)
-                            <x-forms.button type="button" wire:click="removeAvatar" x-bind:disabled="processing"
-                                isError>Remove</x-forms.button>
-                        @endif
-                    </div>
-                    <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
-                    @error('avatar')
-                        <p class="text-xs text-red-500">{{ $message }}</p>
-                    @enderror
-                </div>
-            </div>
-        </section>
 
         <form wire:submit="submit">
             <x-unsaved-bar action="submit" />
@@ -126,10 +15,117 @@
                 <div class="application-settings-section-header">
                     <div>
                         <h2>Profile details</h2>
-                        <p>Your display name and verified sign-in address.</p>
+                        <p>Your avatar, display name, and verified sign-in address.</p>
                     </div>
                 </div>
                 <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
+                    <div class="sm:col-span-2" x-data="{
+                        preview: null,
+                        processing: false,
+                        uploadError: null,
+                        async prepareAvatar(event) {
+                            const file = event.target.files?.[0];
+                            if (!file) return;
+                            this.processing = true;
+                            this.uploadError = null;
+
+                            try {
+                                const dataUrl = await new Promise((resolve, reject) => {
+                                    const reader = new FileReader();
+                                    reader.onload = () => resolve(reader.result);
+                                    reader.onerror = reject;
+                                    reader.readAsDataURL(file);
+                                });
+                                const image = await new Promise((resolve, reject) => {
+                                    const element = new Image();
+                                    element.onload = () => resolve(element);
+                                    element.onerror = reject;
+                                    element.src = dataUrl;
+                                });
+                                const cropSize = Math.min(image.naturalWidth, image.naturalHeight);
+                                const canvas = document.createElement('canvas');
+                                canvas.width = 256;
+                                canvas.height = 256;
+                                const context = canvas.getContext('2d');
+                                context.fillStyle = '#ffffff';
+                                context.fillRect(0, 0, 256, 256);
+                                context.drawImage(
+                                    image,
+                                    (image.naturalWidth - cropSize) / 2,
+                                    (image.naturalHeight - cropSize) / 2,
+                                    cropSize,
+                                    cropSize,
+                                    0,
+                                    0,
+                                    256,
+                                    256,
+                                );
+                                const blob = await new Promise((resolve, reject) => {
+                                    canvas.toBlob(value => value ? resolve(value) : reject(new Error('JPEG compression failed')), 'image/jpeg', 0.8);
+                                });
+                                const previewUrl = URL.createObjectURL(blob);
+                                const compressed = new File([blob], 'avatar.jpg', { type: 'image/jpeg' });
+                                this.$wire.upload('avatar', compressed, async () => {
+                                    try {
+                                        const uploaded = await this.$wire.uploadAvatar();
+                                        if (uploaded) {
+                                            if (this.preview) URL.revokeObjectURL(this.preview);
+                                            this.preview = previewUrl;
+                                        } else {
+                                            URL.revokeObjectURL(previewUrl);
+                                        }
+                                    } catch (error) {
+                                        URL.revokeObjectURL(previewUrl);
+                                        this.uploadError = 'The image could not be uploaded.';
+                                    } finally {
+                                        this.processing = false;
+                                    }
+                                }, () => {
+                                    URL.revokeObjectURL(previewUrl);
+                                    this.processing = false;
+                                    this.uploadError = 'The image could not be uploaded.';
+                                });
+                            } catch (error) {
+                                this.processing = false;
+                                this.uploadError = 'The image could not be processed in this browser.';
+                            }
+                        },
+                    }">
+                        <div class="mb-2 text-sm font-medium leading-4">Avatar</div>
+                        <div class="flex items-center gap-4">
+                            <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl bg-neutral-200 text-2xl font-semibold text-neutral-700 dark:bg-white/[0.1] dark:text-fg">
+                                <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
+                                    class="h-full w-full object-cover">
+                                @if (auth()->user()->avatar_path)
+                                    <img src="{{ profile_avatar_url(auth()->user()) }}"
+                                        x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
+                                @else
+                                    <span x-show="!preview">
+                                        {{ strtoupper(mb_substr(auth()->user()->name ?: auth()->user()->email, 0, 1)) }}
+                                    </span>
+                                @endif
+                            </div>
+                            <div class="flex min-w-0 flex-1 flex-col gap-2">
+                                <div class="flex flex-wrap gap-2">
+                                    <input x-ref="avatarInput" type="file" x-on:change="prepareAvatar($event)"
+                                        accept="image/jpeg,image/png,image/webp" class="hidden">
+                                    <x-forms.button type="button" x-on:click="$refs.avatarInput.click()"
+                                        x-bind:disabled="processing">
+                                        <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
+                                    </x-forms.button>
+                                    @if (auth()->user()->avatar_path)
+                                        <x-forms.button type="button" wire:click="removeAvatar" x-bind:disabled="processing"
+                                            isError>Remove</x-forms.button>
+                                    @endif
+                                </div>
+                                <p class="text-xs text-neutral-500 dark:text-fg-dim">JPG, PNG, or WebP. Shown in the user menu and team member lists.</p>
+                                <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
+                                @error('avatar')
+                                    <p class="text-xs text-red-500">{{ $message }}</p>
+                                @enderror
+                            </div>
+                        </div>
+                    </div>
                     <x-forms.input id="name" label="Name" required />
                     <div class="flex items-end gap-2">
                         <x-forms.input id="email" label="Email" readonly />
diff --git a/resources/views/livewire/project/application/analytics-placeholder.blade.php b/resources/views/livewire/project/application/analytics-placeholder.blade.php
index 1cb6cffc70..6c8df5d82c 100644
--- a/resources/views/livewire/project/application/analytics-placeholder.blade.php
+++ b/resources/views/livewire/project/application/analytics-placeholder.blade.php
@@ -25,8 +25,16 @@
         <x-skeleton.table :rows="6" flush />
     </x-application.settings-section>
 
-    <x-application.settings-section id="analytics-country-section" title="Countries" flush>
-        <x-skeleton class="h-64 w-full" />
+    <x-application.settings-section id="analytics-country-section" title="Locations" flush>
+        <x-slot:actions>
+            <x-skeleton class="h-9 w-36 rounded-lg" />
+        </x-slot:actions>
+        <div class="grid grid-cols-1 items-start gap-4 p-4 lg:grid-cols-[2fr_3fr]">
+            <div class="flex items-center justify-center">
+                <x-skeleton class="aspect-square w-full max-w-[320px] rounded-full" />
+            </div>
+            <x-skeleton.table :rows="7" flush />
+        </div>
     </x-application.settings-section>
 
     <div class="grid grid-cols-1 gap-6 lg:grid-cols-2">
diff --git a/resources/views/livewire/project/application/analytics.blade.php b/resources/views/livewire/project/application/analytics.blade.php
index b2458f4cf8..53c09e5629 100644
--- a/resources/views/livewire/project/application/analytics.blade.php
+++ b/resources/views/livewire/project/application/analytics.blade.php
@@ -157,13 +157,11 @@ $approxBadge = fn (string $tooltip) => '<span title="'.e($tooltip).'" class="ml-
             @include('livewire.traffic._paths-list', ['paths' => $topPaths])
         </x-application.settings-section>
 
-        <x-application.settings-section id="analytics-country-section" title="Countries"
-            helper="Request volume by visitor country for the selected range." flush>
-            @include('livewire.traffic._geo', [
-                'countries' => data_get($breakdowns, 'country', []),
-                'attribution' => $attribution,
-            ])
-        </x-application.settings-section>
+        @include('livewire.traffic._geo', [
+            'countries' => data_get($breakdowns, 'country', []),
+            'cities' => trafficCityRows(data_get($breakdowns, 'city', [])),
+            'attribution' => $attribution,
+        ])
 
         {{-- Requests by device type (donut) + HTTP versions / cache / status. --}}
         <div class="grid grid-cols-1 gap-6 lg:grid-cols-2">
diff --git a/resources/views/livewire/project/application/backup/index.blade.php b/resources/views/livewire/project/application/backup/index.blade.php
index 785b855cae..bab72d8ec4 100644
--- a/resources/views/livewire/project/application/backup/index.blade.php
+++ b/resources/views/livewire/project/application/backup/index.blade.php
@@ -167,7 +167,7 @@
                 </div>
 
                 @if ($backups->isNotEmpty())
-                    <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
+                    <div class="data-table flex w-full flex-col overflow-x-auto" x-show="filteredBackups.length > 0">
                         <div class="data-table-header backup-table-grid">
                             <span>Target</span>
                             <span>Type</span>
diff --git a/resources/views/livewire/project/application/backup/show.blade.php b/resources/views/livewire/project/application/backup/show.blade.php
index 982160794d..0b9b31bfb6 100644
--- a/resources/views/livewire/project/application/backup/show.blade.php
+++ b/resources/views/livewire/project/application/backup/show.blade.php
@@ -7,11 +7,14 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            {{-- The application menu, one Back away from the backup menu in the main sidebar. --}}
+            <x-application.configuration-sidebar :application="$application"
+                current-route="project.application.backup.index" nav-only />
             <x-backup-sidebar context="application" :parameters="$parameters" :section="$section" />
 
             <div class="min-w-0">
                 <livewire:project.shared.storages.volume-backups :storage="$backup->backupable"
-                    :resource="$application" :section="$section"
+                    :resource="$application" :section="$section" :actions-in-header="true"
                     wire:key="volume-backup-{{ $backup->uuid }}-{{ $section }}" />
             </div>
         </div>
diff --git a/resources/views/livewire/project/application/configuration.blade.php b/resources/views/livewire/project/application/configuration.blade.php
index 168b102e0c..e223ed8123 100644
--- a/resources/views/livewire/project/application/configuration.blade.php
+++ b/resources/views/livewire/project/application/configuration.blade.php
@@ -30,8 +30,6 @@
                 <livewire:project.shared.destination :resource="$application" />
             @elseif ($currentRoute === 'project.application.scheduled-tasks.show')
                 <livewire:project.shared.scheduled-task.all :resource="$application" />
-            @elseif ($currentRoute === 'project.application.scheduled-tasks')
-                <livewire:project.shared.scheduled-task.show />
             @elseif ($currentRoute === 'project.application.webhooks')
                 <livewire:project.shared.webhooks :resource="$application" />
             @elseif ($currentRoute === 'project.application.preview-deployments')
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index 48a813c6b5..8d6c6e22ef 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -185,7 +185,7 @@
                                 @if ($this->application->is_github_based() && !$this->application->is_public_repository())
                                     <div class="pt-4">
                                         <x-forms.textarea
-                                            helper="Order-based pattern matching to filter Git webhook deployments. Supports wildcards (*, **, ?) and negation (!). Last matching pattern wins."
+                                            helper="Order-based pattern matching to filter Git webhook deployments. Enter one pattern per line. Commas do not separate patterns. Supports wildcards (*, **, ?) and negation (!). Last matching pattern wins."
                                             placeholder="services/api/**" id="watchPaths" label="Watch paths"
                                             x-bind:disabled="shouldDisable()" />
                                     </div>
@@ -208,7 +208,7 @@
                             @if ($this->application->is_github_based() && !$this->application->is_public_repository())
                                 <div class="pb-4">
                                     <x-forms.textarea
-                                        helper="Order-based pattern matching to filter Git webhook deployments. Supports wildcards (*, **, ?) and negation (!). Last matching pattern wins."
+                                        helper="Order-based pattern matching to filter Git webhook deployments. Enter one pattern per line. Commas do not separate patterns. Supports wildcards (*, **, ?) and negation (!). Last matching pattern wins."
                                         placeholder="src/pages/**" id="watchPaths" label="Watch paths"
                                         x-bind:disabled="!canUpdate" />
                                 </div>
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 313606f3a1..6cf452cd98 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -6,7 +6,7 @@
                     {{ $application->name }}
                 </h1>
                 <div class="relative flex w-full min-w-0 items-center gap-2">
-                    <x-status-summary :status="$application->status" align="right"
+                    <x-status-summary :status="$application->status"
                         :healthcheck-url="route('project.application.healthcheck', $parameters)" />
                     <x-applications.links :application="$application" compact />
                     @if ($this->runningDeploymentUrl)
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index 0792e96aa3..4abe3b4ca8 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -86,7 +86,7 @@
 
             <div class="w-full">
                 <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="savePreviewSettings"
-                    helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
+                    helper="When public, anyone can trigger PR deployments. Otherwise only PRs from branches in the same repository are deployed and fork PRs are blocked."
                     :options="[
                         ['value' => false, 'label' => 'Repository members only'],
                         ['value' => true, 'label' => 'Public (fork PRs allowed)'],
diff --git a/resources/views/livewire/project/database/backup-edit.blade.php b/resources/views/livewire/project/database/backup-edit.blade.php
index d85d506a0b..90543e817b 100644
--- a/resources/views/livewire/project/database/backup-edit.blade.php
+++ b/resources/views/livewire/project/database/backup-edit.blade.php
@@ -1,13 +1,5 @@
 <div class="flex flex-col gap-6">
-    @if ($backup->database_id === 0)
-        @include('livewire.project.database.backup-edit.general')
-        @include('livewire.project.database.backup-edit.s3')
-        @include('livewire.project.database.backup-edit.retention')
-    @elseif ($section === 'retention')
-        @include('livewire.project.database.backup-edit.retention')
-    @elseif ($section === 's3')
-        @include('livewire.project.database.backup-edit.s3')
-    @elseif ($section === 'danger')
+    @if ($section === 'danger' && $backup->database_id !== 0)
         @include('livewire.project.database.backup-edit.danger')
     @else
         @include('livewire.project.database.backup-edit.general')
diff --git a/resources/views/livewire/project/database/backup-edit/general.blade.php b/resources/views/livewire/project/database/backup-edit/general.blade.php
index 49385b0258..dfe465e07a 100644
--- a/resources/views/livewire/project/database/backup-edit/general.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/general.blade.php
@@ -1,10 +1,11 @@
-<form wire:submit="submit">
+<form wire:submit="submit" class="flex flex-col gap-6">
     <x-unsaved-bar action="submit" />
 
     <x-application.settings-section title="Backup schedule"
         description="Choose what to back up, when it runs, and how long it may run.">
         <x-slot:actions>
-            <div class="flex items-center gap-2">
+            {{-- Below xl the header bar is hidden, so keep the buttons here. --}}
+            <div @class(['flex items-center gap-2', 'xl:hidden' => $actionsInHeader])>
                 @if (! $backupEnabled)
                     <x-forms.button type="button" wire:click="toggleEnabled" wire:loading.attr="disabled"
                         wire:target="toggleEnabled" isHighlighted>
@@ -98,4 +99,7 @@
             </div>
         </div>
     </x-application.settings-section>
+
+    @include('livewire.project.database.backup-edit.s3')
+    @include('livewire.project.database.backup-edit.retention')
 </form>
diff --git a/resources/views/livewire/project/database/backup-edit/retention.blade.php b/resources/views/livewire/project/database/backup-edit/retention.blade.php
index 8825b3c26d..d340216537 100644
--- a/resources/views/livewire/project/database/backup-edit/retention.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/retention.blade.php
@@ -1,34 +1,30 @@
-<form wire:submit="submit">
-    <x-unsaved-bar action="submit" />
-
-    <x-application.settings-section title="Retention"
-        description="The first reached limit removes the oldest backup. Use 0 for unlimited retention.">
-        <div class="space-y-6">
-            <div>
-                <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
-                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                    <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountLocally"
-                        type="number" min="0" helper="Maximum number of recent local backups." required />
-                    <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysLocally"
-                        type="number" min="0" helper="Remove local backups older than this many days." required />
-                    <x-forms.input label="Maximum storage (GB)"
-                        id="databaseBackupRetentionMaxStorageLocally" type="number" min="0" step="any"
-                        helper="Remove oldest local backups after this total size is reached." required />
-                </div>
-            </div>
-
-            <div class="border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
-                <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
-                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                    <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountS3"
-                        type="number" min="0" helper="Maximum number of recent S3 backups." required />
-                    <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysS3"
-                        type="number" min="0" helper="Remove S3 backups older than this many days." required />
-                    <x-forms.input label="Maximum storage (GB)" id="databaseBackupRetentionMaxStorageS3"
-                        type="number" min="0" step="any"
-                        helper="Remove oldest S3 backups after this total size is reached." required />
-                </div>
+<x-application.settings-section title="Retention"
+    description="The first reached limit removes the oldest backup. Use 0 for unlimited retention.">
+    <div class="space-y-6">
+        <div>
+            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
+            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+                <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountLocally"
+                    type="number" min="0" helper="Maximum number of recent local backups." required />
+                <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysLocally"
+                    type="number" min="0" helper="Remove local backups older than this many days." required />
+                <x-forms.input label="Maximum storage (GB)"
+                    id="databaseBackupRetentionMaxStorageLocally" type="number" min="0" step="any"
+                    helper="Remove oldest local backups after this total size is reached." required />
             </div>
         </div>
-    </x-application.settings-section>
-</form>
+
+        <div class="border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
+            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
+            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+                <x-forms.input label="Backups to keep" id="databaseBackupRetentionAmountS3"
+                    type="number" min="0" helper="Maximum number of recent S3 backups." required />
+                <x-forms.input label="Days to keep" id="databaseBackupRetentionDaysS3"
+                    type="number" min="0" helper="Remove S3 backups older than this many days." required />
+                <x-forms.input label="Maximum storage (GB)" id="databaseBackupRetentionMaxStorageS3"
+                    type="number" min="0" step="any"
+                    helper="Remove oldest S3 backups after this total size is reached." required />
+            </div>
+        </div>
+    </div>
+</x-application.settings-section>
diff --git a/resources/views/livewire/project/database/backup-edit/s3.blade.php b/resources/views/livewire/project/database/backup-edit/s3.blade.php
index 4f0f7b43fd..586c3617cf 100644
--- a/resources/views/livewire/project/database/backup-edit/s3.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/s3.blade.php
@@ -10,33 +10,29 @@
         </x-empty>
     </x-application.settings-section>
 @else
-    <form wire:submit="submit">
-        <x-unsaved-bar action="submit" />
-
-        <x-application.settings-section title="S3 storage"
-            description="Choose where remote backups are stored and whether local copies are retained.">
-            <x-slot:actions>
-                @if (! $saveS3)
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3" isHighlighted>Enable S3</x-forms.button>
-                @else
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3">Disable S3</x-forms.button>
-                @endif
-            </x-slot:actions>
-            <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageIds" label="S3 storages" multiple live portal
-                    helper="Each backup is uploaded to every selected storage." placeholder="Select S3 storages"
-                    :options="$availableS3Storages->map(fn ($storage) => [
-                        'value' => $storage->id,
-                        'label' => $storage->name.($storage->is_usable ? '' : ' (unavailable)'),
-                    ])->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
-                    :options="[
-                        ['value' => false, 'label' => 'Keep local backup'],
-                        ['value' => true, 'label' => 'Delete after S3 upload'],
-                    ]" />
-            </div>
-        </x-application.settings-section>
-    </form>
+    <x-application.settings-section title="S3 storage"
+        description="Choose where remote backups are stored and whether local copies are retained.">
+        <x-slot:actions>
+            @if (! $saveS3)
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3" isHighlighted>Enable S3</x-forms.button>
+            @else
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3">Disable S3</x-forms.button>
+            @endif
+        </x-slot:actions>
+        <div class="grid gap-4 sm:grid-cols-2">
+            <x-forms.listbox id="s3StorageIds" label="S3 storages" multiple live portal
+                helper="Each backup is uploaded to every selected storage." placeholder="Select S3 storages"
+                :options="$availableS3Storages->map(fn ($storage) => [
+                    'value' => $storage->id,
+                    'label' => $storage->name.($storage->is_usable ? '' : ' (unavailable)'),
+                ])->all()" />
+            <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
+                :options="[
+                    ['value' => false, 'label' => 'Keep local backup'],
+                    ['value' => true, 'label' => 'Delete after S3 upload'],
+                ]" />
+        </div>
+    </x-application.settings-section>
 @endif
diff --git a/resources/views/livewire/project/database/backup-executions.blade.php b/resources/views/livewire/project/database/backup-executions.blade.php
index f267908207..66a9d2c863 100644
--- a/resources/views/livewire/project/database/backup-executions.blade.php
+++ b/resources/views/livewire/project/database/backup-executions.blade.php
@@ -1,10 +1,12 @@
-<div wire:init="refreshBackupExecutions">
+<div wire:init="refreshBackupExecutions" x-on:open-backup-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
     @isset($backup)
         <section class="application-settings-section overflow-hidden">
             <div class="application-settings-section-header">
                 <div>
                     <h2>Executions</h2>
-                    <p>Review generated archives, storage availability, and backup output.</p>
                 </div>
                 <div class="flex flex-wrap items-center gap-2">
                     <x-forms.button wire:click="cleanupFailed">Clean failed backups</x-forms.button>
@@ -37,13 +39,15 @@
                             class="data-table-header backup-executions-table-grid h-auto rounded-none px-4 py-2.5 text-[11px]">
                             <span>Status</span>
                             <span>Database</span>
-                            <span>Backup path</span>
-                            <span>Finished</span>
-                            <span>Duration</span>
+                            <span>Archive</span>
+                            <span>Time</span>
                             <span>Size</span>
                             <span>Availability</span>
                             <span class="text-right">Actions</span>
                         </div>
+                        @php
+                            $server = $this->server();
+                        @endphp
                         @foreach ($executions as $execution)
                             @php
                                 $executionStatus = data_get($execution, 'status');
@@ -55,6 +59,7 @@
                                     'failed' => ['Failed', 'error'],
                                     default => [str($executionStatus)->headline(), 'neutral'],
                                 };
+                                $finishedAt = \Carbon\Carbon::parse(data_get($execution, 'finished_at') ?? data_get($execution, 'updated_at'));
                                 $s3Replicas = $execution->s3Replicas;
                                 $hasLiveS3Copies = $s3Replicas->isNotEmpty()
                                     ? $s3Replicas->contains(fn ($replica) => $replica->s3_uploaded === true && ! $replica->s3_storage_deleted)
@@ -87,40 +92,36 @@
                                     <div class="truncate text-[12px] font-medium text-black dark:text-fg">
                                         {{ data_get($execution, 'database_name', 'N/A') }}
                                     </div>
-                                    <div class="flex min-w-0 items-center gap-1">
-                                        <code class="select-all truncate font-mono text-[11px] text-neutral-600 dark:text-fg-dim"
-                                            title="Backup path: {{ data_get($execution, 'filename', 'N/A') }}">{{ data_get($execution, 'filename', 'N/A') }}</code>
-                                        <x-copy-button :value="data_get($execution, 'filename', '')" label="Copy backup path" />
+                                    <div class="min-w-0">
+                                        <x-forms.copy-input :text="data_get($execution, 'filename') ?? 'No archive name'" />
                                     </div>
-                                    <div class="text-[11px] text-neutral-600 dark:text-fg-dim">
+                                    <div class="text-[11px] text-neutral-500 dark:text-fg-faint"
+                                        title="Started: {{ formatDateInServerTimezone(data_get($execution, 'created_at'), $server) }}@if ($executionStatus !== 'running')&#10;Ended: {{ formatDateInServerTimezone(data_get($execution, 'finished_at'), $server) }}@endif">
                                         @if ($executionStatus === 'running')
-                                            Running now
+                                            Running for {{ calculateDuration(data_get($execution, 'created_at'), now()) }}
                                         @else
-                                            {{ \Carbon\Carbon::parse(data_get($execution, 'finished_at'))->diffForHumans() }}
+                                            <div class="text-black dark:text-fg">
+                                                {{ formatDateInServerTimezone($finishedAt, $server) }}
+                                            </div>
+                                            <div>{{ $finishedAt->diffForHumans() }} · {{ calculateDuration(data_get($execution, 'created_at'), $finishedAt) }}</div>
                                         @endif
                                     </div>
-                                    <div class="text-[11px] text-neutral-600 dark:text-fg-dim">
-                                        {{ calculateDuration(
-                                            data_get($execution, 'created_at'),
-                                            $executionStatus === 'running' ? now() : data_get($execution, 'finished_at'),
-                                        ) }}
-                                    </div>
-                                    <div class="text-[11px] text-neutral-600 dark:text-fg-dim">
+                                    <div class="tabular-nums text-neutral-500 dark:text-fg-dim">
                                         {{ data_get($execution, 'size') ? formatBytes(data_get($execution, 'size')) : '-' }}
                                     </div>
                                     <div class="flex flex-wrap items-center gap-1.5">
-                                        <x-status-badge label="Local"
-                                            :status="data_get($execution, 'local_storage_deleted', false) ? 'Deleted' : 'Available'"
+                                        <x-status-badge
+                                            :status="data_get($execution, 'local_storage_deleted', false) ? 'Local deleted' : 'Local'"
                                             :type="data_get($execution, 'local_storage_deleted', false) ? 'neutral' : 'success'" />
                                         @foreach ($s3Replicas as $replica)
                                             <x-status-badge wire:key="database-backup-replica-{{ $replica->id }}"
                                                 :label="$replica->s3?->name ?? 'Removed S3 storage'"
                                                 :status="$replica->s3_storage_deleted
-                                                    ? 'Deleted'
+                                                    ? 'deleted'
                                                     : match ($replica->s3_uploaded) {
-                                                        true => 'Available',
-                                                        false => 'Failed',
-                                                        default => $executionStatus === 'running' ? 'Pending' : 'Not uploaded',
+                                                        true => null,
+                                                        false => 'failed',
+                                                        default => $executionStatus === 'running' ? 'pending' : 'not uploaded',
                                                     }"
                                                 :type="$replica->s3_storage_deleted || $replica->s3_uploaded === null
                                                     ? 'neutral'
@@ -128,10 +129,10 @@
                                                 :title="$replica->message" />
                                         @endforeach
                                         @if ($s3Replicas->isEmpty() && data_get($execution, 's3_uploaded') !== null)
-                                            <x-status-badge label="S3"
+                                            <x-status-badge
                                                 :status="data_get($execution, 's3_storage_deleted', false)
-                                                    ? 'Deleted'
-                                                    : (data_get($execution, 's3_uploaded') ? 'Available' : 'Failed')"
+                                                    ? 'S3 deleted'
+                                                    : (data_get($execution, 's3_uploaded') ? 'S3' : 'S3 failed')"
                                                 :type="data_get($execution, 's3_storage_deleted', false)
                                                     ? 'neutral'
                                                     : (data_get($execution, 's3_uploaded') ? 'success' : 'error')" />
@@ -197,7 +198,11 @@
 @script
     <script>
         window.download_file = function(executionId) {
-            window.open('/download/backup/' + executionId, '_blank');
+            @if ($s3Downloads)
+                $wire.download_file(executionId);
+            @else
+                window.open('/download/backup/' + executionId, '_blank');
+            @endif
         }
     </script>
 @endscript
diff --git a/resources/views/livewire/project/database/backup/execution.blade.php b/resources/views/livewire/project/database/backup/execution.blade.php
index 911f403db8..7fc0c715c4 100644
--- a/resources/views/livewire/project/database/backup/execution.blade.php
+++ b/resources/views/livewire/project/database/backup/execution.blade.php
@@ -5,8 +5,27 @@
 
     <livewire:project.database.heading :database="$database" />
 
+    @can('manageBackups', $database)
+        @teleport('#resource-action-hud-slot')
+            <div class="order-first mr-1 hidden items-center gap-1 xl:flex">
+                @php($databaseRunning = str($database->status)->startsWith('running'))
+                @if ($backup->enabled)
+                    <x-forms.button type="button" wire:click="toggleEnabled">Disable backup</x-forms.button>
+                @else
+                    <x-forms.button type="button" wire:click="toggleEnabled" isHighlighted>Enable backup</x-forms.button>
+                @endif
+                <x-forms.button type="button" wire:click="backupNow" :disabled="! $databaseRunning"
+                    :tooltip="! $databaseRunning ? 'The database must be running to start a backup.' : null">
+                    Back up now
+                </x-forms.button>
+            </div>
+        @endteleport
+    @endcan
+
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            {{-- The database menu, one Back away from the backup menu in the main sidebar. --}}
+            <x-database.configuration-sidebar :database="$database" current-route="project.database.backup.index" nav-only />
             <x-backup-sidebar context="database" :parameters="$parameters" :section="$section" />
 
             <div class="min-w-0">
@@ -15,7 +34,7 @@
                 @else
                     <livewire:project.database.backup-edit :backup="$backup" :available-s3-storages="$s3s"
                         :status="data_get($database, 'status')" :section="$section"
-                        wire:key="database-backup-{{ $backup->uuid }}-{{ $section }}" />
+                        :actions-in-header="true" wire:key="database-backup-{{ $backup->uuid }}-{{ $section }}" />
                 @endif
             </div>
         </div>
diff --git a/resources/views/livewire/project/edit.blade.php b/resources/views/livewire/project/edit.blade.php
index f3d27997a0..ca4a784b12 100644
--- a/resources/views/livewire/project/edit.blade.php
+++ b/resources/views/livewire/project/edit.blade.php
@@ -7,7 +7,17 @@
         </header>
 
         <div class="flex flex-col gap-6">
-        <section class="application-settings-section" x-data="{
+        <form wire:submit="submit">
+            <x-unsaved-bar action="submit" />
+            <section class="application-settings-section">
+                <div class="application-settings-section-header">
+                    <div>
+                        <h2>Project details</h2>
+                        <p>Icon, name, and description shown across the dashboard.</p>
+                    </div>
+                </div>
+                <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
+                    <div class="sm:col-span-2" x-data="{
             preview: null,
             processing: false,
             uploadError: null,
@@ -55,48 +65,38 @@
                 }
             },
         }">
-            <div class="application-settings-section-header">
-                <div>
-                    <h2>Project icon</h2>
-                    <p>Upload a JPG, PNG, or WebP image. It will appear in the projects list.</p>
-                </div>
-            </div>
-            <div class="application-settings-section-body flex items-center gap-4">
-                <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                    <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
-                    @if ($project->icon_path)
-                        <img x-show="!preview" src="{{ project_icon_url($project) }}"
-                            alt="{{ $project->name }} icon" class="h-full w-full object-cover">
-                    @else
-                        <x-reicon x-show="!preview" name="projects" class="size-6" />
-                    @endif
-                </div>
-                <div class="flex min-w-0 flex-1 flex-col gap-3">
-                    <div class="flex flex-wrap gap-2">
-                        <input x-ref="iconInput" type="file" x-on:change="prepareIcon($event)" accept="image/jpeg,image/png,image/webp" class="hidden">
-                        <x-forms.button type="button" x-on:click="$refs.iconInput.click()" x-bind:disabled="processing">
-                            <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
-                        </x-forms.button>
-                        @if ($project->icon_path)
-                            <x-forms.button type="button" wire:click="removeIcon" x-bind:disabled="processing" isError>Remove</x-forms.button>
-                        @endif
+                        <div class="mb-2 text-sm font-medium leading-4">Icon</div>
+                        <div class="flex items-center gap-4">
+                            <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl bg-neutral-200 text-neutral-700 dark:bg-white/[0.1] dark:text-fg">
+                                <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
+                                @if ($project->icon_path)
+                                    <img x-show="!preview" src="{{ project_icon_url($project) }}"
+                                        alt="{{ $project->name }} icon" class="h-full w-full object-cover">
+                                @else
+                                    <x-reicon x-show="!preview" name="projects" class="size-6" />
+                                @endif
+                            </div>
+                            <div class="flex min-w-0 flex-1 flex-col gap-2">
+                                <div class="flex flex-wrap gap-2">
+                                    <input x-ref="iconInput" type="file" x-on:change="prepareIcon($event)"
+                                        accept="image/jpeg,image/png,image/webp" class="hidden">
+                                    <x-forms.button type="button" x-on:click="$refs.iconInput.click()"
+                                        x-bind:disabled="processing">
+                                        <span x-text="processing ? 'Uploading…' : 'Browse…'"></span>
+                                    </x-forms.button>
+                                    @if ($project->icon_path)
+                                        <x-forms.button type="button" wire:click="removeIcon" x-bind:disabled="processing"
+                                            isError>Remove</x-forms.button>
+                                    @endif
+                                </div>
+                                <p class="text-xs text-neutral-500 dark:text-fg-dim">JPG, PNG, or WebP. Shown in the projects list.</p>
+                                <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
+                                @error('icon')
+                                    <p class="text-xs text-red-500">{{ $message }}</p>
+                                @enderror
+                            </div>
+                        </div>
                     </div>
-                    <p x-cloak x-show="uploadError" x-text="uploadError" class="text-xs text-red-500"></p>
-                    @error('icon') <p class="text-xs text-red-500">{{ $message }}</p> @enderror
-                </div>
-            </div>
-        </section>
-
-        <form wire:submit="submit">
-            <x-unsaved-bar action="submit" />
-            <section class="application-settings-section">
-                <div class="application-settings-section-header">
-                    <div>
-                        <h2>Project details</h2>
-                        <p>Name and describe this project across the dashboard.</p>
-                    </div>
-                </div>
-                <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
                     <x-forms.input label="Name" id="name" />
                     <x-forms.input label="Description" id="description" />
                 </div>
diff --git a/resources/views/livewire/project/environment-canvas.blade.php b/resources/views/livewire/project/environment-canvas.blade.php
index 515a3de5d6..35535969e4 100644
--- a/resources/views/livewire/project/environment-canvas.blade.php
+++ b/resources/views/livewire/project/environment-canvas.blade.php
@@ -2,9 +2,9 @@
     <x-slot:title>
         {{ $environment->name }} > Canvas | Coolify
     </x-slot>
-    <div data-environment-canvas data-title="Environment canvas" data-project="{{ $project->uuid }}" data-environment="{{ $environment->uuid }}"
+    <div data-environment-canvas data-project="{{ $project->uuid }}" data-environment="{{ $environment->uuid }}"
         data-team="{{ $project->team_id }}" data-user="{{ auth()->id() }}"
-        data-new="{{ auth()->user()->can('createAnyResource') ? route('project.resource.create', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) : '' }}"
+        data-new="{{ auth()->user()->can('createAnyResource') ? route('deploy-canvas', ['project' => $project->uuid, 'environment' => $environment->uuid]) : '' }}"
         class="relative h-full" wire:ignore>
         {{-- The canvas moves this group into its toolbar; the page actions come last, at the right end. --}}
         <div data-ec-views class="flex items-center gap-2">
@@ -26,8 +26,9 @@
                 </a>
             @endcan
             @can('createAnyResource')
-                <a href="{{ route('project.resource.create', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
-                    {{ wireNavigate() }} class="button button-highlighted whitespace-nowrap">
+                {{-- A full page load: the deploy canvas uses the minimal layout. --}}
+                <a href="{{ route('deploy-canvas', ['project' => $project->uuid, 'environment' => $environment->uuid]) }}"
+                    class="button button-highlighted whitespace-nowrap">
                     <x-reicon name="plus" class="size-3.5" />
                     New resource
                 </a>
diff --git a/resources/views/livewire/project/index.blade.php b/resources/views/livewire/project/index.blade.php
index d57262e2e0..7a476c1c0c 100644
--- a/resources/views/livewire/project/index.blade.php
+++ b/resources/views/livewire/project/index.blade.php
@@ -48,7 +48,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-52!">
                         <x-slot:trigger>
                             <button type="button" class="button" aria-haspopup="listbox" :aria-expanded="open">
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index a9fa3dc5f6..2c20adb3a5 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -35,7 +35,7 @@
                                         :aria-selected="resourceType === option.value"
                                         @click="resourceType = option.value; close()">
                                         <span x-text="option.label"></span>
-                                        <x-reicon name="check-circle" class="size-3.5 text-black dark:text-fg"
+                                        <x-reicon name="check" class="size-3.5 text-black dark:text-fg"
                                             x-show="resourceType === option.value" />
                                     </button>
                                 </template>
@@ -71,7 +71,7 @@
                                         :aria-selected="selectedCategory === ''"
                                         @click="selectedCategory = ''; categorySearch = ''; categoryOpen = false">
                                         <span>All categories</span>
-                                        <x-reicon name="check-circle" class="size-3.5 text-black dark:text-fg"
+                                        <x-reicon name="check" class="size-3.5 text-black dark:text-fg"
                                             x-show="selectedCategory === ''" />
                                     </button>
                                     <template
@@ -81,7 +81,7 @@
                                             :aria-selected="selectedCategory === category"
                                             @click="selectedCategory = category; categorySearch = ''; categoryOpen = false">
                                             <span class="truncate" x-text="category"></span>
-                                            <x-reicon name="check-circle" class="size-3.5 text-black dark:text-fg"
+                                            <x-reicon name="check" class="size-3.5 text-black dark:text-fg"
                                                 x-show="selectedCategory === category" />
                                         </button>
                                     </template>
@@ -95,9 +95,9 @@
             {{-- A full page load: the canvas uses the minimal layout. --}}
             <a href="{{ route('deploy-canvas', ['project' => data_get($parameters, 'project_uuid'), 'environment' => data_get($parameters, 'environment_uuid')]) }}"
                 x-show="search === ''"
-                class="mt-6 flex items-center gap-4 rounded-xl border border-neutral-200 bg-white p-4 shadow-[0_1px_2px_rgb(0_0_0/0.05)] transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:shadow-none dark:hover:border-white/[0.14]">
+                class="mt-6 flex items-center gap-4 rounded-lg border border-neutral-200 bg-white p-4 shadow-[0_1px_2px_rgb(0_0_0/0.05)] transition-colors hover:border-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:border-white/[0.08] dark:bg-white/[0.05] dark:shadow-none dark:hover:border-white/[0.14]">
                 <div
-                    class="flex size-11 shrink-0 items-center justify-center rounded-xl border border-neutral-200 bg-neutral-50 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                    class="flex size-11 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                     <x-reicon name="deploy-canvas" class="size-5" />
                 </div>
                 <div class="min-w-0 flex-1">
@@ -340,7 +340,7 @@
                                             class="button" :class="{ 'opacity-60': docCheckInProgress[service.name] }">
                                             Docs
                                         </a>
-                                        <a x-show="serviceWebsiteUrl(service)" :href="serviceWebsiteUrl(service)"
+                                        <a x-show="service.website" :href="service.website"
                                             target="_blank" rel="noopener noreferrer" class="button" @click.stop>
                                             Website
                                         </a>
@@ -494,16 +494,6 @@
                         databaseWebsiteUrl(database) {
                             return this.databaseLinks[database.id]?.website;
                         },
-                        serviceWebsiteUrl(service) {
-                            const source = service.website || service.homepage || service.documentation;
-                            if (!source) return null;
-
-                            try {
-                                return new URL(source).origin;
-                            } catch (error) {
-                                return null;
-                            }
-                        },
                         async checkUrlExists(url) {
                             if (!url) return false;
                             try {
diff --git a/resources/views/livewire/project/project-canvas.blade.php b/resources/views/livewire/project/project-canvas.blade.php
index 86552e3c49..8083cdc921 100644
--- a/resources/views/livewire/project/project-canvas.blade.php
+++ b/resources/views/livewire/project/project-canvas.blade.php
@@ -2,7 +2,7 @@
     <x-slot:title>
         {{ $project->name }} > Canvas | Coolify
     </x-slot>
-    <div data-environment-canvas data-title="Project canvas" data-endpoint="/projects/{{ $project->uuid }}/canvas"
+    <div data-environment-canvas data-endpoint="/projects/{{ $project->uuid }}/canvas"
         data-empty="No resources in this project yet"
         data-view-only="Only team admins can move cards and edit links."
         data-team="{{ $project->team_id }}" data-user="{{ auth()->id() }}"
diff --git a/resources/views/livewire/project/projects-canvas.blade.php b/resources/views/livewire/project/projects-canvas.blade.php
index 8320d0a300..b909d6a39a 100644
--- a/resources/views/livewire/project/projects-canvas.blade.php
+++ b/resources/views/livewire/project/projects-canvas.blade.php
@@ -2,7 +2,7 @@
     <x-slot:title>
         Projects > Canvas | Coolify
     </x-slot>
-    <div data-environment-canvas data-title="Projects canvas" data-endpoint="/projects/canvas"
+    <div data-environment-canvas data-endpoint="/projects/canvas"
         data-empty="No resources in your projects yet"
         data-view-only="Only team admins can move cards and edit links."
         data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index 6c7d33685b..57dcd456d6 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -5,13 +5,31 @@
     <div x-data="resourceIndex()" class="w-full">
         <header class="mb-5 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
             <div class="min-w-0">
-                <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $environment->name }}</h1>
+                <div class="flex min-w-0 items-center gap-1.5">
+                    <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $environment->name }}</h1>
+                    @can('update', $project)
+                        <a href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
+                            {{ wireNavigate() }}
+                            class="flex size-7 shrink-0 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                            title="Environment settings"
+                            aria-label="Open settings for {{ $environment->name }}">
+                            <x-reicon name="settings" class="size-4" />
+                        </a>
+                    @endcan
+                </div>
                 <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
                     <span x-text="`${resources.length} ${resources.length === 1 ? 'resource' : 'resources'}`"></span>
-                    in {{ $project->name }}
+                    in <a href="{{ route('project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
+                        class="font-medium text-neutral-700 underline-offset-2 hover:text-black hover:underline dark:text-fg dark:hover:text-white"
+                        title="Show all environments in {{ $project->name }}">{{ $project->name }}</a>
                 </p>
             </div>
-            <div class="flex w-fit shrink-0 items-center gap-2">
+            <div class="flex flex-wrap items-center gap-2 sm:shrink-0">
+                @if ($environment->isEmpty())
+                    {{-- The list toolbar (with its canvas switch) is hidden when there are no resources. --}}
+                    <x-canvas-view-toggle :views="['list' => ['List view', 'unordered-list']]"
+                        :canvas-url="route('project.environment.canvas', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid])" />
+                @endif
                 <a href="{{ route('shared-variables.environment.show', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
                     {{ wireNavigate() }}
                     class="button whitespace-nowrap"
@@ -20,16 +38,6 @@
                     <x-reicon name="variables" class="size-3.5" />
                     Shared variables
                 </a>
-                @can('update', $project)
-                    <a href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
-                        {{ wireNavigate() }}
-                        class="button whitespace-nowrap"
-                        title="Environment settings"
-                        aria-label="Open settings for {{ $environment->name }}">
-                        <x-reicon name="settings" class="size-3.5" />
-                        Settings
-                    </a>
-                @endcan
                 @can('createAnyResource')
                     <a href="{{ route('project.resource.create', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}"
                         {{ wireNavigate() }}
@@ -74,7 +82,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-64! overflow-hidden! p-0!" :multiselectable="true">
                         <x-slot:trigger>
                             <button type="button" class="button max-w-64"
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
index ee992b9a47..761b2e2dce 100644
--- a/resources/views/livewire/project/service/backup-executions.blade.php
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -1,4 +1,13 @@
-<div>
+<div x-on:open-backup-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
+    @if ($executions->onFirstPage())
+        <div wire:poll.5000ms class="hidden"></div>
+    @endif
+    @php
+        $server = $service->server;
+    @endphp
     @if ($selectedExecution)
         <x-modal-input title="Backup execution" wireOpen="executionModalOpen" :wireIgnore="false" isLarge>
             <x-slot:content><span></span></x-slot:content>
@@ -6,7 +15,7 @@
                 <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
                     <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Target</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['target'] }}</p></div>
                     <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Status</p><p class="mt-1 text-sm font-medium">{{ str($selectedExecution['status'])->headline() }}</p></div>
-                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Started</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['started_at']->diffForHumans() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Started</p><p class="mt-1 text-sm font-medium" title="{{ $selectedExecution['started_at']->diffForHumans() }}">{{ formatDateInServerTimezone($selectedExecution['started_at'], $server) }}</p></div>
                     <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Size</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['size'] ? formatBytes($selectedExecution['size']) : '-' }}</p></div>
                 </div>
                 @if ($selectedExecution['filename'])
@@ -32,7 +41,7 @@
         @else
             <div class="data-table relative w-full overflow-x-auto">
                 <x-table.loading target="previousPage,nextPage,setPage,perPage" text="Loading executions..." />
-                <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
+                <div class="data-table-header grid min-w-[900px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_190px_90px_48px]">
                     <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
                 </div>
                 @foreach ($executions as $execution)
@@ -47,7 +56,7 @@
                     <div wire:key="service-backup-execution-{{ $execution['id'] }}"
                         wire:click="openExecution('{{ $execution['uuid'] }}')"
                         wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
-                        class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
+                        class="data-table-row grid min-w-[900px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_190px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
                         <span class="flex min-w-0 items-center gap-2 font-medium text-neutral-950 dark:text-fg">
                             <span class="truncate" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
                             <span tabindex="0" data-tooltip="{{ $execution['s3_tooltip'] }}"
@@ -57,10 +66,18 @@
                         </span>
                         <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
                         <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
-                        <span>{{ $execution['started_at']->diffForHumans() }}</span>
+                        <span>
+                            <span class="block">{{ formatDateInServerTimezone($execution['started_at'], $server) }}</span>
+                            <span class="text-[11px] text-neutral-500 dark:text-fg-faint">{{ $execution['started_at']->diffForHumans() }}</span>
+                        </span>
                         <span>{{ $execution['size'] ? formatBytes($execution['size']) : '-' }}</span>
                         <span class="flex justify-end">
-                            @if ($execution['download_url'])
+                            @if ($execution['download_url'] && $s3Downloads)
+                                <button type="button" wire:click.stop="downloadExecution('{{ $execution['uuid'] }}')"
+                                    class="icon-button shrink-0" title="Download backup" aria-label="Download backup">
+                                    <x-reicon name="upload" class="size-3.5 rotate-180" />
+                                </button>
+                            @elseif ($execution['download_url'])
                                 <a href="{{ $execution['download_url'] }}" target="_blank" rel="noopener"
                                     @click.stop class="icon-button shrink-0" title="Download backup"
                                     aria-label="Download backup">
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index 0cc231603a..a0dbc2bfb3 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -6,51 +6,6 @@
     <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="$query" />
 
     @php
-        $serviceRouteParameters = [
-            'project_uuid' => $project->uuid,
-            'environment_uuid' => $environment->uuid,
-            'service_uuid' => $service->uuid,
-        ];
-
-        $configurationItems = collect([
-            ['label' => 'General', 'route' => 'project.service.configuration', 'icon' => 'settings'],
-            ['label' => 'Domains', 'route' => 'project.service.domains', 'icon' => 'globe'],
-            ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
-            ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
-            ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
-            ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
-            ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
-            ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
-            ['label' => 'Analytics', 'route' => 'project.service.analytics', 'icon' => 'analytics'],
-            ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
-            ['label' => 'Webhooks', 'route' => 'project.service.webhooks', 'icon' => 'notifications'],
-            ['label' => 'Resource Operations', 'route' => 'project.service.resource-operations', 'icon' => 'server-update'],
-            ['label' => 'Tags', 'route' => 'project.service.tags', 'icon' => 'tags'],
-            ['label' => 'Danger Zone', 'route' => 'project.service.danger', 'icon' => 'shield-alert'],
-        ])->filter(fn (array $item): bool => $item['visible'] ?? true)->map(fn (array $item): array => [
-            ...$item,
-            'active' => $currentRoute === $item['route']
-                || ($item['route'] === 'project.service.scheduled-tasks.show'
-                    && str($currentRoute)->startsWith('project.service.scheduled-tasks')),
-        ]);
-
-        $menuGroups = [
-            'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
-            'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Analytics'],
-            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
-            'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
-        ];
-
-        $groupedItems = collect($menuGroups)
-            ->map(fn (array $labels) => collect($labels)
-                ->map(fn (string $label) => $configurationItems->firstWhere('label', $label))
-                ->filter()
-                ->values())
-            ->filter(fn ($items) => $items->isNotEmpty());
-
-        // Group that holds the current page — always kept open, even if collapsed before.
-        $activeGroup = (string) $groupedItems->search(fn ($items) => $items->contains(fn ($item) => $item['active'] ?? false));
-
         $storageSections = $applications
             ->concat($databases)
             ->map(fn ($resource): array => [
@@ -61,57 +16,8 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            <aside class="application-settings-navigation min-w-0 xl:self-start"
-                data-settings-search-items="{{ json_encode(settingsSearchItems($groupedItems, $serviceRouteParameters)) }}">
-                <nav aria-label="Service settings"
-                    x-data="settingsSidebarAccordion({ activeGroup: @js($activeGroup), storageKey: 'coolify.settings-sidebar.service' })"
-                    class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                    @foreach ($groupedItems as $groupLabel => $groupItems)
-                        @unless ($loop->first)
-                            <div class="my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]"
-                                aria-hidden="true"></div>
-                        @endunless
-                        <button type="button" class="nav-section-toggle hidden xl:flex" @click="toggle(@js($groupLabel))"
-                            :aria-expanded="isOpen(@js($groupLabel))">
-                            <span>{{ $groupLabel }}</span>
-                            <svg class="size-3 shrink-0 opacity-60 transition-transform"
-                                :class="!isOpen(@js($groupLabel)) && '-rotate-90'" viewBox="0 0 24 24" fill="none"
-                                stroke="currentColor" stroke-width="2" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="m6 9 6 6 6-6" />
-                            </svg>
-                        </button>
-                        <div class="contents" :class="isOpen(@js($groupLabel)) ? 'xl:block' : 'xl:hidden'">
-                        @foreach ($groupItems as $menuItem)
-                            <a @class([
-                                'menu-item',
-                                'menu-item-active' => $menuItem['active'],
-                            ])
-                                @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                                href="{{ route($menuItem['route'], $serviceRouteParameters) }}">
-                                <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
-                                <span class="menu-item-label">{{ $menuItem['label'] }}</span>
-                                @if ($menuItem['hasWarning'] ?? false)
-                                    <span class="ml-auto size-2 shrink-0 rounded-full bg-error" title="Required environment variables missing"></span>
-                                @endif
-                            </a>
-                            @if ($menuItem['active'] && $menuItem['route'] === 'project.service.storages' && $storageSections->isNotEmpty())
-                                <div class="nav-children hidden flex-col gap-0.5 py-1 xl:flex"
-                                    x-data="{ activeSection: '' }">
-                                    @foreach ($storageSections as $section)
-                                        <button type="button" class="menu-subitem"
-                                            :class="activeSection === '{{ $section['id'] }}' && 'menu-subitem-active'"
-                                            @click="activeSection = '{{ $section['id'] }}'; window.scrollToSettingsSection?.('{{ $section['id'] }}')">
-                                            <span class="menu-item-label truncate text-left"
-                                                title="{{ $section['label'] }}">{{ $section['label'] }}</span>
-                                        </button>
-                                    @endforeach
-                                </div>
-                            @endif
-                        @endforeach
-                        </div>
-                    @endforeach
-                </nav>
-            </aside>
+            <x-service.configuration-sidebar :service="$service" :current-route="$currentRoute"
+                :storage-sections="$storageSections" />
 
             <div class="min-w-0">
                 @if ($currentRoute === 'project.service.configuration')
@@ -132,25 +38,7 @@
                                 </p>
                             </div>
                             <div class="flex w-full items-center justify-between gap-2 sm:w-auto sm:justify-start">
-                                <div
-                                    class="view-toggle">
-                                    <button type="button" x-on:click="setViewMode('table')"
-                                        class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                                        :class="viewMode === 'table'
-                                            ? 'control-selected'
-                                            : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                                        aria-label="Table view" title="Table view">
-                                        <x-reicon name="unordered-list" class="size-3.5" />
-                                    </button>
-                                    <button type="button" x-on:click="setViewMode('grid')"
-                                        class="flex size-7.5 items-center justify-center rounded-md transition-colors"
-                                        :class="viewMode === 'grid'
-                                            ? 'control-selected'
-                                            : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'"
-                                        aria-label="Grid view" title="Grid view">
-                                        <x-reicon name="grid" class="size-3.5" />
-                                    </button>
-                                </div>
+                                <x-canvas-view-toggle />
                                 <a class="button" target="_blank" href="{{ $service->documentation() }}">
                                     Documentation
                                     <x-reicon name="external-link" class="size-4" />
@@ -218,8 +106,6 @@
                     </div>
                 @elseif ($currentRoute === 'project.service.scheduled-tasks.show')
                     <livewire:project.shared.scheduled-task.all :resource="$service" />
-                @elseif ($currentRoute === 'project.service.scheduled-tasks')
-                    <livewire:project.shared.scheduled-task.show />
                 @elseif ($currentRoute === 'project.service.webhooks')
                     <livewire:project.shared.webhooks :resource="$service" />
                 @elseif ($currentRoute === 'project.service.resource-operations')
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 268eaae499..798a4a8eae 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -4,14 +4,17 @@
     @endunless
     <section @class(['application-settings-workspace mt-4 w-full max-w-none lg:mt-0' => ! $embedded])>
         <div @class(['grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8' => ! $embedded])>
+        @unless ($embedded)
+            {{-- The service menu, one Back away from this compose resource menu in the main sidebar. --}}
+            <x-service.configuration-sidebar :service="$service" current-route="project.service.configuration" nav-only />
+        @endunless
         @if (! $embedded && $resourceType === 'database')
             <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" />
         @elseif (! $embedded)
-            <aside class="application-settings-navigation min-w-0 xl:self-start">
+            <x-main-nav-menu :depth="1" back-label="Service" back-title="Back to the service menu">
                 <nav aria-label="Compose resource settings"
                     class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                    <div class="nav-section hidden xl:block">Compose resource</div>
-                <a class="menu-item" {{ wireNavigate() }}
+                <a class="menu-item" data-page-only {{ wireNavigate() }}
                     href="{{ route('project.service.configuration', [...$parameters, 'stack_service_uuid' => null]) }}">
                     <x-reicon name="logout" class="menu-item-icon rotate-180" />
                     <span class="menu-item-label">Back to service</span>
@@ -22,7 +25,7 @@
                     <span class="menu-item-label">General</span>
                 </a>
                 </nav>
-            </aside>
+            </x-main-nav-menu>
         @endif
         <div class="min-w-0">
             @if ($resourceType === 'application')
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index acde772a26..e3605b7a7f 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -76,7 +76,7 @@
 
                 <x-backup-tabs context="service-schedule" :parameters="$parameters" section="general" />
 
-                @foreach (['general', 's3', 'retention', 'danger'] as $modalSection)
+                @foreach (['general', 'danger'] as $modalSection)
                     <div x-show="activeSection === '{{ $modalSection }}'" x-cloak>
                         @if ($selectedDatabaseBackup)
                             <livewire:project.database.backup-edit :backup="$selectedDatabaseBackup"
@@ -240,7 +240,7 @@
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
-                    <div class="min-w-[64rem]">
+                    <div class="flex min-w-[64rem] flex-col">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
diff --git a/resources/views/livewire/project/shared/environment-variable/all.blade.php b/resources/views/livewire/project/shared/environment-variable/all.blade.php
index 4d0b12d3be..6c4dd401dd 100644
--- a/resources/views/livewire/project/shared/environment-variable/all.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/all.blade.php
@@ -47,9 +47,11 @@
                                 ['value' => true, 'label' => 'Docker BuildKit secrets'],
                             ]" :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
                     </div>
-                @else
-                    <p class="text-sm text-neutral-500 dark:text-fg-dim">Manage this resource's environment variables below.</p>
                 @endif
+                <x-forms.checkbox instantSave="saveCoolifyDefaultVariables" id="include_coolify_default_variables"
+                    label="Include Coolify default variables"
+                    helper="Adds COOLIFY_APP_NAME, COOLIFY_PROJECT_NAME, COOLIFY_ENVIRONMENT_NAME and COOLIFY_SERVER_IP to the container at runtime. A variable that you define with the same name wins. Takes effect after the next deploy or restart."
+                    :disabled="! auth()->user()->can('manageEnvironment', $resource)" />
                 @if ($this->hasLogRedactionSetting())
                     <div class="grid w-full items-end gap-4 sm:grid-cols-2">
                         <x-forms.listbox id="redact_all_env_values_in_logs" label="Environment values in logs"
diff --git a/resources/views/livewire/project/shared/file-browser.blade.php b/resources/views/livewire/project/shared/file-browser.blade.php
new file mode 100644
index 0000000000..7611ac6967
--- /dev/null
+++ b/resources/views/livewire/project/shared/file-browser.blade.php
@@ -0,0 +1,434 @@
+<div wire:init="loadFiles" x-on:open-file-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
+    <x-slot:title>
+        {{ data_get_str($resource, 'name')->limit(10) }} > Files | Coolify
+    </x-slot>
+
+    @if ($type === 'application')
+        <livewire:project.application.heading :application="$resource" wire:key="application-heading-files" />
+    @elseif ($type === 'service')
+        <livewire:project.service.heading :service="$resource" :parameters="$parameters" title="Files" />
+    @else
+        <livewire:project.database.heading :database="$resource" />
+    @endif
+
+    {{-- Standard resource settings workspace (matches Logs/Configuration) so the
+         heading spacing and sidebar behave identically to every other page. --}}
+    <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0"
+        x-data="{
+            busy: null,
+            {{-- Show a label for the running action over the listing. The short
+                 delay skips the overlay for fast requests. --}}
+            run(label, action) {
+                const timer = setTimeout(() => this.busy = label, 150);
+                return Promise.resolve().then(action).catch(() => {}).finally(() => {
+                    clearTimeout(timer);
+                    this.busy = null;
+                });
+            },
+            uploadFile(file) {
+                return this.run('Uploading file...', () => new Promise((resolve, reject) => {
+                    this.$wire.upload('upload', file, () => this.$wire.uploadFile().then(resolve, reject), reject);
+                }));
+            },
+        }">
+        <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            @if ($type === 'application')
+                <x-application.configuration-sidebar :application="$resource"
+                    current-route="project.application.files" />
+            @elseif ($type === 'service')
+                <x-service.configuration-sidebar :service="$resource"
+                    current-route="project.service.files" />
+            @else
+                <x-database.configuration-sidebar :database="$resource"
+                    current-route="project.database.files" />
+            @endif
+
+            <div class="min-w-0">
+    <x-application.settings-section title="Files"
+        helper="Browse and manage files inside the running container." :flush="true">
+
+        <x-slot:badges>
+            <x-beta-badge />
+        </x-slot:badges>
+
+        <x-slot:actions>
+            @if ($containerRunning && $filesLoaded)
+                <input type="file" class="hidden" x-ref="uploadInput"
+                    @change="if ($event.target.files.length) { uploadFile($event.target.files[0]); $event.target.value = '' }" />
+                <x-forms.button type="button" title="Upload a file to this folder" canGate="canAccessTerminal" :canResource="$resource"
+                    wire:target="uploadFile" @click="$refs.uploadInput.click()">
+                    Upload
+                </x-forms.button>
+
+                <div x-data="{ creationMenuOpen: false }" @keydown.escape.window="creationMenuOpen = false">
+                    <x-forms.button type="button" x-ref="newTrigger"
+                        @click="creationMenuOpen = !creationMenuOpen" x-bind:aria-expanded="creationMenuOpen"
+                        canGate="canAccessTerminal" :canResource="$resource">
+                        New
+                        <x-reicon name="chevron-down" class="size-3.5" />
+                    </x-forms.button>
+                    <template x-teleport="body">
+                        <div x-show="creationMenuOpen" x-cloak x-transition.opacity.duration.120ms
+                            x-anchor.bottom-end.fixed.offset.4="$refs.newTrigger"
+                            @click.outside="creationMenuOpen = false"
+                            class="listbox-panel min-w-36! w-36! z-50!">
+                            <x-modal-input title="New file">
+                                <x-slot:content>
+                                    <button type="button" class="listbox-option" @click="creationMenuOpen = false">
+                                        <x-reicon name="file" class="size-3.5 shrink-0" />
+                                        <span class="flex-1 text-left">New file</span>
+                                    </button>
+                                </x-slot:content>
+                                <form x-data="{ name: '' }"
+                                    @submit.prevent="run('Creating file...', () => $wire.createFile(name)); name=''; $dispatch('close-modal')"
+                                    class="flex flex-col gap-4">
+                                    <x-forms.input id="newFileName" label="File name" x-model="name"
+                                        placeholder="config.yml" required />
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Create file</x-forms.button>
+                                    </div>
+                                </form>
+                            </x-modal-input>
+
+                            <x-modal-input title="New folder">
+                                <x-slot:content>
+                                    <button type="button" class="listbox-option" @click="creationMenuOpen = false">
+                                        <x-reicon name="folder" class="size-3.5 shrink-0" />
+                                        <span class="flex-1 text-left">New folder</span>
+                                    </button>
+                                </x-slot:content>
+                                <form x-data="{ name: '' }"
+                                    @submit.prevent="run('Creating folder...', () => $wire.createDirectory(name)); name=''; $dispatch('close-modal')"
+                                    class="flex flex-col gap-4">
+                                    <x-forms.input id="newFolderName" label="Folder name" x-model="name"
+                                        placeholder="plugins" required />
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Create folder</x-forms.button>
+                                    </div>
+                                </form>
+                            </x-modal-input>
+                        </div>
+                    </template>
+                </div>
+
+                <x-forms.button type="button" @click="run('Loading files...', () => $wire.refresh())" title="Refresh this folder">
+                    Refresh
+                </x-forms.button>
+            @endif
+        </x-slot:actions>
+
+        @if ($loadFailed)
+            <x-empty title="Could not load files" description="Check the server connection and try again." />
+            <div class="flex justify-center pb-4">
+                <x-forms.button wire:click="loadFiles">Retry</x-forms.button>
+            </div>
+        @elseif (! $filesLoaded)
+            <div class="flex justify-center py-12">
+                <x-loading text="Loading files..." />
+            </div>
+        @elseif (! $containerRunning)
+            <x-empty title="Container is not running"
+                description="Start the container to browse its files.">
+                <x-slot:icon>
+                    <x-reicon name="folder" class="size-8" />
+                </x-slot:icon>
+            </x-empty>
+        @else
+            {{-- Keep the current listing visible while an action runs: blur it
+                 and show the action label (from run()) on top of it. --}}
+            <div class="relative">
+            <div x-show="busy" x-cloak class="absolute inset-0 z-10">
+                <div class="flex h-full items-start justify-center">
+                    <div class="sticky top-[40vh] mt-12 inline-flex items-center gap-2 rounded-md bg-white px-3 py-1.5 text-[13px] text-neutral-500 shadow-sm ring-1 ring-black/5 dark:bg-coolgray-100 dark:text-fg-dim dark:ring-white/10">
+                        <x-loading />
+                        <span x-text="busy"></span>
+                    </div>
+                </div>
+            </div>
+            <div x-bind:class="busy && 'pointer-events-none select-none blur-[2px] opacity-60'"
+                class="transition-[filter,opacity] duration-150 motion-reduce:transition-none">
+            {{-- Container picker (services / multi-container) --}}
+            @if (count($availableContainers) > 1)
+                <div class="flex flex-wrap items-center gap-2 border-b border-coollabs-hairline px-4 py-2">
+                    <span class="text-xs text-coollabs-subtle">Container</span>
+                    @foreach ($availableContainers as $name)
+                        <button type="button" x-on:click="run('Loading files...', () => $wire.selectContainer(@js($name)))"
+                            @class([
+                                'button',
+                                'bg-coollabs/10 text-coollabs ring-coollabs/25 dark:bg-white/[0.08] dark:text-white dark:ring-white/15' => $name === $container,
+                            ])>{{ $name }}</button>
+                    @endforeach
+                </div>
+            @endif
+
+            {{-- Breadcrumb. The root crumb renders as "/" and doubles as the
+                 first separator, so we only draw a slash between named segments
+                 (index >= 2) - avoids the "/ /" duplicate. --}}
+            <div class="flex flex-wrap items-center gap-1 px-4 py-2 text-sm">
+                @foreach ($this->breadcrumbs() as $crumb)
+                    @if ($loop->index > 1)
+                        <span class="text-coollabs-subtle">/</span>
+                    @endif
+                    <button type="button" x-on:click="run('Loading files...', () => $wire.goTo(@js($crumb['path'])))"
+                        @class([
+                            'rounded-md px-1.5 py-0.5 hover:bg-black/5 hover:text-current dark:hover:bg-white/[0.06]',
+                            'text-current font-medium' => $loop->last,
+                            'text-coollabs-subtle' => ! $loop->last,
+                        ])>
+                        {{ $crumb['label'] }}
+                    </button>
+                @endforeach
+            </div>
+
+            {{-- Drag-and-drop file list --}}
+            <div x-data="{ dragging: false }"
+                @dragover.prevent="dragging = true"
+                @dragleave.prevent="dragging = false"
+                @drop.prevent="dragging = false; if ($event.dataTransfer.files.length) { uploadFile($event.dataTransfer.files[0]) }"
+                :class="dragging ? 'ring-2 ring-coollabs/40 dark:ring-white/30' : ''"
+                class="transition-[box-shadow] duration-150 ease-out motion-reduce:transition-none">
+                @if (count($entries) === 0)
+                    <x-empty size="sm" title="This folder is empty"
+                        description="Upload a file to get started.">
+                        <x-slot:icon>
+                            <x-reicon name="folder" class="size-8" />
+                        </x-slot:icon>
+                    </x-empty>
+                @else
+                    <div class="data-table w-full">
+                        <div class="data-table-header file-table-grid">
+                            <span></span>
+                            <span>Name</span>
+                            <span>Perms</span>
+                            <span>Owner</span>
+                            <span>Group</span>
+                            <span class="text-right">Size</span>
+                            <span>Modified</span>
+                            <span class="text-right">Actions</span>
+                        </div>
+                        @foreach ($entries as $entry)
+                            <div wire:key="entry-{{ $entry['name'] }}" class="data-table-row file-table-grid">
+                                <div class="flex items-center">
+                                    <x-reicon :name="$entry['type'] === 'dir' ? 'folder-filled' : 'file'"
+                                        class="size-4 {{ $entry['type'] === 'dir' ? 'text-coollabs dark:text-neutral-200' : 'text-coollabs-subtle opacity-70' }}" />
+                                </div>
+                                <div class="min-w-0">
+                                    @if ($entry['type'] === 'dir')
+                                        <button type="button" x-on:click="run('Loading files...', () => $wire.open(@js($entry['name'])))"
+                                            class="block w-full cursor-pointer truncate text-left font-medium hover:text-coollabs hover:underline dark:hover:text-white">{{ $entry['name'] }}</button>
+                                    @else
+                                        <span class="block truncate">{{ $entry['name'] }}</span>
+                                    @endif
+                                </div>
+                                {{-- Permissions (click to chmod) --}}
+                                <div class="min-w-0">
+                                    <x-modal-input title="Change permissions">
+                                        <x-slot:content>
+                                            <button type="button" title="Edit permissions"
+                                                class="cursor-pointer rounded-md px-1.5 py-0.5 font-mono text-xs text-coollabs-subtle hover:bg-black/5 hover:text-current dark:hover:bg-white/[0.06]">
+                                                {{ $entry['perms'] ?: '-' }}
+                                            </button>
+                                        </x-slot:content>
+                                        <form x-data="{ mode: @js($entry['perms']) }"
+                                            @submit.prevent="run('Updating permissions...', () => $wire.chmodEntry(@js($entry['name']), mode)); $dispatch('close-modal')"
+                                            class="flex flex-col gap-4">
+                                            <p class="text-sm text-coollabs-subtle">
+                                                Set the octal permission mode for
+                                                <span class="font-medium">{{ $entry['name'] }}</span>.
+                                            </p>
+                                            <x-forms.input id="chmodMode-{{ $loop->index }}" label="Octal mode"
+                                                x-model="mode" placeholder="644" required />
+                                            <div class="flex justify-end">
+                                                <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Apply</x-forms.button>
+                                            </div>
+                                        </form>
+                                    </x-modal-input>
+                                </div>
+                                <div class="min-w-0 truncate text-coollabs-subtle">
+                                    {{ $entry['owner'] ?: '-' }}
+                                </div>
+                                <div class="min-w-0 truncate text-coollabs-subtle">
+                                    {{ $entry['group'] ?: '-' }}
+                                </div>
+                                <div class="text-right text-coollabs-subtle tabular-nums">
+                                    {{ $entry['type'] === 'dir' ? '-' : formatBytes($entry['size']) }}
+                                </div>
+                                <div class="text-coollabs-subtle tabular-nums">
+                                    {{ $entry['mtime'] ? \Illuminate\Support\Carbon::createFromTimestamp($entry['mtime'])->toDateTimeString() : '-' }}
+                                </div>
+                                {{-- Actions kebab. The entry name lives in this
+                                     row's x-data as a JS string so the menu can
+                                     call $wire.* with it directly - passing @js()
+                                     through a component attribute double-encodes
+                                     the quotes and breaks the handler. --}}
+                                <div class="flex items-center justify-end"
+                                    x-data="{ open: false, name: @js($entry['name']), isDir: @js($entry['type'] === 'dir') }"
+                                    @keydown.escape.window="open = false">
+                                    <div class="relative">
+                                        <button type="button" title="Actions" aria-label="Actions" x-ref="trigger"
+                                            x-on:click="open = !open" x-bind:aria-expanded="open"
+                                            x-bind:class="open && 'bg-black/5 text-current dark:bg-white/[0.08]'"
+                                            class="inline-flex size-7 cursor-pointer items-center justify-center rounded-md text-coollabs-subtle hover:bg-black/5 hover:text-current focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs/40 dark:hover:bg-white/[0.06] dark:focus-visible:ring-white/30">
+                                            <x-reicon name="dots-horizontal" class="size-4" />
+                                        </button>
+                                        <template x-teleport="body">
+                                            <div x-show="open" x-cloak x-transition.opacity.duration.120ms
+                                                x-anchor.bottom-end.fixed.offset.4="$refs.trigger"
+                                                @click.outside="open = false"
+                                                class="listbox-panel min-w-52! w-52! z-50!">
+                                                @if ($entry['type'] !== 'dir')
+                                                    <button type="button" class="listbox-option"
+                                                        x-on:click="open = false; run('Opening file...', () => $wire.openEditor(name))">
+                                                        <x-reicon name="file-content" class="size-3.5 shrink-0" />
+                                                        <span class="min-w-0 flex-1 text-left">Edit</span>
+                                                    </button>
+                                                @endif
+                                                <button type="button" class="listbox-option"
+                                                    x-on:click="open = false; run(isDir ? 'Preparing folder download...' : 'Preparing file download...', () => $wire.download(name))">
+                                                    <x-reicon name="download" class="size-3.5 shrink-0" />
+                                                    <span class="min-w-0 flex-1 text-left">Download</span>
+                                                </button>
+
+                                                {{-- Rename --}}
+                                                <x-modal-input title="Rename">
+                                                    <x-slot:content>
+                                                        <button type="button" class="listbox-option" x-on:click="open = false">
+                                                            <x-reicon name="edit" class="size-3.5 shrink-0" />
+                                                            <span class="min-w-0 flex-1 text-left">Rename</span>
+                                                        </button>
+                                                    </x-slot:content>
+                                                    <form x-data="{ newName: @js($entry['name']) }"
+                                                        @submit.prevent="run('Renaming...', () => $wire.renameEntry(name, newName)); $dispatch('close-modal')"
+                                                        class="flex flex-col gap-4">
+                                                        <x-forms.input id="renameName-{{ $loop->index }}"
+                                                            label="New name" x-model="newName" required />
+                                                        <div class="flex justify-end">
+                                                            <x-forms.button type="submit" isHighlighted canGate="canAccessTerminal" :canResource="$resource">Rename</x-forms.button>
+                                                        </div>
+                                                    </form>
+                                                </x-modal-input>
+
+                                                {{-- Delete --}}
+                                                <x-modal-input title="Delete this item?">
+                                                    <x-slot:content>
+                                                        <button type="button" class="listbox-option" x-on:click="open = false">
+                                                            <x-reicon name="trash" class="size-3.5 shrink-0 text-red-600 dark:text-red-500" />
+                                                            <span class="min-w-0 flex-1 text-left text-red-600 dark:text-red-500">Delete</span>
+                                                        </button>
+                                                    </x-slot:content>
+                                                    <div class="flex flex-col gap-4">
+                                                        <p class="text-sm text-coollabs-subtle">
+                                                            This permanently deletes
+                                                            <span class="font-medium">{{ $entry['name'] }}</span>
+                                                            inside the container. This cannot be undone.
+                                                        </p>
+                                                        <div class="flex justify-end">
+                                                            <x-forms.button isError type="button" canGate="canAccessTerminal" :canResource="$resource"
+                                                                x-on:click="run(isDir ? 'Deleting folder...' : 'Deleting file...', () => $wire.deleteEntry(name)); $dispatch('close-modal')">Delete</x-forms.button>
+                                                        </div>
+                                                    </div>
+                                                </x-modal-input>
+                                            </div>
+                                        </template>
+                                    </div>
+                                </div>
+                            </div>
+                        @endforeach
+                    </div>
+                @endif
+            </div>
+            </div>
+            </div>
+
+            {{-- Editor modal (opens when a text file is loaded) --}}
+            <x-modal-input title="Edit file" :wireOpen="'editorOpen'" :content="true" wireIgnore="false" isLarge>
+                <x-slot:content>
+                    <span class="hidden"></span>
+                </x-slot:content>
+                <form @submit.prevent="run('Saving file...', () => $wire.saveEditor())" class="flex flex-col gap-4">
+                    <div class="flex items-center justify-between gap-2">
+                        <p class="truncate font-mono text-xs text-coollabs-subtle">{{ $editingPath }}</p>
+                        @if ($editorLanguage)
+                            <span class="shrink-0 rounded-md bg-coollabs/10 px-1.5 py-0.5 font-mono text-[11px] text-coollabs dark:bg-white/[0.08] dark:text-neutral-200">{{ $editorLanguage }}</span>
+                        @endif
+                    </div>
+                    {{-- Monaco editor, kept mounted across opens (wire:ignore) and
+                         preloaded on page init so the first Edit click is instant.
+                         openEditor dispatches load-file-editor with the content and
+                         Monaco language id; we setValue + setModelLanguage without
+                         recreating, so highlighting applies and there is no flash.
+                         Inline Alpine (like x-forms.monaco-editor) means this works
+                         without a JS rebuild. --}}
+                    <div wire:ignore class="min-w-0" x-init="loadMonaco()"
+                        x-on:load-file-editor.window="load($event.detail)"
+                        x-data="{
+                            vs: '/js/monaco-editor-0.52.2/min/vs',
+                            base: '/js/monaco-editor-0.52.2/min',
+                            isDark() {
+                                return document.documentElement.classList.contains('dark') || localStorage.theme === 'dark' || (!('theme' in localStorage) && window.matchMedia('(prefers-color-scheme: dark)').matches);
+                            },
+                            loadMonaco() {
+                                if (window.__fileEditorMonaco) return window.__fileEditorMonaco;
+                                const vs = this.vs, base = this.base;
+                                window.__fileEditorMonaco = new Promise((resolve, reject) => {
+                                    const boot = () => {
+                                        window.require.config({ paths: { vs } });
+                                        const proxy = URL.createObjectURL(new Blob([`self.MonacoEnvironment={baseUrl:'${window.location.origin}${base}'};importScripts('${window.location.origin}${vs}/base/worker/workerMain.js');`], { type: 'text/javascript' }));
+                                        window.MonacoEnvironment = { getWorkerUrl: () => proxy };
+                                        window.require(['vs/editor/editor.main'], () => resolve(window.monaco));
+                                    };
+                                    if (typeof window.require !== 'undefined' && window.require.config) { boot(); return; }
+                                    const s = document.createElement('script');
+                                    s.src = `${vs}/loader.js`; s.onload = boot; s.onerror = reject;
+                                    document.head.appendChild(s);
+                                });
+                                return window.__fileEditorMonaco;
+                            },
+                            ensureTheme(monaco) {
+                                if (window.__fileEditorThemeDefined) return;
+                                monaco.editor.defineTheme('coolify-dark', { base: 'vs-dark', inherit: true, rules: [], colors: { 'editor.background': '#0b0b0c', 'editorGutter.background': '#0b0b0c', 'minimap.background': '#0b0b0c' } });
+                                window.__fileEditorThemeDefined = true;
+                            },
+                            async load(detail) {
+                                const monaco = await this.loadMonaco();
+                                this.ensureTheme(monaco);
+                                const el = this.$refs.editor;
+                                const wire = this.$wire;
+                                const content = (detail && detail.content) || '';
+                                const language = (detail && detail.language) || 'plaintext';
+                                // Keep the Monaco instance on the DOM node, NOT in
+                                // Alpine reactive state - proxying its huge object
+                                // graph would hang and crash the tab.
+                                if (!el._monacoEditor) {
+                                    const editor = monaco.editor.create(el, { value: content, language, theme: this.isDark() ? 'coolify-dark' : 'vs', automaticLayout: true, minimap: { enabled: false }, fontSize: 14, lineNumbersMinChars: 3, scrollBeyondLastLine: false, renderLineHighlight: 'all', padding: { top: 12, bottom: 12 }, scrollbar: { verticalScrollbarSize: 8, horizontalScrollbarSize: 8, useShadows: false } });
+                                    el._monacoEditor = editor;
+                                    editor.onDidChangeModelContent(() => { wire.set('editorContent', editor.getValue(), false); });
+                                    new MutationObserver(() => monaco.editor.setTheme(this.isDark() ? 'coolify-dark' : 'vs')).observe(document.documentElement, { attributes: true, attributeFilter: ['class'] });
+                                } else {
+                                    const model = el._monacoEditor.getModel();
+                                    model.setValue(content);
+                                    monaco.editor.setModelLanguage(model, language);
+                                }
+                                const editor = el._monacoEditor;
+                                this.$nextTick(() => { editor.layout(); setTimeout(() => editor.focus(), 40); });
+                            }
+                        }">
+                        <div x-ref="editor" class="file-editor-monaco"></div>
+                    </div>
+                    <div class="flex justify-end gap-2">
+                        <x-forms.button type="button" wire:click="closeEditor"
+                            @click="$dispatch('close-modal')">Cancel</x-forms.button>
+                        <x-forms.button type="submit" isHighlighted
+                            @click="$dispatch('close-modal')">Save changes</x-forms.button>
+                    </div>
+                </form>
+            </x-modal-input>
+        @endif
+    </x-application.settings-section>
+            </div>
+        </div>
+    </section>
+</div>
diff --git a/resources/views/livewire/project/shared/scheduled-task/all.blade.php b/resources/views/livewire/project/shared/scheduled-task/all.blade.php
index 89741ff9a2..74b962edb6 100644
--- a/resources/views/livewire/project/shared/scheduled-task/all.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/all.blade.php
@@ -1,4 +1,13 @@
 <div>
+    @if ($selectedTask)
+        <x-modal-input title="Edit scheduled task" :subtitle="$selectedTask->name" wireOpen="taskModalOpen" :wireIgnore="false" isLarge fixedHeight>
+            <x-slot:content><span></span></x-slot:content>
+
+            <livewire:project.shared.scheduled-task.show :resource="$resource" :task="$selectedTask"
+                wire:key="scheduled-task-modal-{{ $selectedTask->uuid }}" />
+        </x-modal-input>
+    @endif
+
     <x-application.settings-section id="scheduled-tasks-section" title="Scheduled tasks"
         helper="Run commands inside this resource automatically using a cron schedule." flush>
         <x-slot:actions>
@@ -32,13 +41,10 @@
                     'running' => 'Running',
                     default => 'Not run yet',
                 };
-                $taskRoute = $resource->type() === 'application'
-                    ? 'project.application.scheduled-tasks'
-                    : 'project.service.scheduled-tasks';
             @endphp
-            <a class="group flex items-center gap-3 border-b border-neutral-200 px-4 py-3.5 transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.025]"
-                {{ wireNavigate() }}
-                href="{{ route($taskRoute, [...$parameters, 'task_uuid' => $task->uuid]) }}">
+            <div wire:key="scheduled-task-{{ $task->uuid }}" wire:click="openTask('{{ $task->uuid }}')"
+                wire:keydown.enter="openTask('{{ $task->uuid }}')" role="button" tabindex="0"
+                class="group flex cursor-pointer items-center gap-3 border-b border-neutral-200 px-4 py-3.5 transition-colors last:border-b-0 hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                 <div
                     class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-neutral-500 ring-1 ring-neutral-200 dark:bg-white/[0.05] dark:text-fg-dim dark:ring-white/[0.07]">
                     <x-reicon name="browser-terminal" class="size-[18px]" />
@@ -58,7 +64,7 @@
                     </p>
                 </div>
                 <x-status-badge :status="$statusLabel" :type="$statusType" />
-            </a>
+            </div>
         @empty
             <x-empty title="No scheduled tasks"
                 description="Create a task to run maintenance commands, scripts, or recurring jobs automatically."
diff --git a/resources/views/livewire/project/shared/scheduled-task/executions.blade.php b/resources/views/livewire/project/shared/scheduled-task/executions.blade.php
index 8283e359d1..6f978dc40c 100644
--- a/resources/views/livewire/project/shared/scheduled-task/executions.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/executions.blade.php
@@ -25,8 +25,8 @@
                 'failed' => 'Failed',
                 default => ucfirst($executionStatus),
             };
-            $server = data_get($task, 'application.destination.server')
-                ?? data_get($task, 'service.destination.server');
+            $server = data_get($this->task, 'application.destination.server')
+                ?? data_get($this->task, 'service.destination.server');
         @endphp
         <div class="border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]"
             wire:key="task-execution-{{ data_get($execution, 'id') }}">
diff --git a/resources/views/livewire/project/shared/scheduled-task/show.blade.php b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
index c5be9974ba..bff3acb9aa 100644
--- a/resources/views/livewire/project/shared/scheduled-task/show.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
@@ -1,10 +1,22 @@
-<div class="flex flex-col gap-6">
-    <form wire:submit="submit" class="application-settings-form flex flex-col">
+<div x-data="{ activeSection: 'general' }" class="flex min-w-0 flex-col gap-6">
+    <nav aria-label="Scheduled task sections"
+        class="flex min-w-0 flex-wrap gap-1 border-b border-neutral-200 pb-2 dark:border-white/[0.08]">
+        @foreach (['general' => 'General', 'executions' => 'Executions', ...(auth()->user()->can('update', $resource) ? ['danger' => 'Danger Zone'] : [])] as $sectionKey => $sectionLabel)
+            <button type="button" @click="activeSection = '{{ $sectionKey }}'"
+                :class="activeSection === '{{ $sectionKey }}'
+                    ? 'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25'
+                    : 'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg'"
+                class="inline-flex h-8 shrink-0 cursor-pointer items-center rounded-md px-3 text-[13px] font-medium transition-colors">
+                {{ $sectionLabel }}
+            </button>
+        @endforeach
+    </nav>
+
+    <form x-show="activeSection === 'general'" wire:submit="submit" class="application-settings-form flex flex-col">
         <x-unsaved-bar action="submit" />
         <x-application.settings-section id="task-configuration-section" title="Task configuration"
             helper="Configure when this task runs and which command Coolify executes.">
             <x-slot:actions>
-                <x-status-badge :status="$isEnabled ? 'Enabled' : 'Disabled'" :type="$isEnabled ? 'success' : 'neutral'" />
                 @if ($resource->isRunning())
                     @can('update', $resource)
                         <x-forms.button type="button" wire:click="executeNow">
@@ -16,13 +28,6 @@
                     <x-forms.button type="button" wire:click="toggleEnabled" :isHighlighted="!$isEnabled">
                         {{ $isEnabled ? 'Disable' : 'Enable' }}
                     </x-forms.button>
-                    <x-modal-confirmation title="Delete scheduled task?" isErrorButton buttonTitle="Delete"
-                        submitAction="delete({{ $task->id }})"
-                        :actions="['The selected scheduled task will be permanently deleted.']"
-                        confirmationText="{{ $task->name }}"
-                        confirmationLabel="Enter the scheduled task name to confirm deletion"
-                        shortConfirmationLabel="Task name" :confirmWithPassword="false"
-                        step2ButtonText="Permanently delete" />
                 @endcan
             </x-slot:actions>
 
@@ -47,8 +52,28 @@
         </x-application.settings-section>
     </form>
 
-    <x-application.settings-section id="task-executions-section" title="Recent executions"
+    <x-application.settings-section x-show="activeSection === 'executions'" x-cloak id="task-executions-section" title="Recent executions"
         helper="Execution history refreshes automatically while a task is running." flush>
         <livewire:project.shared.scheduled-task.executions :taskId="$task->id" />
     </x-application.settings-section>
+
+    @can('update', $resource)
+        <div x-show="activeSection === 'danger'" x-cloak class="application-settings-form">
+            <x-application.settings-section title="Delete scheduled task"
+                description="Permanently remove this task and its execution history.">
+                <x-danger-zone title="This action cannot be undone.">
+                    <p>The task stops running and cannot be restored.</p>
+                    <x-slot:action>
+                        <x-modal-confirmation title="Delete scheduled task?" isErrorButton buttonTitle="Delete task"
+                            submitAction="delete({{ $task->id }})"
+                            :actions="['The selected scheduled task will be permanently deleted.']"
+                            confirmationText="{{ $task->name }}"
+                            confirmationLabel="Enter the scheduled task name to confirm deletion"
+                            shortConfirmationLabel="Task name" :confirmWithPassword="false"
+                            step2ButtonText="Permanently delete" />
+                    </x-slot:action>
+                </x-danger-zone>
+            </x-application.settings-section>
+        </div>
+    @endcan
 </div>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups.blade.php b/resources/views/livewire/project/shared/storages/volume-backups.blade.php
index cc354e88d5..0a395fa08e 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups.blade.php
@@ -1,9 +1,25 @@
-<div>
-    @if ($section === 'retention')
-        @include('livewire.project.shared.storages.volume-backups.retention')
-    @elseif ($section === 's3')
-        @include('livewire.project.shared.storages.volume-backups.s3')
-    @elseif ($section === 'executions')
+<div x-on:open-backup-download.window="window.location.href = $event.detail.url">
+    @if (count($pendingDownloads) > 0)
+        <div wire:poll.3s="checkDownloads" class="hidden"></div>
+    @endif
+    @if ($actionsInHeader && $backup)
+        @can('update', $resource)
+            @teleport('#resource-action-hud-slot')
+                <div class="order-first mr-1 hidden items-center gap-1 xl:flex">
+                    @if ($enabled)
+                        <x-forms.button type="button" wire:click="toggleEnabled">Disable backup</x-forms.button>
+                    @else
+                        <x-forms.button type="button" wire:click="toggleEnabled" isHighlighted>Enable backup</x-forms.button>
+                    @endif
+                    <x-forms.button type="button" wire:click="backupNow">Back up now</x-forms.button>
+                </div>
+            @endteleport
+        @endcan
+    @endif
+    @if ($section === 'executions')
+        @if ($backup && $executions->onFirstPage())
+            <div wire:poll.5000ms class="hidden"></div>
+        @endif
         @include('livewire.project.shared.storages.volume-backups.executions')
     @elseif ($section === 'danger')
         @include('livewire.project.shared.storages.volume-backups.danger')
@@ -14,7 +30,11 @@
     @script
     <script>
         window.download_volume_backup_file = function(executionId) {
-            window.open('/download/volume-backup/' + executionId, '_blank');
+            @if ($s3Downloads)
+                $wire.downloadBackup(executionId);
+            @else
+                window.open('/download/volume-backup/' + executionId, '_blank');
+            @endif
         }
     </script>
     @endscript
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
index 041fb4470d..3d29c960e6 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
@@ -3,6 +3,7 @@
         $executionCount = method_exists($executions, 'total') ? $executions->total() : $executions->count();
         $currentPage = method_exists($executions, 'currentPage') ? $executions->currentPage() : 1;
         $lastPage = method_exists($executions, 'lastPage') ? $executions->lastPage() : 1;
+        $server = $backup->server();
     @endphp
 
     <div wire:poll.5000ms="$refresh">
@@ -86,12 +87,13 @@
                                 <x-forms.copy-input :text="$execution->filename ?? 'No archive name'" />
                             </span>
 
-                            <span class="text-[11px] text-neutral-500 dark:text-fg-faint">
+                            <span class="text-[11px] text-neutral-500 dark:text-fg-faint"
+                                title="Started: {{ formatDateInServerTimezone($execution->created_at, $server) }}@if ($execution->status !== 'running')&#10;Ended: {{ formatDateInServerTimezone($finishedAt, $server) }}@endif">
                                 @if ($execution->status === 'running')
                                     Running for {{ calculateDuration($execution->created_at, now()) }}
                                 @else
-                                    {{ $finishedAt->diffForHumans() }}<br>
-                                    {{ calculateDuration($execution->created_at, $finishedAt) }}
+                                    <span class="block text-black dark:text-fg">{{ formatDateInServerTimezone($finishedAt, $server) }}</span>
+                                    {{ $finishedAt->diffForHumans() }} · {{ calculateDuration($execution->created_at, $finishedAt) }}
                                 @endif
                             </span>
 
@@ -137,7 +139,7 @@
                             </span>
 
                             <span class="flex items-center justify-end gap-1">
-                                @if ($execution->status === 'success' && ! $execution->local_storage_deleted)
+                                @if ($execution->status === 'success' && $execution->isDownloadable())
                                     <button type="button" class="icon-button shrink-0"
                                         x-on:click="download_volume_backup_file('{{ $execution->id }}')"
                                         title="Download backup" aria-label="Download backup">
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
index a48b6cb303..5c83f66f18 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/general.blade.php
@@ -1,10 +1,11 @@
-<form wire:submit="save" class="application-settings-form">
+<form wire:submit="save" class="application-settings-form flex flex-col gap-6">
     <x-unsaved-bar action="save" />
 
     <x-application.settings-section title="Backup schedule"
         description="Choose when this storage is archived and how long each backup may run.">
         <x-slot:actions>
-            <div class="flex items-center gap-2">
+            {{-- Below xl the header bar is hidden, so keep the buttons here. --}}
+            <div @class(['flex items-center gap-2', 'xl:hidden' => $actionsInHeader && $backup])>
                 @if (!$enabled)
                     <x-forms.button type="button" wire:click="toggleEnabled" wire:loading.attr="disabled"
                         wire:target="toggleEnabled" isHighlighted>Enable backup</x-forms.button>
@@ -49,4 +50,7 @@
                 helper="Notify through backup failure channels after this many days without an execution. Use 0 to disable." required />
         </div>
     </x-application.settings-section>
+
+    @include('livewire.project.shared.storages.volume-backups.s3')
+    @include('livewire.project.shared.storages.volume-backups.retention')
 </form>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php
index d260d17f1c..d4f91e43da 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/retention.blade.php
@@ -1,35 +1,31 @@
-<form wire:submit="save" class="application-settings-form">
-    <x-unsaved-bar action="save" />
-
-    <x-application.settings-section title="Retention"
-        description="The first reached limit removes the oldest archive. Use 0 for unlimited retention.">
-        <div>
-            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
-            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                <x-forms.input label="Backups to keep" id="retentionAmountLocally" type="number"
-                    min="0" canGate="update" :canResource="$resource"
-                    helper="Maximum number of recent local backups." required />
-                <x-forms.input label="Days to keep" id="retentionDaysLocally" type="number"
-                    min="0" canGate="update" :canResource="$resource"
-                    helper="Remove local backups older than this many days." required />
-                <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageLocally" type="number"
-                    min="0" step="any" canGate="update" :canResource="$resource"
-                    helper="Remove the oldest local backups after this total size is reached." required />
-            </div>
+<x-application.settings-section title="Retention"
+    description="The first reached limit removes the oldest archive. Use 0 for unlimited retention.">
+    <div>
+        <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">Local backups</h3>
+        <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+            <x-forms.input label="Backups to keep" id="retentionAmountLocally" type="number"
+                min="0" canGate="update" :canResource="$resource"
+                helper="Maximum number of recent local backups." required />
+            <x-forms.input label="Days to keep" id="retentionDaysLocally" type="number"
+                min="0" canGate="update" :canResource="$resource"
+                helper="Remove local backups older than this many days." required />
+            <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageLocally" type="number"
+                min="0" step="any" canGate="update" :canResource="$resource"
+                helper="Remove the oldest local backups after this total size is reached." required />
         </div>
+    </div>
 
-        <div class="mt-6 border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
-            <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
-            <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-                <x-forms.input label="Backups to keep" id="retentionAmountS3" type="number" min="0"
-                    canGate="update" :canResource="$resource" helper="Maximum number of recent S3 backups." required />
-                <x-forms.input label="Days to keep" id="retentionDaysS3" type="number" min="0"
-                    canGate="update" :canResource="$resource"
-                    helper="Remove S3 backups older than this many days." required />
-                <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageS3" type="number"
-                    min="0" step="any" canGate="update" :canResource="$resource"
-                    helper="Remove the oldest S3 backups after this total size is reached." required />
-            </div>
+    <div class="mt-6 border-t border-neutral-200 pt-6 dark:border-white/[0.06]">
+        <h3 class="mb-3 text-sm font-semibold text-black dark:text-fg">S3 backups</h3>
+        <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+            <x-forms.input label="Backups to keep" id="retentionAmountS3" type="number" min="0"
+                canGate="update" :canResource="$resource" helper="Maximum number of recent S3 backups." required />
+            <x-forms.input label="Days to keep" id="retentionDaysS3" type="number" min="0"
+                canGate="update" :canResource="$resource"
+                helper="Remove S3 backups older than this many days." required />
+            <x-forms.input label="Maximum storage (GB)" id="retentionMaxStorageS3" type="number"
+                min="0" step="any" canGate="update" :canResource="$resource"
+                helper="Remove the oldest S3 backups after this total size is reached." required />
         </div>
-    </x-application.settings-section>
-</form>
+    </div>
+</x-application.settings-section>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
index 3655a94753..a1c1056a23 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
@@ -10,37 +10,33 @@
         </x-empty>
     </x-application.settings-section>
 @else
-    <form wire:submit="save">
-        <x-unsaved-bar action="save" />
-
-        <x-application.settings-section title="S3 storage"
-            description="Choose where remote copies are stored and whether local archives are retained.">
-            <x-slot:actions>
-                @if (! $saveToS3)
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3" isHighlighted canGate="update" :canResource="$resource">
-                        Enable S3
-                    </x-forms.button>
-                @else
-                    <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
-                        wire:target="toggleS3" canGate="update" :canResource="$resource">
-                        Disable S3
-                    </x-forms.button>
-                @endif
-            </x-slot:actions>
-            <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageIds" label="S3 storages" multiple live portal
-                    helper="Each backup is uploaded to every selected storage." placeholder="Select S3 storages"
-                    :options="$availableS3Storages->map(fn ($storage) => [
-                        'value' => $storage->id,
-                        'label' => $storage->name.($storage->is_usable ? '' : ' (unavailable)'),
-                    ])->all()" />
-                <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
-                    :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
-                        ['value' => false, 'label' => 'Keep local backup'],
-                        ['value' => true, 'label' => 'Delete after S3 upload'],
-                    ]" />
-            </div>
-        </x-application.settings-section>
-    </form>
+    <x-application.settings-section title="S3 storage"
+        description="Choose where remote copies are stored and whether local archives are retained.">
+        <x-slot:actions>
+            @if (! $saveToS3)
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3" isHighlighted canGate="update" :canResource="$resource">
+                    Enable S3
+                </x-forms.button>
+            @else
+                <x-forms.button type="button" wire:click="toggleS3" wire:loading.attr="disabled"
+                    wire:target="toggleS3" canGate="update" :canResource="$resource">
+                    Disable S3
+                </x-forms.button>
+            @endif
+        </x-slot:actions>
+        <div class="grid gap-4 sm:grid-cols-2">
+            <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageIds" label="S3 storages" multiple live portal
+                helper="Each backup is uploaded to every selected storage." placeholder="Select S3 storages"
+                :options="$availableS3Storages->map(fn ($storage) => [
+                    'value' => $storage->id,
+                    'label' => $storage->name.($storage->is_usable ? '' : ' (unavailable)'),
+                ])->all()" />
+            <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
+                :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
+                    ['value' => false, 'label' => 'Keep local backup'],
+                    ['value' => true, 'label' => 'Delete after S3 upload'],
+                ]" />
+        </div>
+    </x-application.settings-section>
 @endif
diff --git a/resources/views/livewire/project/shared/webhooks.blade.php b/resources/views/livewire/project/shared/webhooks.blade.php
index 8e5483b283..f137d658ed 100644
--- a/resources/views/livewire/project/shared/webhooks.blade.php
+++ b/resources/views/livewire/project/shared/webhooks.blade.php
@@ -50,7 +50,8 @@
 
             @if ($githubManualWebhook && $gitlabManualWebhook)
                 <form wire:submit.prevent="submit" class="application-settings-form flex flex-col">
-                    <x-unsaved-bar action="submit" />
+                    <x-unsaved-bar action="submit"
+                        dirty="Object.entries($wire.savedSecrets).some(([property, saved]) => ($wire[property] ?? '') !== (saved ?? ''))" />
                     <x-application.settings-section id="manual-git-webhooks-section" title="Manual Git webhooks"
                         helper="Configure these endpoints when the repository is not connected through an official Git App." flush>
                         <x-slot:actions>
@@ -84,7 +85,7 @@
                                                     helper="Must exactly match the secret configured in {{ $provider['name'] }}. New secrets need at least 16 characters. Leave empty to disable this webhook."
                                                     autocomplete="new-password" copyable />
                                                 <x-forms.button type="button"
-                                                    x-on:click="$wire.generateSecret('{{ $provider['key'] }}').then((secret) => { if (typeof secret === 'string') { $wire.set('{{ $provider['secret'] }}', secret, false); } })"
+                                                    wire:click="generateSecret('{{ $provider['key'] }}')"
                                                     aria-label="Generate {{ $provider['name'] }} webhook secret">
                                                     Generate
                                                 </x-forms.button>
@@ -99,6 +100,37 @@
                         </div>
                     </x-application.settings-section>
                 </form>
+            @elseif ($gitlabAppWebhook)
+                <x-application.settings-section id="manual-git-webhooks-section" title="Manual Git webhooks"
+                    helper="GitLab Apps cannot register repository webhooks, so add this webhook to the GitLab project yourself." flush>
+                    <x-slot:actions>
+                        @can('view', $resource->source)
+                            <a class="button" href="{{ route('source.gitlab.show', ['gitlab_app_uuid' => $resource->source->uuid]) }}"
+                                {{ wireNavigate() }}>
+                                Source settings
+                            </a>
+                        @endcan
+                        @if (filled($resource?->gitWebhook))
+                            <a class="button" href="{{ $resource->gitWebhook }}" target="_blank"
+                                rel="noopener noreferrer">
+                                Repository settings
+                                <x-external-link />
+                            </a>
+                        @endif
+                    </x-slot:actions>
+
+                    <section class="px-4 py-5">
+                        <div class="mb-4">
+                            <h4 class="text-sm font-semibold text-black dark:text-fg">GitLab</h4>
+                            <p class="mt-1 text-[13px] leading-5 text-neutral-500 dark:text-fg-dim">
+                                Add this URL in the GitLab project under Settings → Webhooks. Set the Secret token to
+                                the Webhook secret token from the source settings, and enable Push events and Merge
+                                request events.
+                            </p>
+                        </div>
+                        <x-forms.copy-input label="Webhook URL" :text="$gitlabAppWebhook" />
+                    </section>
+                </x-application.settings-section>
             @else
                 <x-application.settings-section id="manual-git-webhooks-section" title="Manual Git webhooks"
                     helper="Manual repository webhooks are only required when a repository is not connected through an official Git App.">
diff --git a/resources/views/livewire/project/show.blade.php b/resources/views/livewire/project/show.blade.php
index 93b9e97999..d682ee0033 100644
--- a/resources/views/livewire/project/show.blade.php
+++ b/resources/views/livewire/project/show.blade.php
@@ -5,7 +5,18 @@
     <div x-data="projectEnvironments()" class="w-full">
         <header class="mb-5 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
             <div class="min-w-0">
-                <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $project->name }}</h1>
+                <div class="flex min-w-0 items-center gap-1.5">
+                    <h1 class="truncate text-[24px]! leading-7! font-semibold! tracking-tight!">{{ $project->name }}</h1>
+                    @can('update', $project)
+                        <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
+                            {{ wireNavigate() }}
+                            class="flex size-7 shrink-0 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg"
+                            title="Project settings"
+                            aria-label="Open settings for {{ $project->name }}">
+                            <x-reicon name="settings" class="size-4" />
+                        </a>
+                    @endcan
+                </div>
                 <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
                     <span
                         x-text="`${environments.length} ${environments.length === 1 ? 'environment' : 'environments'}`"></span>
@@ -15,15 +26,6 @@
 
             @can('update', $project)
                 <div class="flex w-fit shrink-0 items-center gap-2">
-                    <a href="{{ route('project.edit', ['project_uuid' => $project->uuid]) }}"
-                        {{ wireNavigate() }}
-                        class="button"
-                        title="Project settings"
-                        aria-label="Open settings for {{ $project->name }}">
-                        <x-reicon name="settings" class="size-3.5" />
-                        Settings
-                    </a>
-
                     <x-modal-input title="New Environment">
                         <x-slot:content>
                             <button type="button"
@@ -58,7 +60,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-48!">
                         <x-slot:trigger>
                             <button type="button" class="button" aria-haspopup="listbox" :aria-expanded="open">
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 1a1509485e..2fd7a387c3 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -5,24 +5,6 @@
 
     <x-security.settings-layout>
 
-    @if (!$isApiEnabled && !$isMcpEnabled)
-        <div class="application-settings-form">
-            <x-application.settings-section title="API disabled"
-                description="Enable the Coolify API before creating access tokens.">
-                <x-empty title="API access is turned off"
-                    description="{{ isInstanceAdmin() ? 'Enable API access in instance settings to issue tokens.' : 'Ask an instance admin to enable API access.' }}"
-                    icon-name="keys" size="sm">
-                    @if (isInstanceAdmin())
-                        <x-slot:actions>
-                            <a href="{{ route('settings.advanced') }}" class="button" {{ wireNavigate() }}>
-                                Enable API access
-                            </a>
-                        </x-slot:actions>
-                    @endif
-                </x-empty>
-            </x-application.settings-section>
-        </div>
-    @else
         @php
             $expirationList = collect($expirationOptions)
                 ->map(fn ($label, $days) => ['value' => (string) $days, 'label' => $label])
@@ -32,11 +14,9 @@
         @endphp
 
         <div class="application-settings-form flex flex-col gap-6">
-            @if (!$isApiEnabled)
-                <x-callout type="info" title="REST API disabled">
-                    Tokens work only for the MCP endpoint <code>{{ url('/mcp') }}</code> until API access is enabled.
-                </x-callout>
-            @endif
+            <x-api-disabled-callout
+                message="REST API requests are rejected. Tokens still authenticate the MCP endpoint when the MCP server is enabled." />
+
             @can('create', App\Models\PersonalAccessToken::class)
                 <form wire:submit="addNewToken">
                     <x-application.settings-section title="New API token">
@@ -267,6 +247,5 @@
                 </div>
             </x-application.settings-section>
         </div>
-    @endif
     </x-security.settings-layout>
 </div>
diff --git a/resources/views/livewire/server/canvas.blade.php b/resources/views/livewire/server/canvas.blade.php
index dd2f78e65a..f8e236770c 100644
--- a/resources/views/livewire/server/canvas.blade.php
+++ b/resources/views/livewire/server/canvas.blade.php
@@ -5,12 +5,12 @@
     @if ($server)
         {{-- Status, proxy actions and the server name dock in the top bar. --}}
         <livewire:server.navbar :server="$server" />
-        {{-- Fixed rail on xl, hidden below xl (see .app-main-full .application-settings-navigation in app.css). --}}
+        {{-- Its menu shows in the main sidebar on xl (components/server/sidebar.blade.php); below xl a canvas has no room for it. --}}
         <x-server.sidebar :server="$server" activeMenu="resources" />
     @endif
-    <div data-environment-canvas data-title="{{ $server ? 'Server canvas' : 'Servers canvas' }}"
+    <div data-environment-canvas
         data-endpoint="{{ $server ? '/servers/'.$server->uuid.'/canvas' : '/servers/canvas' }}"
-        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}" @if ($server) data-toolbar-inline @endif
+        data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
         class="relative min-h-0 flex-1" wire:ignore>
         @if ($server)
             <x-canvas-view-toggle data-ec-views on-canvas :views="['list' => ['List view', 'unordered-list']]"
@@ -21,16 +21,6 @@
             <div data-ec-views class="flex items-center gap-2">
                 <x-canvas-view-toggle on-canvas
                     :list-url="route('server.index')" :canvas-url="route('server.canvas.index')" />
-                @if (isDev())
-                    @can('create', App\Models\Server::class)
-                        <a href="{{ route('server.transfer.import') }}" {{ wireNavigate() }}
-                            class="button whitespace-nowrap">
-                            <x-reicon name="upload" class="size-3.5" />
-                            Import server
-                            <x-status-badge label="Dev" />
-                        </a>
-                    @endcan
-                @endif
                 @can('createAnyResource')
                     <a href="{{ route('server.create') }}" {{ wireNavigate() }}
                         class="button button-highlighted whitespace-nowrap">
diff --git a/resources/views/livewire/server/delete.blade.php b/resources/views/livewire/server/delete.blade.php
index 2e96838e63..5c13c0b9fd 100644
--- a/resources/views/livewire/server/delete.blade.php
+++ b/resources/views/livewire/server/delete.blade.php
@@ -17,11 +17,15 @@
                     <x-danger-zone title="This action cannot be undone">
                         <p>
                         The server will be removed from Coolify.
-                        @if ($server->definedResources()->count() > 0)
+                        @if ($server->isTransferredAway())
+                            This server was transferred to another Coolify instance. Only the records on this instance
+                            are deleted, also the records of its resources. The server, its containers, and its data
+                            stay as they are.
+                        @elseif ($server->definedResources()->count() > 0)
                             It currently contains managed resources. Enable force deletion in the confirmation only
                             if those resources should also be removed.
                         @endif
-                        @if ($server->hostinger_virtual_machine_id)
+                        @if ($server->hostinger_virtual_machine_id && ! $server->isTransferredAway())
                             Hostinger deletes the VPS only at the end of its paid period, and only if you select this in the confirmation dialog.
                             <a class="underline" href="https://hpanel.hostinger.com/" target="_blank"
                                 rel="noopener noreferrer">Manage the VPS and billing in hPanel.</a>
@@ -30,9 +34,16 @@
                         <p>Type the server name in the confirmation dialog to continue.</p>
                         <x-slot:action>
                         @php
-                            $deleteActions = ['This server will be permanently deleted from Coolify.'];
+                            $deleteActions = $server->isTransferredAway()
+                                ? ['This server and the records of its resources will be permanently deleted from this Coolify instance. Nothing on the server changes.']
+                                : ['This server will be permanently deleted from Coolify.'];
                             $deleteWarningMessage = null;
-                            if ($server->hostinger_virtual_machine_id) {
+                            if ($server->isTransferredAway()) {
+                                $deleteWarningMessage = '<strong>This removes the option to undo the transfer.</strong><br>'
+                                    .'This archive is the copy that "Transfer back" and "Take back" use. '
+                                    .'Delete it only when the transfer works and you do not need to undo it.';
+                            }
+                            if ($server->hostinger_virtual_machine_id && ! $server->isTransferredAway()) {
                                 $deleteWarningMessage = '<strong>Hostinger deletes a VPS only at the end of its paid period.</strong><br>'
                                     .'If you select to delete the VPS from Hostinger, Coolify turns off its auto-renewal. '
                                     .'The VPS keeps running until the paid period ends. Then Hostinger deletes it with all its data. '
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index eca553592d..efa6a365ee 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -6,16 +6,6 @@
     <div class="mb-5 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
         <h1 class="min-w-0 text-[24px]! leading-7! font-semibold! tracking-tight!">Servers</h1>
         <div class="flex flex-wrap items-center gap-2">
-            @if (isDev())
-                @can('create', App\Models\Server::class)
-                    <a href="{{ route('server.transfer.import') }}" {{ wireNavigate() }}
-                        class="button w-fit shrink-0 whitespace-nowrap">
-                        <x-reicon name="upload" class="size-3.5" />
-                        Import server
-                        <x-status-badge label="Dev" />
-                    </a>
-                @endcan
-            @endif
             @can('createAnyResource')
                 <a href="{{ route('server.create') }}" {{ wireNavigate() }}
                     class="button w-fit shrink-0 whitespace-nowrap button-highlighted">
@@ -28,7 +18,7 @@
 
     @php
         $serverRows = $servers->map(function ($server) {
-            $isTransferredAway = isDev() && $server->isTransferredAway();
+            $isTransferredAway = $server->isTransferredAway();
             $isReady = $server->settings->is_reachable
                 && $server->settings->is_usable
                 && ! $server->settings->force_disabled
@@ -38,7 +28,6 @@
             $sentinelNeedsAttention = $isReady && $server->isSentinelEnabled() && $server->sentinelStatus() === 'out_of_sync';
 
             $status = match (true) {
-                $isTransferredAway && $server->isManagementDisabled() => 'Transferable',
                 $isTransferredAway => 'Transferred away',
                 $server->settings->force_disabled => 'Disabled',
                 $proxyNeedsAttention || $sentinelNeedsAttention => 'Attention required',
@@ -100,14 +89,8 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-3">
-                    <span class="text-[11px] text-neutral-500 dark:text-fg-faint">
-                        <span x-text="filteredServers.length"></span>
-                        <span x-text="filteredServers.length === 1 ? 'server' : 'servers'"></span>
-                    </span>
-                    <x-canvas-view-toggle :list-url="route('server.index')"
-                        :canvas-url="route('server.canvas.index')" />
-                </div>
+                <x-canvas-view-toggle :list-url="route('server.index')"
+                    :canvas-url="route('server.canvas.index')" />
             </div>
 
             <div x-cloak x-show="viewMode === 'grid'"
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index be2414fbe8..8172da75ea 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -141,7 +141,7 @@
                             <span class="size-1.5 shrink-0 rounded-full"
                                 :class="option.functional ? 'bg-success' : 'bg-error'"></span>
                             <span class="min-w-0 flex-1 truncate" x-text="option.name"></span>
-                            <x-reicon name="check-circle"
+                            <x-reicon name="check"
                                 class="size-3.5 shrink-0 text-black dark:text-fg"
                                 x-show="option.uuid === '{{ $server->uuid }}'" />
                         </a>
@@ -254,70 +254,55 @@
             </div>
         </div>
 
+        @php
+            $canManageProxy = auth()->user()?->can('manageProxy', $server) ?? false;
+        @endphp
+        @if ($server->proxySet() && ($canManageProxy || $traefikDashboardAvailable))
+        {{-- Teleport only with content: a filled slot renders as a floating panel. --}}
         @teleport('#resource-action-hud-slot')
         <div class="hidden xl:flex xl:w-auto xl:items-center">
             <div
                 class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 items-center justify-end gap-1 overflow-visible">
-                <x-resource-heading-tabs class="hidden" aria-hidden="true">
-                    @foreach ($serverMenuItems as $menuItem)
-                        <a wire:key="server-primary-nav-{{ str($menuItem['label'])->slug() }}"
-                            @class([
-                                'app-tab shrink-0 gap-1',
-                                'app-tab-active' => $menuItem['active'],
-                            ])
-                            @if ($menuItem['active']) aria-current="page" @endif
-                            @if ($menuItem['navigate'] ?? true) {{ wireNavigate() }} @endif
-                            href="{{ route($menuItem['route'], $serverRouteParameters) }}">
-                            {{ $menuItem['label'] }}
-                            @if ($menuItem['warning'] ?? false)
-                                <x-reicon name="alert-triangle"
-                                    class="size-3.5 text-orange-500 dark:text-warning" />
-                            @endif
+                @if ($traefikDashboardAvailable)
+                    <div class="resource-heading-menus shrink-0">
+                        <a class="app-tab shrink-0 gap-1" target="_blank" title="Open Traefik dashboard"
+                            href="http://{{ formatHostForUrl((string) $serverIp) }}:8080">
+                            <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+                            Traefik Dashboard
                         </a>
-                    @endforeach
-                </x-resource-heading-tabs>
-
-                @if ($server->proxySet())
-                    @can('manageProxy', $server)
-                        @if ($traefikDashboardAvailable)
-                            <div class="resource-heading-menus shrink-0">
-                                <a class="app-tab shrink-0 gap-1" target="_blank" title="Open Traefik dashboard"
-                                    href="http://{{ formatHostForUrl((string) $serverIp) }}:8080">
-                                    <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
-                                    Traefik Dashboard
-                                </a>
-                            </div>
-                        @endif
-                        <x-split-action id="server-desktop-actions" class="resource-heading-actions shrink-0">
-                            @if ($proxyCanBeStopped)
-                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
-                                    @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
-                                    <x-reicon name="restart" class="size-3.5" />
-                                    Restart Proxy
-                                </x-slot:main>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    Stop Proxy
-                                </button>
-                            @else
-                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
-                                    <x-reicon name="play-circle" class="size-3.5" />
-                                    Start Proxy
-                                </x-slot:main>
-                            @endif
-                            <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
-                                wire:loading.attr="disabled" @click="open = false" role="menuitem">
-                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                Refresh Proxy Status
+                    </div>
+                @endif
+                @if ($canManageProxy)
+                    <x-split-action id="server-desktop-actions" class="resource-heading-actions shrink-0">
+                        @if ($proxyCanBeStopped)
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
+                                @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart Proxy
+                            </x-slot:main>
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
+                                role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop Proxy
                             </button>
-                        </x-split-action>
-                    @endcan
+                        @else
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                Start Proxy
+                            </x-slot:main>
+                        @endif
+                        <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
+                            wire:loading.attr="disabled" @click="open = false" role="menuitem">
+                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                            Refresh Proxy Status
+                        </button>
+                    </x-split-action>
                 @endif
             </div>
         </div>
         @endteleport
+        @endif
     </div>
 
     @script
diff --git a/resources/views/livewire/server/partials/localhost-general.blade.php b/resources/views/livewire/server/partials/localhost-general.blade.php
index 86cb943fef..1fd78c369c 100644
--- a/resources/views/livewire/server/partials/localhost-general.blade.php
+++ b/resources/views/livewire/server/partials/localhost-general.blade.php
@@ -2,10 +2,6 @@
                     <x-unsaved-bar action="submit" />
                     <x-application.settings-section id="server-overview-section" title="Server overview"
                         helper="Operating system and hardware details for the server running this Coolify instance.">
-                        <x-slot:badges>
-                            <x-status-badge :status="$server->isFunctional() ? 'Ready' : 'Validation required'"
-                                :type="$server->isFunctional() ? 'success' : 'warning'" />
-                        </x-slot:badges>
                         <x-slot:actions>
                             @if ($server->server_metadata)
                                 <x-forms.button type="button" wire:click="refreshServerMetadata"
diff --git a/resources/views/livewire/server/security/patches.blade.php b/resources/views/livewire/server/security/patches.blade.php
index f1e4fc3f7a..bcb23f8c87 100644
--- a/resources/views/livewire/server/security/patches.blade.php
+++ b/resources/views/livewire/server/security/patches.blade.php
@@ -16,7 +16,7 @@
 
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="security" />
+        <x-server.sidebar :server="$server" activeMenu="security" activeSubMenu="patches" />
 
         <div class="application-settings-form flex w-full flex-col gap-6">
             <x-application.settings-section id="server-patching-overview-section" title="Server patching"
diff --git a/resources/views/livewire/server/security/terminal-access.blade.php b/resources/views/livewire/server/security/terminal-access.blade.php
index 88d46e6469..88f80276b7 100644
--- a/resources/views/livewire/server/security/terminal-access.blade.php
+++ b/resources/views/livewire/server/security/terminal-access.blade.php
@@ -7,16 +7,11 @@
 
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="security" />
+        <x-server.sidebar :server="$server" activeMenu="security" activeSubMenu="terminal-access" />
 
         <div class="application-settings-form w-full">
             <x-application.settings-section id="server-terminal-access-section" title="Terminal access"
                 helper="Control dashboard terminal access for this server and its containers.">
-                <x-slot:actions>
-                    <x-status-badge :status="$isTerminalEnabled ? 'Enabled' : 'Disabled'"
-                        :type="$isTerminalEnabled ? 'success' : 'error'" />
-                </x-slot:actions>
-
                 <div class="flex flex-col justify-between gap-4 sm:flex-row sm:items-center">
                     <div class="flex items-start gap-3">
                         <div
diff --git a/resources/views/livewire/server/sentinel/logs.blade.php b/resources/views/livewire/server/sentinel/logs.blade.php
index ed2f350c66..3e25983b32 100644
--- a/resources/views/livewire/server/sentinel/logs.blade.php
+++ b/resources/views/livewire/server/sentinel/logs.blade.php
@@ -5,7 +5,7 @@
     <livewire:server.navbar :server="$server" />
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="sentinel" />
+        <x-server.sidebar :server="$server" activeMenu="sentinel" activeSubMenu="logs" />
         <div class="application-settings-form w-full">
             <x-application.settings-section title="Sentinel logs"
                 helper="Search, filter, follow, copy, or download recent output from the Sentinel container."
diff --git a/resources/views/livewire/server/sentinel/show.blade.php b/resources/views/livewire/server/sentinel/show.blade.php
index 139ad9d29b..6f7d9236fa 100644
--- a/resources/views/livewire/server/sentinel/show.blade.php
+++ b/resources/views/livewire/server/sentinel/show.blade.php
@@ -5,7 +5,7 @@
     <livewire:server.navbar :server="$server" />
     <div
         class="server-settings-workspace application-settings-workspace mt-4 grid w-full max-w-none min-w-0 gap-8 lg:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-        <x-server.sidebar :server="$server" activeMenu="sentinel" />
+        <x-server.sidebar :server="$server" activeMenu="sentinel" activeSubMenu="configuration" />
         @if ($server->isFunctional())
             <div class="w-full">
                 <livewire:server.sentinel :server="$server" />
diff --git a/resources/views/livewire/server/show.blade.php b/resources/views/livewire/server/show.blade.php
index 993509467b..e00177757f 100644
--- a/resources/views/livewire/server/show.blade.php
+++ b/resources/views/livewire/server/show.blade.php
@@ -76,10 +76,8 @@
                     <x-application.settings-section id="server-connection-section" title="Connection"
                         helper="Configure how Coolify identifies, reaches, and validates this server.">
                         <x-slot:badges>
-                            @if (isDev() && $server->isTransferredAway())
-                                @unless ($server->isManagementDisabled())
-                                    <x-status-badge label="Transferred away" type="warning" />
-                                @endunless
+                            @if ($server->isTransferredAway())
+                                <x-status-badge label="Transferred away" type="warning" />
                             @else
                                 <x-status-badge :label="$server->isFunctional() ? 'Ready' : 'Validation required'"
                                     :type="$server->isFunctional() ? 'success' : 'warning'" />
@@ -157,56 +155,49 @@
                                     </x-forms.button>
                                 </x-process-dialog>
                             @endif
-                            @if (isDev())
-                                <div wire:key="server-management-{{ $server->isTransferredAway() ? 'enable' : 'disable' }}">
-                                    @if ($server->isTransferredAway())
-                                        <x-modal-confirmation title="Enable management on this instance?"
-                                            submitAction="toggleManagement" :confirmWithText="false"
-                                            :confirmWithPassword="false" step2ButtonText="Enable management"
-                                            warningMessage="Before you continue, disable this server on every other Coolify instance. Two active instances can cause conflicting deployments, proxy changes, backups, and restarts."
-                                            :actions="['This instance will run deployments, webhooks, scheduled tasks, backups, proxy updates, and monitoring for this server.']">
-                                            <x-slot:trigger>
-                                                <x-forms.button type="button" canGate="update" :canResource="$server">
-                                                    <x-reicon name="play-circle" class="size-3.5" />
-                                                    Enable management
-                                                </x-forms.button>
-                                            </x-slot:trigger>
-                                        </x-modal-confirmation>
-                                    @else
-                                        <x-modal-confirmation title="Disable management on this instance?"
-                                            submitAction="toggleManagement" :confirmWithText="false"
-                                            :confirmWithPassword="false" step2ButtonText="Disable management"
-                                            :actions="[
-                                                'Deployments, webhooks, scheduled tasks, backups, proxy updates, and monitoring will stop on this instance for this server.',
-                                                'Existing workloads continue to run on the server.',
-                                            ]">
-                                            <x-slot:trigger>
-                                                <x-forms.button type="button" canGate="update" :canResource="$server">
-                                                    <x-reicon name="stop-circle" class="size-3.5" />
-                                                    Disable management
-                                                </x-forms.button>
-                                            </x-slot:trigger>
-                                        </x-modal-confirmation>
-                                    @endif
-                                </div>
+                            @if ($server->isTransferredAway() && ! $server->isLocalhost())
+                                @php
+                                    $transferTarget = data_get($server->server_metadata, 'transfer.target_instance_url') ?: 'another Coolify instance';
+                                    $transferredAt = data_get($server->server_metadata, 'transfer.transferred_at');
+                                    $transferredAt = $transferredAt ? \Illuminate\Support\Carbon::parse($transferredAt)->toDayDateTimeString().' UTC' : 'the transfer';
+                                @endphp
+                                <x-modal-confirmation title="Take back a transferred server?"
+                                    submitAction="enableManagement" :confirmWithPassword="false"
+                                    temporaryDisableTwoStepConfirmation
+                                    step2ButtonText="I understand, enable management"
+                                    :confirmationText="$server->name"
+                                    confirmationLabel="Enter the server name to take the server back."
+                                    shortConfirmationLabel="Server name"
+                                    :warningMessage="'<strong>Changes made on '.e($transferTarget).' after '.e($transferredAt).' are lost.</strong> This instance uses its copy of the settings and resources from the time of the transfer. Use this only when '.e($transferTarget).' is lost or cannot transfer the server back. Otherwise use Transfer back, which keeps those changes.'"
+                                    :actions="[
+                                        'This instance starts to run deployments, webhooks, scheduled tasks, backups, proxy updates, and monitoring for this server again.',
+                                        'The server records that this instance owns it. The next time the other instance connects to the server, it stops managing it automatically.',
+                                        'Sentinel on the server is reconfigured to send its data to this instance.',
+                                        'This instance takes back its DNS records and shows the steps that finish the take back: webhooks, DNS, Sentinel, backups, and runners.',
+                                    ]">
+                                    <x-slot:trigger>
+                                        <x-forms.button type="button" isError canGate="update" :canResource="$server">
+                                            <x-reicon name="alert-triangle" class="size-3.5" />
+                                            Enable management
+                                        </x-forms.button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
                             @endif
                         </x-slot:actions>
 
-                        @if (isDev() && $server->isManagementDisabled())
-                            <x-callout type="warning" title="Transferable to another instance" class="mb-4">
-                                Management of this server is disabled on this Coolify instance. You can now
-                                <a href="{{ route('server.transfer', ['server_uuid' => $server->uuid]) }}"
-                                    {{ wireNavigate() }} class="underline">transfer it to another instance</a>, or enable
-                                management again to manage it here.
-                            </x-callout>
-                        @elseif (isDev() && $server->isTransferredAway())
-                            <x-callout type="warning" title="Transferred to another instance" class="mb-4">
-                                This server was migrated away from this Coolify instance. It cannot be revalidated or
-                                managed here. Use the target instance, or delete this server when you no longer need the
-                                archive.
+                        @if ($server->isTransferredAway())
+                            <x-callout type="danger" title="Transferred to another instance" class="mb-4">
+                                This server was transferred to
+                                <strong>{{ data_get($server->server_metadata, 'transfer.target_instance_url') ?: 'another Coolify instance' }}</strong>,
+                                which manages it now. Use that instance. To undo the transfer, use
+                                <a href="{{ route('server.transfer', ['server_uuid' => $server->uuid]) }}" {{ wireNavigate() }}
+                                    class="underline">Transfer back</a>. Keep this archive until you are sure: it is the copy
+                                that an undo uses.
                             </x-callout>
                         @endif
 
+                        <livewire:server.transfer-finish :server="$server" :key="'transfer-finish-'.$server->uuid" />
+
                         @if ($this->limaStartCommand)
                             <x-callout type="info" title="Start this Lima VM locally" class="mb-4">
                                 <code
@@ -342,9 +333,7 @@
                                     {{ $server->name }}
                                 </p>
                                 <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
-                                    @if (isDev() && $server->isManagementDisabled())
-                                        Management is disabled on this Coolify instance. You can transfer this server to another instance.
-                                    @elseif (isDev() && $server->isTransferredAway())
+                                    @if ($server->isTransferredAway())
                                         This server was migrated away from this Coolify instance and cannot be managed here.
                                     @elseif ($server->isFunctional())
                                         The server is reachable, validated, and ready to host resources.
diff --git a/resources/views/livewire/server/traffic-analytics-settings.blade.php b/resources/views/livewire/server/traffic-analytics-settings.blade.php
index 09ee724eeb..177bb1a59a 100644
--- a/resources/views/livewire/server/traffic-analytics-settings.blade.php
+++ b/resources/views/livewire/server/traffic-analytics-settings.blade.php
@@ -61,7 +61,7 @@
                             ['value' => 'anonymized', 'label' => 'Anonymized (/24 IPv4, /48 IPv6)'],
                             ['value' => 'off', 'label' => 'Disabled'],
                         ]"
-                        helper="How Sentinel stores visitor IPs for the Top IPs list. Anonymized keeps only the network. Disabled does not store IPs. When you change this setting, Sentinel deletes the stored IPs that the new setting does not allow." />
+                        helper="How Sentinel stores visitor IPs for the Top IPs list. Anonymized keeps only the network. Disabled does not store IPs or visitor cities. When you change this setting, Sentinel deletes the stored IPs that the new setting does not allow." />
                     <x-forms.input canGate="update" :canResource="$server" type="number" min="1"
                         id="geoipRefreshDays" label="GeoIP refresh interval" required
                         helper="Days between GeoIP database update checks." />
diff --git a/resources/views/livewire/server/transfer-finish.blade.php b/resources/views/livewire/server/transfer-finish.blade.php
new file mode 100644
index 0000000000..aaeb37869a
--- /dev/null
+++ b/resources/views/livewire/server/transfer-finish.blade.php
@@ -0,0 +1,171 @@
+<div>
+    @if ($finish && $openCount > 0)
+        {{-- Not on the root element: Livewire starts a poll that a later render adds only on a new element. --}}
+        <div wire:key="transfer-finish-poll" wire:init="refreshSteps" wire:poll.15s="refreshSteps" hidden></div>
+    @endif
+    @if ($finish)
+        @php
+            $doneCount = $totalCount - $openCount;
+            $lastCheckedAt = data_get($finish, 'last_checked_at');
+            $badges = [
+                'action' => ['Needs action', 'warning'],
+                'unchecked' => ['Cannot check', 'neutral'],
+                'pending' => ['Not checked yet', 'neutral'],
+            ];
+        @endphp
+        <div class="mb-4 rounded-lg p-4 ring-1 ring-neutral-200 dark:ring-white/[0.08]" data-testid="transfer-finish">
+            <div class="flex flex-wrap items-start justify-between gap-3">
+                <div class="min-w-0">
+                    <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Finish the transfer</h3>
+                    <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">
+                        {{ $doneCount }} of {{ $totalCount }} done.
+                        @if ($openCount > 0)
+                            Coolify checks the open steps every 30 seconds.
+                        @endif
+                    </p>
+                </div>
+                <div class="flex items-center gap-2">
+                    @if ($openCount > 0)
+                        <span class="text-xs text-neutral-500 dark:text-fg-dim">
+                            {{ $lastCheckedAt ? 'Checked '.\Illuminate\Support\Carbon::parse($lastCheckedAt)->format('H:i') : 'Checking…' }}
+                        </span>
+                        @can('update', $server)
+                            <button type="button" class="icon-button" title="Check now" wire:click="checkAllNow"
+                                wire:loading.attr="disabled" wire:target="checkAllNow">
+                                <x-reicon name="refresh" class="size-4" />
+                            </button>
+                        @endcan
+                    @else
+                        <x-forms.button isHighlighted wire:click="finishTransfer" canGate="update" :canResource="$server">
+                            Finish the transfer
+                        </x-forms.button>
+                    @endif
+                </div>
+            </div>
+            <div class="mt-3 h-1 overflow-hidden rounded-full bg-neutral-200 dark:bg-white/[0.08]">
+                <div class="h-full rounded-full bg-success transition-all"
+                    style="width: {{ $totalCount > 0 ? round($doneCount / $totalCount * 100) : 0 }}%"></div>
+            </div>
+
+            @foreach ($openGroups as $group)
+                <div class="mt-4" wire:key="transfer-group-{{ $loop->index }}-{{ $group['label'] }}">
+                    <p class="text-xs font-medium text-neutral-500 dark:text-fg-dim">{{ $group['label'] }}</p>
+                    <ul class="mt-1 flex flex-col divide-y divide-neutral-200 dark:divide-white/[0.06]">
+                        @foreach ($group['items'] as $step)
+                            @php
+                                $fixLabel = $checklist->fixLabel($step);
+                                $manualOnly = ! $checklist->canCheck($step);
+                                [$link, $linkLabel] = $checklist->linkOf($step) ?? [null, null];
+                                $linkAttributes = $link && str_starts_with($link, 'http') ? 'target="_blank" rel="noopener noreferrer"' : wireNavigate();
+                                $hasMenu = ! $manualOnly || $link;
+                                $hasDetails = filled($step['hint'] ?? null) || count($step['details'] ?? []) > 0 || filled($step['error'] ?? null);
+                                [$badgeLabel, $badgeType] = $badges[$step['status']] ?? ['Not checked yet', 'neutral'];
+                            @endphp
+                            <li wire:key="transfer-step-{{ $step['key'] }}" class="py-2" x-data="{ details: false, menu: false }">
+                                <div class="flex items-center gap-3">
+                                    <span class="size-2 shrink-0 rounded-full {{ $badgeType === 'warning' ? 'bg-warning' : 'bg-neutral-400 dark:bg-neutral-500' }}"
+                                        title="{{ $badgeLabel }}" role="img" aria-label="{{ $badgeLabel }}"></span>
+                                    <div class="min-w-0 flex-1">
+                                        <p class="truncate text-sm text-neutral-950 dark:text-fg">{{ $step['label'] }}</p>
+                                        <p class="truncate text-xs text-neutral-500 dark:text-fg-dim">
+                                            {{ $step['message'] ?? $step['hint'] }}
+                                            @if ($hasDetails)
+                                                <button type="button" class="ml-1 underline" @click="details = !details"
+                                                    x-text="details ? 'Hide details' : 'Details'"></button>
+                                            @endif
+                                        </p>
+                                    </div>
+                                    @can('update', $server)
+                                        <div class="flex shrink-0 items-center gap-1">
+                                            @if ($hasMenu)
+                                            <div class="relative" @click.outside="menu = false" @keydown.escape.window="menu = false">
+                                                <button type="button" class="icon-button" title="More actions" aria-haspopup="menu"
+                                                    :aria-expanded="menu" @click="menu = !menu">
+                                                    <x-reicon name="dots-horizontal" class="size-4" />
+                                                </button>
+                                                <div x-cloak x-show="menu" x-transition.origin.top.right role="menu"
+                                                    class="listbox-panel top-full! right-0! left-auto! z-[90]! mt-1! w-40! min-w-40!">
+                                                    @unless ($manualOnly)
+                                                        <button type="button" class="listbox-option justify-start!" role="menuitem"
+                                                            wire:click="checkStep('{{ $step['key'] }}')" @click="menu = false">Check now</button>
+                                                    @endunless
+                                                    @if (! $manualOnly || $link)
+                                                        <button type="button" class="listbox-option justify-start!" role="menuitem"
+                                                            wire:click="markStepDone('{{ $step['key'] }}')" @click="menu = false">Mark as done</button>
+                                                    @endif
+                                                    @if ($fixLabel && $link)
+                                                        <a href="{{ $link }}" {!! $linkAttributes !!} class="listbox-option justify-start!"
+                                                            role="menuitem">{{ $linkLabel }}</a>
+                                                    @endif
+                                                </div>
+                                            </div>
+                                            @endif
+                                            @if ($fixLabel)
+                                                <x-forms.button wire:click="fixStep('{{ $step['key'] }}')">{{ $fixLabel }}</x-forms.button>
+                                            @elseif ($link)
+                                                <a href="{{ $link }}" {!! $linkAttributes !!} class="button">{{ $linkLabel }}</a>
+                                            @elseif ($manualOnly)
+                                                <x-forms.button wire:click="markStepDone('{{ $step['key'] }}')">Mark as done</x-forms.button>
+                                            @endif
+                                        </div>
+                                    @endcan
+                                </div>
+                                @if ($hasDetails)
+                                    <div x-cloak x-show="details" class="mt-2 ml-1 flex flex-col gap-1.5 text-xs text-neutral-600 dark:text-fg-dim">
+                                        @if (filled($step['hint'] ?? null) && filled($step['message'] ?? null))
+                                            <p>{{ $step['hint'] }}</p>
+                                        @endif
+                                        @foreach ($step['details'] ?? [] as $detail)
+                                            <div class="flex min-w-0 items-center gap-2" wire:key="transfer-detail-{{ $step['key'] }}-{{ $detail['label'] }}">
+                                                <span class="shrink-0">{{ $detail['label'] }}</span>
+                                                <code class="min-w-0 truncate rounded bg-neutral-100 px-1.5 py-0.5 dark:bg-white/[0.06]">{{ $detail['value'] }}</code>
+                                                <x-copy-button :value="$detail['value']" />
+                                            </div>
+                                        @endforeach
+                                        @if (filled($step['error'] ?? null))
+                                            <p class="break-words">{{ $step['error'] }}</p>
+                                        @endif
+                                    </div>
+                                @endif
+                            </li>
+                        @endforeach
+                    </ul>
+                </div>
+            @endforeach
+
+            @if ($doneCount > 0)
+                <div class="mt-4" x-data="{ showDone: false }">
+                    <button type="button" class="flex items-center gap-1 text-xs text-neutral-500 dark:text-fg-dim"
+                        @click="showDone = !showDone">
+                        <x-reicon name="chevron-down" class="size-3 transition-transform" ::class="showDone ? '' : '-rotate-90'" />
+                        {{ $doneCount }} {{ $doneCount === 1 ? 'step is' : 'steps are' }} OK or done
+                    </button>
+                    <ul x-cloak x-show="showDone" class="mt-1 flex flex-col gap-1">
+                        @foreach ($doneItems as $step)
+                            <li wire:key="transfer-done-{{ $step['key'] }}" class="flex items-center gap-2 text-xs text-neutral-500 dark:text-fg-dim">
+                                <x-reicon name="check-circle" class="size-3.5 text-success" />
+                                <span class="text-neutral-700 dark:text-fg">{{ $step['label'] }}</span>
+                                <span class="truncate">{{ $step['message'] }}</span>
+                            </li>
+                        @endforeach
+                    </ul>
+                </div>
+            @endif
+
+            @if ($openCount > 0)
+                @can('update', $server)
+                    <div class="mt-4 flex justify-end">
+                        <x-modal-confirmation title="Finish with open steps?" submitAction="finishTransfer"
+                            :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Finish the transfer"
+                            :warningMessage="'<strong>'.$openCount.' steps are not OK or done.</strong> Coolify does not check them again. Webhooks, DNS records, or runners can still point to the other instance.'"
+                            :actions="collect($openGroups)->flatMap(fn ($group) => $group['items'])->map(fn ($step) => 'Skipped: '.$step['label'])->all()">
+                            <x-slot:trigger>
+                                <button type="button" class="text-xs text-neutral-500 underline dark:text-fg-dim">Finish with open steps…</button>
+                            </x-slot:trigger>
+                        </x-modal-confirmation>
+                    </div>
+                @endcan
+            @endif
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/server/transfer-import.blade.php b/resources/views/livewire/server/transfer-import.blade.php
deleted file mode 100644
index d55a4d320b..0000000000
--- a/resources/views/livewire/server/transfer-import.blade.php
+++ /dev/null
@@ -1,128 +0,0 @@
-<div class="w-full">
-    <x-slot:title>
-        Import server | Coolify
-    </x-slot>
-
-    <div class="mb-5 flex min-h-9 flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-        <div class="min-w-0">
-            <div class="flex flex-wrap items-center gap-2">
-                <h1 class="min-w-0 text-[24px]! leading-7! font-semibold! tracking-tight!">Import server</h1>
-                <x-status-badge label="Dev" />
-            </div>
-            <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
-                Import a server that you downloaded from another Coolify instance. This instance then manages it.
-            </p>
-        </div>
-        <a href="{{ route('server.index') }}" class="button w-fit shrink-0" {{ wireNavigate() }}>
-            Back to servers
-        </a>
-    </div>
-
-    <div class="application-settings-form flex flex-col gap-6">
-        <x-application.settings-section id="server-import-file-section" title="Transfer file"
-            helper="On the source instance, open the server, go to Transfer, and click Download JSON in Manual transfer. The server data on the machine does not change.">
-            <x-slot:actions>
-                <x-forms.button wire:click="dryRun" wire:loading.attr="disabled" wire:target="dryRun,importBundle">
-                    <x-reicon name="search" class="size-3.5" />
-                    <span wire:loading.remove wire:target="dryRun">Dry run</span>
-                    <span wire:loading wire:target="dryRun">Checking…</span>
-                </x-forms.button>
-                <x-modal-confirmation title="Import this server?" submitAction="importBundle"
-                    :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Import server"
-                    :actions="[
-                        'The server and its resources will be added to the current team.',
-                        'This instance will manage the server. Disable management of it on the source instance.',
-                    ]">
-                    <x-slot:trigger>
-                        <x-forms.button isHighlighted wire:loading.attr="disabled" wire:target="dryRun,importBundle">
-                            <x-reicon name="upload" class="size-3.5" />
-                            <span wire:loading.remove wire:target="importBundle">Import server</span>
-                            <span wire:loading wire:target="importBundle">Importing…</span>
-                        </x-forms.button>
-                    </x-slot:trigger>
-                </x-modal-confirmation>
-            </x-slot:actions>
-
-            <div class="flex flex-col gap-4">
-                <x-forms.input type="file" id="bundleFile" label="Upload file"
-                    accept=".json,application/json" />
-                <x-forms.textarea id="bundleJson" label="Or paste the file content" rows="10"
-                    placeholder='{"schema_version":1,...}' />
-                <div class="md:max-w-xl">
-                    <x-forms.input id="passphrase" type="password" label="Passphrase"
-                        placeholder="Only for encrypted files" autocomplete="off" />
-                </div>
-            </div>
-        </x-application.settings-section>
-
-        <x-application.settings-section id="server-import-options-section" title="Options">
-            <div class="flex flex-col gap-1 md:max-w-xl">
-                <x-forms.checkbox id="preserveUuids" label="Keep UUIDs from the source instance"
-                    helper="Resources keep the same UUIDs, so their names, containers, and webhook URLs stay the same." />
-                <x-forms.checkbox id="adoptMode" label="Adopt running resources"
-                    helper="Keep the current status of each resource and do not redeploy stopped resources." />
-            </div>
-        </x-application.settings-section>
-
-        @if (count($lastWarnings) > 0)
-            <x-callout type="warning" title="Warnings">
-                <ul class="mt-1 list-disc space-y-1 pl-5">
-                    @foreach ($lastWarnings as $warning)
-                        <li>{{ $warning }}</li>
-                    @endforeach
-                </ul>
-            </x-callout>
-        @endif
-
-        @if ($lastResult)
-            @php
-                $createdCounts = collect(data_get($lastResult, 'created', []))
-                    ->filter(fn ($count) => (int) $count > 0);
-            @endphp
-            <x-application.settings-section id="server-import-result-section"
-                :title="data_get($lastResult, 'dry_run') ? 'Dry run result' : 'Import result'">
-                <x-slot:actions>
-                    @if (data_get($lastResult, 'dry_run'))
-                        <x-status-badge label="Nothing written" type="neutral" />
-                    @elseif (data_get($lastResult, 'claimed'))
-                        <x-status-badge label="Managed here" type="success" />
-                    @else
-                        <x-status-badge label="Management not enabled" type="warning" />
-                    @endif
-                    @if ($importedServerUuid)
-                        <a href="{{ route('server.show', ['server_uuid' => $importedServerUuid]) }}" class="button"
-                            {{ wireNavigate() }}>
-                            Open server
-                            <x-reicon name="arrow-right" class="size-3.5" />
-                        </a>
-                    @endif
-                </x-slot:actions>
-
-                <div class="flex flex-col gap-4">
-                    @if (filled(data_get($lastResult, 'server_uuid')))
-                        <p class="text-xs text-neutral-500 dark:text-fg-dim">
-                            Server UUID
-                            <code class="ml-1 font-mono text-neutral-700 dark:text-fg">{{ data_get($lastResult, 'server_uuid') }}</code>
-                        </p>
-                    @endif
-
-                    @if ($createdCounts->isNotEmpty())
-                        <div class="grid grid-cols-2 gap-2 sm:grid-cols-3 lg:grid-cols-4">
-                            @foreach ($createdCounts as $type => $count)
-                                <div
-                                    class="rounded-lg border border-neutral-200 px-3 py-2 dark:border-white/[0.08]">
-                                    <div class="text-[15px] font-semibold text-neutral-950 dark:text-fg">
-                                        {{ $count }}</div>
-                                    <div class="text-[11px] text-neutral-500 dark:text-fg-faint">
-                                        {{ str($type)->replace('_', ' ')->ucfirst() }}</div>
-                                </div>
-                            @endforeach
-                        </div>
-                    @else
-                        <p class="text-xs text-neutral-500 dark:text-fg-dim">No resources in this file.</p>
-                    @endif
-                </div>
-            </x-application.settings-section>
-        @endif
-    </div>
-</div>
diff --git a/resources/views/livewire/server/transfer.blade.php b/resources/views/livewire/server/transfer.blade.php
index 0b322fc6ca..a28757a968 100644
--- a/resources/views/livewire/server/transfer.blade.php
+++ b/resources/views/livewire/server/transfer.blade.php
@@ -11,29 +11,74 @@
 
         <div class="application-settings-form flex w-full flex-col gap-6">
             @if ($this->isLocalhost)
-                <x-application.settings-section id="server-transfer-section" title="Transfer server (Dev)"
+                <x-application.settings-section id="server-transfer-section" title="Transfer server"
                     helper="Move this server’s control-plane config to another Coolify instance (same physical host).">
                     <x-callout type="warning" title="Localhost cannot be transferred">
                         The Coolify host (localhost) cannot be transferred between instances.
                     </x-callout>
                 </x-application.settings-section>
             @else
-                <x-application.settings-section id="server-transfer-section" title="Transfer server (Dev)"
+                <x-application.settings-section id="server-transfer-section" title="Transfer server"
                     helper="Move this server’s control-plane config to another Coolify instance (same physical host).">
                     <x-slot:actions>
-                        @if ($server->isManagementDisabled())
-                            <x-status-badge label="Transferable" type="warning" />
+                        @php
+                            $exportTooltip = $exportId ? "Export ID: {$exportId}" : null;
+                        @endphp
+                        @if (data_get($this->migration, 'status') === 'running')
+                            <x-status-badge label="Transferring" type="warning" :data-tooltip="$exportTooltip" />
                         @elseif ($server->isTransferredAway())
-                            <x-status-badge label="Transferred away" type="warning" />
+                            <x-status-badge label="Transferred away" type="warning" :data-tooltip="$exportTooltip" />
                         @else
-                            <x-status-badge label="Managed here" type="success" />
-                        @endif
-                        @if ($exportId)
-                            <span class="text-[11px] text-neutral-500 dark:text-fg-faint">export {{ $exportId }}</span>
+                            <x-status-badge label="Managed here" type="success" :data-tooltip="$exportTooltip" />
                         @endif
                     </x-slot:actions>
 
                     <div class="flex flex-col gap-4">
+                        @if ($server->isTransferredAway())
+                            <div>
+                                <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Transfer back</h3>
+                                <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
+                                    Undo the transfer. The instance that manages the server now transfers it back here,
+                                    with all changes made there. This archive is replaced only when the import here
+                                    succeeds. If the other instance is lost, use Enable management on the server page.
+                                </p>
+                            </div>
+                            <div class="flex flex-col gap-3 md:max-w-xl">
+                                <x-forms.input id="managerUrl" label="Instance that manages the server now" required
+                                    placeholder="https://coolify.example.com"
+                                    helper="The Coolify instance that this server was transferred to." />
+                                <x-forms.input id="managerToken" type="password" label="API token of that instance" required
+                                    placeholder="Paste token from that instance" autocomplete="off"
+                                    helper="A token with root, or with read:sensitive and write, from an admin or owner of that instance." />
+                                <x-forms.input id="thisInstanceUrl" label="URL of this instance" required
+                                    helper="The URL at which the other instance reaches this instance. This instance gives it a token that expires in 3 hours." />
+                            </div>
+                            <div>
+                                <x-modal-confirmation title="Transfer this server back?" submitAction="transferBack"
+                                    :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Transfer back"
+                                    :actions="[
+                                        'The other instance checks the server, this instance, and the tokens. If a check fails, nothing changes.',
+                                        'The other instance transfers the server, its resources, and its credentials back here.',
+                                        'This archive is replaced by the transferred server, and the other instance keeps an archive.',
+                                    ]">
+                                    <x-slot:trigger>
+                                        <x-forms.button canGate="update" :canResource="$server" wire:loading.attr="disabled"
+                                            wire:target="transferBack">
+                                            <span wire:loading.remove wire:target="transferBack">Transfer back</span>
+                                            <span wire:loading wire:target="transferBack">Running checks…</span>
+                                        </x-forms.button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
+                            </div>
+                            @if ($transferBackAt = data_get($server->server_metadata, 'transfer.transfer_back.requested_at'))
+                                <x-callout type="info" title="Transfer back started">
+                                    {{ data_get($server->server_metadata, 'transfer.transfer_back.from') }} started the transfer back at
+                                    {{ \Illuminate\Support\Carbon::parse($transferBackAt)->format('H:i') }}. Reload this page in a minute.
+                                    When the transfer finishes, this instance manages the server again. If it does not, read
+                                    the transfer log of the server on the other instance.
+                                </x-callout>
+                            @endif
+                        @else
                         <div>
                             <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Transfer to another instance
                             </h3>
@@ -45,8 +90,8 @@
                         </div>
                         <div class="flex flex-col gap-3 md:max-w-xl">
                             <x-forms.input id="targetUrl" label="Target instance URL" required
-                                placeholder="http://localhost:8001"
-                                helper="Base URL of the other Coolify instance (no trailing path)." />
+                                placeholder="https://coolify.example.com"
+                                helper="Base URL of the other Coolify instance (no trailing path). It must use https." />
                             <x-forms.input id="targetToken" type="password" label="Target API token" required
                                 placeholder="Paste token from target instance" autocomplete="off"
                                 helper="Create a token on the target with root (or write + create servers). It is only used for this request." />
@@ -55,6 +100,7 @@
                             <x-modal-confirmation title="Transfer this server?" submitAction="migrateServer"
                                 :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Transfer server"
                                 :actions="[
+                                    'Coolify first checks this server, the target instance, and the token. If a check fails, nothing is changed.',
                                     'The server will be transferred to the target instance.',
                                     'Automations for this server will be disabled on this instance.',
                                 ]">
@@ -62,11 +108,83 @@
                                     <x-forms.button canGate="update" :canResource="$server" wire:loading.attr="disabled"
                                         wire:target="migrateServer">
                                         <span wire:loading.remove wire:target="migrateServer">Transfer server</span>
-                                        <span wire:loading wire:target="migrateServer">Transferring…</span>
+                                        <span wire:loading wire:target="migrateServer">Running checks…</span>
                                     </x-forms.button>
                                 </x-slot:trigger>
                             </x-modal-confirmation>
                         </div>
+                        @endif
+                        @php $migration = $this->migration; @endphp
+                        @if (data_get($migration, 'status') === 'running')
+                            <div wire:poll.5s="refreshMigration">
+                                <x-callout type="info" title="Transfer in progress">
+                                    The server is being transferred to {{ data_get($migration, 'target_url') }}. You can
+                                    leave this page; the transfer continues in the background.
+                                </x-callout>
+                            </div>
+                        @elseif (data_get($migration, 'status') === 'failed')
+                            <x-callout type="danger"
+                                :title="data_get($migration, 'phase') === 'checks' ? 'A check failed. The transfer did not start.' : 'Transfer failed'">
+                                @if (count((array) data_get($migration, 'log', [])) > 0)
+                                    See the transfer log below for details.
+                                @else
+                                    {{ data_get($migration, 'error') }}
+                                @endif
+                            </x-callout>
+                        @elseif (data_get($migration, 'status') === 'unknown')
+                            <x-callout type="warning" title="Transfer result unknown">
+                                The transfer stopped before this instance could confirm the result. Check whether
+                                {{ data_get($migration, 'target_url') }} manages this server. If it does, call
+                                <code>POST /api/v1/servers/{{ $server->uuid }}/transfer/complete</code> on this instance.
+                                If it does not, transfer again.
+                            </x-callout>
+                        @elseif (data_get($migration, 'status') === 'succeeded')
+                            <x-callout type="success" title="Transfer finished">
+                                {{ data_get($migration, 'target_url') }} now manages this server. Automations are
+                                disabled on this instance.
+                            </x-callout>
+                            @php $checklist = $this->postTransferChecklist; @endphp
+                            @if (count($checklist) > 0 || data_get($migration, 'target_server_url'))
+                                <div data-testid="post-transfer-checklist">
+                                    <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Finish the transfer on the target</h3>
+                                    <p class="mt-1 text-xs leading-5 text-neutral-500 dark:text-fg-dim">
+                                        The target shows these steps on the server page, checks them where it can, and keeps
+                                        their state.
+                                        @if ($targetServerUrl = data_get($migration, 'target_server_url'))
+                                            <a href="{{ $targetServerUrl }}" target="_blank" rel="noopener noreferrer"
+                                                class="underline">Open the server on the target</a>.
+                                        @endif
+                                    </p>
+                                    @if (count($checklist) > 0)
+                                        <ul class="mt-2 list-disc space-y-1 pl-5 text-xs leading-5 text-neutral-600 dark:text-fg-dim">
+                                            @foreach ($checklist as $step)
+                                                <li wire:key="post-transfer-step-{{ hash('xxh128', $step) }}">{{ $step }}</li>
+                                            @endforeach
+                                        </ul>
+                                    @endif
+                                </div>
+                            @endif
+                        @endif
+                        @if (count((array) data_get($migration, 'log', [])) > 0)
+                            <div>
+                                <h3 class="text-sm font-semibold text-neutral-950 dark:text-fg">Transfer log</h3>
+                                <ol class="mt-2 flex flex-col gap-1 rounded-lg border border-neutral-200 bg-neutral-50 p-3 font-mono text-xs dark:border-coolgray-300 dark:bg-coolgray-100"
+                                    data-testid="transfer-log">
+                                    @foreach ((array) data_get($migration, 'log', []) as $entry)
+                                        <li wire:key="transfer-log-{{ $loop->index }}-{{ data_get($entry, 'at') }}" @class([
+                                            'flex gap-3',
+                                            'text-success' => data_get($entry, 'level') === 'success',
+                                            'text-error' => data_get($entry, 'level') === 'error',
+                                            'text-warning' => data_get($entry, 'level') === 'warning',
+                                            'text-neutral-600 dark:text-fg-dim' => data_get($entry, 'level') === 'info',
+                                        ])>
+                                            <span class="shrink-0 text-neutral-400">{{ \Illuminate\Support\Carbon::parse(data_get($entry, 'at'))->format('H:i:s') }}</span>
+                                            <span class="break-words">{{ data_get($entry, 'message') }}</span>
+                                        </li>
+                                    @endforeach
+                                </ol>
+                            </div>
+                        @endif
                         @if (count($lastWarnings) > 0)
                             <x-callout type="warning" title="Warnings">
                                 <ul class="mt-2 list-disc space-y-1 pl-5 text-sm">
@@ -76,41 +194,9 @@
                                 </ul>
                             </x-callout>
                         @endif
-                        @if ($lastResultJson)
-                            <div>
-                                <div class="mb-1 text-sm font-semibold">Result</div>
-                                <pre
-                                    class="max-h-64 overflow-auto rounded-lg bg-neutral-100 p-3 text-xs dark:bg-coolgray-100">{{ $lastResultJson }}</pre>
-                            </div>
-                        @endif
                     </div>
                 </x-application.settings-section>
 
-                <x-application.settings-section id="server-transfer-manual-section" title="Manual transfer"
-                    helper="Download the server as a file, for example when the instances cannot reach each other.">
-                    <div class="flex flex-col gap-4">
-                        <p class="text-xs leading-5 text-neutral-500 dark:text-fg-dim">
-                            Import the file on the target via Servers → Import server, then click Disable management
-                            on this server.
-                        </p>
-                        <div class="flex flex-col gap-3 md:max-w-xl">
-                            <x-forms.input id="passphrase" type="password" label="Passphrase"
-                                placeholder="Optional"
-                                helper="If you set a passphrase, the file is encrypted with it. You need the same passphrase to import the file."
-                                autocomplete="new-password" />
-                        </div>
-                        <div class="flex flex-wrap gap-2">
-                            <x-forms.button canGate="view" :canResource="$server" wire:click="exportBundle"
-                                wire:loading.attr="disabled">
-                                <span wire:loading.remove wire:target="exportBundle">Download JSON</span>
-                                <span wire:loading wire:target="exportBundle">Exporting…</span>
-                            </x-forms.button>
-                            <a href="{{ route('server.transfer.import') }}" {{ wireNavigate() }} class="button">
-                                Import page (this instance)
-                            </a>
-                        </div>
-                    </div>
-                </x-application.settings-section>
             @endif
         </div>
     </div>
diff --git a/resources/views/livewire/settings-backup.blade.php b/resources/views/livewire/settings-backup.blade.php
index 05673e9816..93c2269d65 100644
--- a/resources/views/livewire/settings-backup.blade.php
+++ b/resources/views/livewire/settings-backup.blade.php
@@ -13,13 +13,12 @@
 
                     <x-application.settings-section title="Instance database">
                         <div class="grid gap-4 lg:grid-cols-2">
-                            <x-forms.input label="Name" readonly id="name" />
+                            <x-forms.input label="Name" readonly :value="$database->name" />
                             <x-forms.input label="Description" id="description" />
                             <div class="lg:col-span-2">
-                                <x-forms.input label="UUID" readonly id="uuid" />
+                                <x-forms.input label="UUID" readonly :value="$database->uuid" />
                             </div>
-                            <x-forms.input label="User" readonly id="postgres_user" />
-                            <x-forms.input type="password" label="Password" readonly id="postgres_password" />
+                            <x-forms.input label="User" readonly :value="$database->postgres_user" />
                         </div>
                     </x-application.settings-section>
                 </form>
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index 53a30369cd..52e26ce9a9 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -95,8 +95,8 @@
                             ['value' => false, 'label' => 'Disabled'],
                         ]" />
                     <div class="lg:col-span-2">
-                        <x-forms.input id="allowed_ips" label="Allowed API IPs"
-                            helper="Comma-separated IPs or CIDR ranges. Empty or 0.0.0.0 allows all sources."
+                        <x-forms.input id="allowed_ips" label="Allowed IPs"
+                            helper="Applies to the REST API and the MCP endpoint. Comma-separated IPs or CIDR ranges. Empty or 0.0.0.0 allows all sources."
                             placeholder="192.168.1.100, 10.0.0.0/8" />
                     </div>
                 </div>
@@ -107,9 +107,12 @@
                 @endif
                 @if ($is_mcp_server_enabled)
                     <x-callout type="info" title="MCP endpoint" class="mt-4">
-                        <span class="inline-flex items-center gap-1 align-middle"><code>{{ url('/mcp') }}</code><x-copy-button :value="url('/mcp')" label="Copy MCP endpoint" /></span>
-                        uses bearer tokens from
-                        <a href="{{ route('security.api-tokens') }}" class="underline" {{ wireNavigate() }}>Security → API Tokens</a>.
+                        <div class="flex items-center gap-1">
+                            <code>{{ url('/mcp') }}</code>
+                            <x-copy-button :value="url('/mcp')" label="Copy MCP endpoint" />
+                        </div>
+                        Authenticate with a bearer token from
+                        <a href="{{ route('security.api-tokens') }}" class="font-medium underline" {{ wireNavigate() }}>Security → API Tokens</a>.
                     </x-callout>
                 @endif
             </x-application.settings-section>
@@ -163,7 +166,7 @@
                     <x-forms.listbox id="avatar_storage" label="Storage destination" onChange="instantSave"
                         :options="$avatar_storage_options" />
                     <x-forms.input id="image_cdn_url" label="Image CDN URL"
-                        helper="Optional public CDN URL for profile pictures and project icons stored on S3. Leave empty to use the S3 endpoint." placeholder="https://images.example.com" />
+                        helper="Optional public URL (for example a CDN or public bucket domain) that serves profile pictures and project icons stored on S3. Leave empty to serve them through Coolify." placeholder="https://images.example.com" />
                 </div>
                 @if (count($avatar_storage_options) === 1)
                     <x-callout type="info" title="No usable S3 storage configured" class="mt-4">
@@ -171,6 +174,22 @@
                     </x-callout>
                 @endif
             </x-application.settings-section>
+
+            <x-application.settings-section id="file-download-storage-section" title="File downloads"
+                helper="Choose how files from the container file browser and backups are downloaded. Streaming sends each file through this Coolify instance (file browser: up to 1 GB). With S3, the server uploads the file to the bucket and the browser downloads it from S3, up to 5 GB; larger backups are streamed. S3 download links expire after 15 minutes, and the files are deleted after 6 hours.">
+                <div class="flex max-w-md flex-col gap-4">
+                    <x-forms.listbox id="file_download_storage" label="Download method" onChange="instantSave"
+                        :options="[
+                            ['value' => 'stream', 'label' => 'Stream through Coolify'],
+                            ...array_values(array_filter($avatar_storage_options, fn ($option) => $option['value'] !== 'local')),
+                        ]" />
+                </div>
+                <x-callout type="info" title="Bucket auto-delete rule" class="mt-4">
+                    When you select an S3 storage, Coolify adds a lifecycle rule that deletes objects under
+                    <span class="font-mono">coolify-file-downloads/</span> after 1 day, as a safety net. The selected
+                    storage must be reachable from your servers, and the S3 provider must support lifecycle rules.
+                </x-callout>
+            </x-application.settings-section>
         </form>
     </x-settings.layout>
 </div>
diff --git a/resources/views/livewire/settings/index.blade.php b/resources/views/livewire/settings/index.blade.php
index f5a3ae95ce..963c8d1070 100644
--- a/resources/views/livewire/settings/index.blade.php
+++ b/resources/views/livewire/settings/index.blade.php
@@ -48,14 +48,20 @@
             </x-application.settings-section>
 
             <x-application.settings-section title="Network addresses">
+                <x-slot:actions>
+                    <x-forms.button canGate="update" :canResource="$settings" type="button"
+                        wire:click="detectPublicIps">
+                        Detect
+                    </x-forms.button>
+                </x-slot:actions>
                 <div class="grid gap-4 lg:grid-cols-2">
                     <x-forms.input canGate="update" :canResource="$settings" id="public_ipv4" type="password"
                         label="Instance public IPv4"
-                        helper="Set this when Coolify cannot detect the correct public IPv4 address."
+                        helper="Coolify detects this address on start only when the field is empty. Set it when the detected address is wrong. Detect looks it up again and saves it."
                         placeholder="1.2.3.4" autocomplete="new-password" />
                     <x-forms.input canGate="update" :canResource="$settings" id="public_ipv6" type="password"
                         label="Instance public IPv6"
-                        helper="Set this when Coolify cannot detect the correct public IPv6 address."
+                        helper="Coolify detects this address on start only when the field is empty. Set it when the detected address is wrong. Detect looks it up again and saves it."
                         placeholder="2001:db8::1" autocomplete="new-password" />
                 </div>
             </x-application.settings-section>
diff --git a/resources/views/livewire/shared-variables/canvas.blade.php b/resources/views/livewire/shared-variables/canvas.blade.php
index 8fae686071..d01113327e 100644
--- a/resources/views/livewire/shared-variables/canvas.blade.php
+++ b/resources/views/livewire/shared-variables/canvas.blade.php
@@ -2,9 +2,9 @@
     <x-slot:title>
         {{ str($scope)->headline() }} Variables > Canvas | Coolify
     </x-slot>
-    {{-- Fixed rail on xl, hidden below xl (see .app-main-full .application-settings-navigation in app.css). --}}
+    {{-- Page search items; the menu is in the main sidebar. --}}
     <x-shared-variables.sidebar />
-    <div data-environment-canvas data-title="Variables canvas" data-mode="variables" data-endpoint="{{ $endpoint }}"
+    <div data-environment-canvas data-mode="variables" data-endpoint="{{ $endpoint }}"
         data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
         class="relative min-h-0 flex-1" wire:ignore>
         {{-- The canvas moves this group into its toolbar (page actions last, at the right end),
diff --git a/resources/views/livewire/shared-variables/index.blade.php b/resources/views/livewire/shared-variables/index.blade.php
index 4cf74d6c8a..25baec1002 100644
--- a/resources/views/livewire/shared-variables/index.blade.php
+++ b/resources/views/livewire/shared-variables/index.blade.php
@@ -3,66 +3,114 @@
         Shared Variables | Coolify
     </x-slot>
 
+    @php
+        $scopeCards = [
+            'team' => ['Team wide', 'teams', route('shared-variables.team.index'), 'Every resource of this team.', null],
+            'project' => ['Project wide', 'projects', route('shared-variables.project.index'), 'Every environment of a project.', 'project'],
+            'environment' => ['Environment wide', 'layers', route('shared-variables.environment.index'), 'Resources in one environment.', 'environment'],
+            'server' => ['Server wide', 'servers', route('shared-variables.server.index'), 'Resources deployed on one server.', 'server'],
+        ];
+        $panel = 'rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.05]';
+        $panelTitle = 'flex items-center justify-between gap-2 border-b border-neutral-200 px-3 py-2.5 text-[12px] font-semibold text-black dark:border-white/[0.06] dark:text-fg';
+        $row = 'flex items-center gap-2 border-b border-neutral-100 px-3 py-2 last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.04] dark:hover:bg-white/[0.03]';
+        $scopeBadge = 'shrink-0 rounded-full border border-neutral-200 bg-neutral-50 px-1.5 text-[10px] leading-4 font-medium text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.05] dark:text-fg-dim';
+    @endphp
+
     <x-shared-variables.layout>
+        <div class="flex w-full flex-col gap-4">
+            {{-- Scopes, with how many variables each has and on how many owners. --}}
+            <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
+                @foreach ($scopeCards as $scope => [$label, $icon, $href, $description, $ownerNoun])
+                    @php $counts = $overview['scopes'][$scope]; @endphp
+                    <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
+                        href="{{ $href }}" {{ wireNavigate() }}>
+                        <div class="flex items-start justify-between gap-2">
+                            <div
+                                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
+                                <x-reicon :name="$icon" class="size-4" />
+                            </div>
+                            <span class="text-[22px] leading-7 font-semibold tabular-nums text-black dark:text-fg">{{ $counts['variables'] }}</span>
+                        </div>
+                        <div class="mt-auto pt-5">
+                            <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">{{ $label }}</h2>
+                            <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
+                                @if ($ownerNoun && $counts['variables'] > 0)
+                                    {{ str('variable')->plural($counts['variables']) }} on {{ $counts['owners'] }} {{ str($ownerNoun)->plural($counts['owners']) }}.
+                                @else
+                                    {{ $description }}
+                                @endif
+                            </p>
+                        </div>
+                    </a>
+                @endforeach
+            </div>
 
-    <div class="w-full">
-    <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.team.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="teams" class="size-4" />
-            </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Team wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Available to every resource owned by this team.
-                </p>
-            </div>
-        </a>
+            @if ($overview['missing'] > 0)
+                <div class="flex items-start gap-2 rounded-xl border border-warning/30 bg-warning/10 px-3 py-2.5 text-[12px] text-neutral-700 dark:text-fg-dim" role="note">
+                    <x-reicon name="alert-triangle" class="mt-px size-4 shrink-0 text-warning" />
+                    <p>
+                        {{ $overview['missing'] }} {{ str('reference')->plural($overview['missing']) }} in resource variables
+                        {{ $overview['missing'] === 1 ? 'points' : 'point' }} to a shared variable that does not exist. Open a scope canvas to find
+                        {{ $overview['missing'] === 1 ? 'it' : 'them' }}.
+                    </p>
+                </div>
+            @endif
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.project.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="projects" class="size-4" />
-            </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Project wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Shared by every environment inside a project.
-                </p>
-            </div>
-        </a>
+            <div class="grid grid-cols-1 gap-3 lg:grid-cols-3">
+                {{-- Most used: links open the variable on its scope canvas. --}}
+                <section class="{{ $panel }}">
+                    <h2 class="{{ $panelTitle }}">Most used</h2>
+                    @forelse ($overview['used'] as $variable)
+                        <a class="{{ $row }}" href="{{ $variable['link'] }}" {{ wireNavigate() }}>
+                            <span class="min-w-0 flex-1">
+                                <span class="block truncate font-mono text-[12px] text-black dark:text-fg">{{ $variable['key'] }}</span>
+                                <span class="block truncate text-[11px] text-neutral-500 dark:text-fg-faint">{{ $variable['owner'] }}</span>
+                            </span>
+                            <span class="shrink-0 text-[11px] text-neutral-500 tabular-nums dark:text-fg-dim">
+                                {{ $variable['resources'] }} {{ str('resource')->plural($variable['resources']) }}
+                            </span>
+                        </a>
+                    @empty
+                        <p class="px-3 py-4 text-[12px] text-neutral-500 dark:text-fg-faint">No resource uses a shared variable yet.</p>
+                    @endforelse
+                </section>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.environment.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="layers" class="size-4" />
-            </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Environment wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Reused by resources in one environment.
-                </p>
-            </div>
-        </a>
+                <section class="{{ $panel }}">
+                    <h2 class="{{ $panelTitle }}">Recently changed</h2>
+                    @forelse ($overview['recent'] as $variable)
+                        <a class="{{ $row }}" href="{{ $variable['link'] }}" {{ wireNavigate() }}>
+                            <span class="min-w-0 flex-1">
+                                <span class="block truncate font-mono text-[12px] text-black dark:text-fg">{{ $variable['key'] }}</span>
+                                <span class="block truncate text-[11px] text-neutral-500 dark:text-fg-faint">{{ $variable['owner'] }}</span>
+                            </span>
+                            <span class="shrink-0 text-[11px] text-neutral-500 dark:text-fg-dim">{{ $variable['updated_at']?->diffForHumans(short: true) }}</span>
+                        </a>
+                    @empty
+                        <p class="px-3 py-4 text-[12px] text-neutral-500 dark:text-fg-faint">No shared variables yet.</p>
+                    @endforelse
+                </section>
 
-        <a class="group flex min-h-32 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.05] dark:hover:border-white/[0.14]"
-            href="{{ route('shared-variables.server.index') }}" {{ wireNavigate() }}>
-            <div
-                class="flex size-8 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
-                <x-reicon name="servers" class="size-4" />
+                {{-- Not referenced by any resource: candidates to use or to clean up. --}}
+                <section class="{{ $panel }}">
+                    <h2 class="{{ $panelTitle }}">
+                        Not used
+                        <span class="text-[11px] font-normal text-neutral-400 tabular-nums dark:text-fg-faint">{{ $overview['unused']->count() }}</span>
+                    </h2>
+                    <div class="max-h-72 overflow-y-auto">
+                        @forelse ($overview['unused'] as $variable)
+                            <a class="{{ $row }}" href="{{ $variable['link'] }}" {{ wireNavigate() }}>
+                                <span class="min-w-0 flex-1">
+                                    <span class="block truncate font-mono text-[12px] text-black dark:text-fg">{{ $variable['key'] }}</span>
+                                    <span class="block truncate text-[11px] text-neutral-500 dark:text-fg-faint">{{ $variable['owner'] }}</span>
+                                </span>
+                                <span class="{{ $scopeBadge }}">{{ str($variable['scope'])->headline() }}</span>
+                            </a>
+                        @empty
+                            <p class="px-3 py-4 text-[12px] text-neutral-500 dark:text-fg-faint">Every shared variable is in use.</p>
+                        @endforelse
+                    </div>
+                </section>
             </div>
-            <div class="mt-auto pt-5">
-                <h2 class="text-[13px]! leading-4! font-semibold! text-black dark:text-fg">Server wide</h2>
-                <p class="mt-1 text-[11px] leading-4 text-neutral-500 dark:text-fg-faint">
-                    Available to resources deployed on one server.
-                </p>
-            </div>
-        </a>
-    </div>
-    </div>
+        </div>
     </x-shared-variables.layout>
 </div>
diff --git a/resources/views/livewire/shared/list-search-controls.blade.php b/resources/views/livewire/shared/list-search-controls.blade.php
index d14ddc8f4b..1a99c6352e 100644
--- a/resources/views/livewire/shared/list-search-controls.blade.php
+++ b/resources/views/livewire/shared/list-search-controls.blade.php
@@ -4,11 +4,5 @@
             clear-when="search" clear-action="search = ''"
             class="h-8! rounded-lg! border-neutral-200! bg-white! py-0! pr-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint" />
     </div>
-    <div class="flex items-center gap-3">
-        <span class="text-[11px] text-neutral-500 dark:text-fg-faint"><span x-text="filteredItems.length"></span> <span x-text="filteredItems.length === 1 ? '{{ $singular }}' : '{{ $plural }}'"></span></span>
-        <div class="view-toggle">
-            <button type="button" x-on:click="setViewMode('table')" class="flex size-7.5 items-center justify-center rounded-md transition-colors" :class="viewMode === 'table' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'" aria-label="Table view"><x-reicon name="unordered-list" class="size-3.5" /></button>
-            <button type="button" x-on:click="setViewMode('grid')" class="flex size-7.5 items-center justify-center rounded-md transition-colors" :class="viewMode === 'grid' ? 'control-selected' : 'text-neutral-400 hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg'" aria-label="Grid view"><x-reicon name="grid" class="size-3.5" /></button>
-        </div>
-    </div>
+    <x-canvas-view-toggle />
 </div>
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 9567a3f7fa..6a74d5fb0b 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -34,7 +34,7 @@
                     'label' => 'Danger Zone',
                     'route' => 'source.github.danger',
                     'active' => $activeTab === 'danger',
-                    'icon' => 'shield-alert',
+                    'icon' => 'danger',
                 ],
             ];
         @endphp
@@ -47,12 +47,14 @@
         @if ($showSettingsSidebar)
             <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
                 <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-                    <aside class="application-settings-navigation min-w-0 xl:self-start"
+                    <x-main-nav-menu back-label="Sources" back-title="Back to Integrations"
                         data-settings-search-items="{{ json_encode(settingsSearchItems(['GitHub App' => $settingsMenuItems], $githubAppRouteParameters)) }}">
                         <nav aria-label="GitHub App settings"
                             class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                            <div class="nav-section hidden xl:block">Settings</div>
                             @foreach ($settingsMenuItems as $menuItem)
+                                @if ($menuItem['label'] === 'Danger Zone')
+                                    <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+                                @endif
                                 <a wire:key="github-app-settings-{{ str($menuItem['label'])->slug() }}"
                                     @class([
                                         'menu-item',
@@ -65,7 +67,7 @@
                                 </a>
                             @endforeach
                         </nav>
-                    </aside>
+                    </x-main-nav-menu>
 
                     <div class="min-w-0">
                         @if (!data_get($github_app, 'installation_id') && $activeTab === 'general')
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index 2ba6bb1d63..a773769aa0 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -95,7 +95,7 @@
             </x-application.settings-section>
 
             <x-application.settings-section title="Webhook"
-                description="Configure this webhook URL in your GitLab project settings (Settings → Webhooks).">
+                description="Configure this webhook URL in your GitLab project settings (Settings → Webhooks). On self-managed GitLab, an admin can instead add the same URL and token once as a system hook (Admin Area → System hooks) with Push events and Merge request events enabled.">
                 <div class="grid gap-4 lg:grid-cols-2">
                     <div class="lg:col-span-2">
                         <x-forms.input readonly label="Webhook URL"
diff --git a/resources/views/livewire/storage/index.blade.php b/resources/views/livewire/storage/index.blade.php
index 30f492705e..ddb23ab6ea 100644
--- a/resources/views/livewire/storage/index.blade.php
+++ b/resources/views/livewire/storage/index.blade.php
@@ -44,7 +44,7 @@
             matches(values) { const query = this.search.trim().toLowerCase(); return !query || values.some(value => String(value || '').toLowerCase().includes(query)); },
             setViewMode(mode) { this.viewMode = mode; localStorage.setItem('coolify-s3-storages-view', mode); }
         }">
-        @include('livewire.shared.list-search-controls', ['placeholder' => 'Search S3 storages', 'singular' => 'storage', 'plural' => 'storages'])
+        @include('livewire.shared.list-search-controls', ['placeholder' => 'Search S3 storages'])
         <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
             @foreach ($s3 as $storage)
                 <a x-show="matches(@js([$storage->name, $storage->description ?: 'S3-compatible storage', $storage->is_usable ? 'Connected' : 'Not usable']))" {{ wireNavigate() }} href="/storages/{{ $storage->uuid }}"
diff --git a/resources/views/livewire/storage/show.blade.php b/resources/views/livewire/storage/show.blade.php
index 93fa1150ee..aacc03706a 100644
--- a/resources/views/livewire/storage/show.blade.php
+++ b/resources/views/livewire/storage/show.blade.php
@@ -23,7 +23,7 @@
                 'label' => 'Danger Zone',
                 'route' => 'storage.danger',
                 'active' => $currentRoute === 'storage.danger',
-                'icon' => 'shield-alert',
+                'icon' => 'danger',
             ],
         ];
     @endphp
@@ -36,12 +36,14 @@
     @if ($showSettingsSidebar)
         <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
             <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-                <aside class="application-settings-navigation min-w-0 xl:self-start"
+                <x-main-nav-menu back-label="S3 Storage" back-title="Back to Integrations"
                     data-settings-search-items="{{ json_encode(settingsSearchItems(['S3 storage' => $settingsMenuItems], $storageRouteParameters)) }}">
                     <nav aria-label="S3 storage settings"
                         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
-                        <div class="nav-section hidden xl:block">Settings</div>
                         @foreach ($settingsMenuItems as $menuItem)
+                            @if ($menuItem['label'] === 'Danger Zone')
+                                <div class="col-span-full my-2 hidden border-t border-neutral-200 xl:block dark:border-white/[0.06]" aria-hidden="true"></div>
+                            @endif
                             <a wire:key="storage-settings-{{ str($menuItem['label'])->slug() }}"
                                 @class([
                                     'menu-item',
@@ -54,7 +56,7 @@
                             </a>
                         @endforeach
                     </nav>
-                </aside>
+                </x-main-nav-menu>
 
                 <div class="min-w-0">
                     @if ($currentRoute === 'storage.show')
diff --git a/resources/views/livewire/tags/canvas.blade.php b/resources/views/livewire/tags/canvas.blade.php
index 3a01be7f6f..246addc1e6 100644
--- a/resources/views/livewire/tags/canvas.blade.php
+++ b/resources/views/livewire/tags/canvas.blade.php
@@ -2,7 +2,7 @@
     <x-slot:title>
         Tags > Canvas | Coolify
     </x-slot>
-    <div data-environment-canvas data-title="Tags canvas" data-mode="tags" data-endpoint="/tags/canvas"
+    <div data-environment-canvas data-mode="tags" data-endpoint="/tags/canvas"
         data-team="{{ $teamId }}" data-user="{{ auth()->id() }}"
         class="relative h-full" wire:ignore>
         {{-- The canvas moves this group into its toolbar (page actions last, at the right end),
diff --git a/resources/views/livewire/tags/show.blade.php b/resources/views/livewire/tags/show.blade.php
index adad8cd0ce..65904408df 100644
--- a/resources/views/livewire/tags/show.blade.php
+++ b/resources/views/livewire/tags/show.blade.php
@@ -56,7 +56,7 @@
                     </button>
                 </div>
 
-                <div class="flex items-center gap-2">
+                <div class="flex flex-wrap items-center gap-2">
                     <x-table.dropdown panel-class="w-52!">
                         <x-slot:trigger>
                             <button type="button" class="button" aria-haspopup="listbox" :aria-expanded="open">
@@ -280,10 +280,44 @@
             <x-application.settings-section :title="$tag->name"
                 description="Use this webhook to deploy every resource with this tag.">
                 <x-slot:actions>
-                    <a href="{{ app(App\Services\TagCanvas::class)->connectLink($tag) }}" class="button whitespace-nowrap"
-                        title="Add this tag to resources, and see which resources have it">
-                        <x-reicon name="link" class="size-3.5" />
-                        Connect to resources
+                    {{-- Two ways to connect: a list in a modal, or the canvas (wide screens only). --}}
+                    <x-modal-input title="Connect to resources" subtitle="Add this tag to resources, or remove it."
+                        wireOpen="connectResourcesOpen" :wireIgnore="false" :contentClicks="false">
+                        <x-slot:content>
+                            <button type="button" class="button whitespace-nowrap" wire:click="openConnectResources">
+                                <x-reicon name="link" class="size-3.5" />
+                                Connect to resources
+                            </button>
+                        </x-slot:content>
+                        @forelse ($connectableResources as $context => $resources)
+                            <div wire:key="connect-group-{{ $context }}" class="mb-4 last:mb-0">
+                                <p class="mb-1.5 truncate text-[11px] font-medium text-neutral-500 dark:text-fg-faint">{{ $context }}</p>
+                                <div class="flex flex-col gap-1">
+                                    @foreach ($resources as $resource)
+                                        <label wire:key="connect-resource-{{ $resource['uuid'] }}" @class([
+                                            'flex items-center gap-2.5 rounded-md border border-neutral-200 px-3 py-2 text-[13px] dark:border-white/[0.08]',
+                                            'cursor-pointer' => $resource['can_update'],
+                                            'opacity-60' => ! $resource['can_update'],
+                                        ])>
+                                            <input type="checkbox" @checked($resource['tagged']) @disabled(! $resource['can_update'])
+                                                wire:click="toggleResource(@js($resource['uuid']))" wire:loading.attr="disabled"
+                                                class="size-4 shrink-0 rounded-sm border-neutral-300 text-accent focus:ring-accent dark:border-white/20 dark:bg-transparent" />
+                                            <span class="min-w-0 truncate">{{ $resource['name'] }}</span>
+                                        </label>
+                                    @endforeach
+                                </div>
+                            </div>
+                        @empty
+                            <div wire:loading.remove wire:target="openConnectResources">
+                                <x-empty title="No resources yet" description="Create a resource in a project first." icon-name="tags" size="sm" />
+                            </div>
+                        @endforelse
+                    </x-modal-input>
+                    <a href="{{ app(App\Services\TagCanvas::class)->connectLink($tag) }}"
+                        class="button hidden whitespace-nowrap md:inline-flex"
+                        title="Add this tag to resources on the canvas, and see which resources have it">
+                        <x-reicon name="deploy-canvas" class="size-3.5" />
+                        Connect in canvas
                     </a>
                     @can('delete', $tag)
                         <x-modal-confirmation title="Delete this tag?" isErrorButton buttonTitle="Delete"
diff --git a/resources/views/livewire/team/member.blade.php b/resources/views/livewire/team/member.blade.php
index 41e1412907..4b1261a07a 100644
--- a/resources/views/livewire/team/member.blade.php
+++ b/resources/views/livewire/team/member.blade.php
@@ -40,52 +40,54 @@
     <div class="flex justify-end">
         @can('manageMembers', currentTeam())
             @if ($member->id !== Auth::id())
-                <div class="relative" x-data="{ open: false }" @keydown.escape.window="open = false"
-                    @click.outside="open = false">
-                    <button type="button" class="button h-7! px-2.5! text-[11px]!" @click="open = !open"
-                        aria-haspopup="menu" :aria-expanded="open">
+                <div x-data="{ open: false }" @keydown.escape.window="open = false">
+                    <button type="button" class="button h-7! px-2.5! text-[11px]!" x-ref="trigger"
+                        @click="open = !open" aria-haspopup="menu" :aria-expanded="open">
                         Manage
                     </button>
-                    <div x-show="open" x-cloak role="menu"
-                        class="listbox-panel top-full! right-0! left-auto! mt-1! w-36! min-w-0!">
-                        @if (Auth::user()->isOwner())
-                            @if (data_get($member, 'pivot.role') !== 'owner')
-                                <button type="button" class="listbox-option justify-start!" wire:click="makeOwner"
-                                    @click="open = false">
-                                    Make owner
-                                </button>
+                    <template x-teleport="body">
+                        <div x-show="open" x-cloak role="menu" x-anchor.bottom-end.fixed.offset.4="$refs.trigger"
+                            @click.outside="if (! $refs.trigger.contains($event.target)) open = false"
+                            class="listbox-panel w-36! min-w-0! z-50!">
+                            @if (Auth::user()->isOwner())
+                                @if (data_get($member, 'pivot.role') !== 'owner')
+                                    <button type="button" class="listbox-option justify-start!" wire:click="makeOwner"
+                                        @click="open = false">
+                                        Make owner
+                                    </button>
+                                @endif
+                                @if (data_get($member, 'pivot.role') !== 'admin')
+                                    <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
+                                        @click="open = false">
+                                        Make admin
+                                    </button>
+                                @endif
+                                @if (data_get($member, 'pivot.role') !== 'member')
+                                    <button type="button" class="listbox-option justify-start!"
+                                        wire:click="makeReadonly" @click="open = false">
+                                        Make member
+                                    </button>
+                                @endif
+                            @elseif (Auth::user()->isAdmin())
+                                @if (data_get($member, 'pivot.role') === 'admin')
+                                    <button type="button" class="listbox-option justify-start!"
+                                        wire:click="makeReadonly" @click="open = false">
+                                        Make member
+                                    </button>
+                                @elseif (data_get($member, 'pivot.role') === 'member')
+                                    <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
+                                        @click="open = false">
+                                        Make admin
+                                    </button>
+                                @endif
                             @endif
-                            @if (data_get($member, 'pivot.role') !== 'admin')
-                                <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
-                                    @click="open = false">
-                                    Make admin
-                                </button>
-                            @endif
-                            @if (data_get($member, 'pivot.role') !== 'member')
-                                <button type="button" class="listbox-option justify-start!"
-                                    wire:click="makeReadonly" @click="open = false">
-                                    Make member
-                                </button>
-                            @endif
-                        @elseif (Auth::user()->isAdmin())
-                            @if (data_get($member, 'pivot.role') === 'admin')
-                                <button type="button" class="listbox-option justify-start!"
-                                    wire:click="makeReadonly" @click="open = false">
-                                    Make member
-                                </button>
-                            @elseif (data_get($member, 'pivot.role') === 'member')
-                                <button type="button" class="listbox-option justify-start!" wire:click="makeAdmin"
-                                    @click="open = false">
-                                    Make admin
-                                </button>
-                            @endif
-                        @endif
-                        <div class="my-1 border-t border-neutral-200 dark:border-white/[0.08]"></div>
-                        <button type="button" class="listbox-option justify-start! text-error! hover:text-error!"
-                            wire:click="remove" @click="open = false">
-                            Remove member
-                        </button>
-                    </div>
+                            <div class="my-1 border-t border-neutral-200 dark:border-white/[0.08]"></div>
+                            <button type="button" class="listbox-option justify-start! text-error! hover:text-error!"
+                                wire:click="remove" @click="open = false">
+                                Remove member
+                            </button>
+                        </div>
+                    </template>
                 </div>
             @endif
         @endcan
diff --git a/resources/views/livewire/traffic/_breakdown-section.blade.php b/resources/views/livewire/traffic/_breakdown-section.blade.php
index e6b1e9be4f..df862b9ec1 100644
--- a/resources/views/livewire/traffic/_breakdown-section.blade.php
+++ b/resources/views/livewire/traffic/_breakdown-section.blade.php
@@ -1,5 +1,5 @@
 {{--
-    One breakdown dimension rendered as a paginated settings-section. Handles the
+    One breakdown dimension rendered as a sortable, paginated settings-section. Handles the
     per-dimension presentation: referrers get a DuckDuckGo favicon + an openable
     external link (rel="noopener noreferrer nofollow", new tab), devices are mapped
     to friendly capitalized labels, and Sentinel's `__other__` overflow bucket reads
@@ -20,7 +20,14 @@
         <x-empty size="sm" title="No data"
             :description="'No '.strtolower($label).' data for the selected range.'" icon-name="network" />
     @else
-        <div x-data="{ page: 0, per: 10, total: {{ count($rows) }} }">
+        <div x-data="trafficTable()">
+            <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+                @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Name', 'text' => true, 'class' => 'min-w-0 flex-1'])
+                <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+                @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+                @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
+            </div>
+            <div class="flex flex-col">
             @foreach ($rows as $row)
                 @php
                     $value = (string) ($row['value'] ?? '');
@@ -35,11 +42,13 @@
                             default => $value !== '' ? $value : 'Unknown',
                         };
                     $requests = (int) ($row['requests'] ?? 0);
+                    $bytesOut = (int) ($row['bytesOut'] ?? 0);
                     $width = min(100, round(($requests / $maxRequests) * 100, 1));
                 @endphp
                 <div wire:key="analytics-{{ $dimension }}-{{ md5($value) }}"
-                    x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                    class="flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]">
+                    data-row="{{ json_encode(['name' => $display, 'requests' => $requests, 'bytesOut' => $bytesOut]) }}" @if ($isOther) data-pinned @endif
+                    x-show="shown($el)"
+                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
                     @if ($dimension === 'referer' && $host)
                         <img src="{{ refererFaviconUrl($host) }}" alt="" loading="lazy" width="16" height="16"
                             class="size-4 shrink-0 rounded-sm" onerror="this.style.visibility='hidden'">
@@ -51,11 +60,12 @@
                     <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
                         <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
                     </div>
-                    <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                    <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
                         title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
-                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes((int) ($row['bytesOut'] ?? 0)) }}</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($bytesOut) }}</span>
                 </div>
             @endforeach
+            </div>
             @include('livewire.traffic._pager')
         </div>
     @endif
diff --git a/resources/views/livewire/traffic/_geo.blade.php b/resources/views/livewire/traffic/_geo.blade.php
index 06f24bfee6..754edd9aa6 100644
--- a/resources/views/livewire/traffic/_geo.blade.php
+++ b/resources/views/livewire/traffic/_geo.blade.php
@@ -1,13 +1,14 @@
 {{--
-    Shared geo visualization for traffic analytics: a lightweight interactive 3D
-    dotted globe (WebGL, via cobe — see resources/js/traffic-globe.js) with a
-    request-volume marker per country, beside a scrollable ranked country list.
-    Hovering a country row rotates the globe to face it. Driven by the `country`
-    breakdown; each row is ['value' => ISO-A2, 'requests', 'bytesOut']. The globe
-    live-updates from the host's `refreshChartData-{chartId}-status` payload
-    (`geo` key), so `$chartId` must be in scope.
+    "Locations" settings-section for traffic analytics: a lightweight interactive
+    3D dotted globe (WebGL, via cobe — see resources/js/traffic-globe.js) beside a
+    scrollable ranked list. A Countries / Cities switch in the section header picks
+    the list and the globe markers; the choice is saved per-browser in localStorage.
+    Hovering a row rotates the globe to face it. The globe live-updates from the
+    host's `refreshChartData-{chartId}-status` payload (`geo` key), so `$chartId`
+    must be in scope.
 
-    @param iterable $countries    country-breakdown rows
+    @param iterable $countries    country-breakdown rows: ['value' => ISO-A2, 'requests', 'bytesOut']
+    @param array    $cities       output of trafficCityRows(); empty when there is no city data
     @param ?string  $attribution  optional Sentinel attribution note
 --}}
 @php
@@ -25,9 +26,6 @@
         fn ($r) => preg_match('/^[A-Z]{2}$/', $r['value']) && countryName($r['value']) !== 'Unknown'
     );
 
-    // Initial marker payload for the globe, keyed by ISO-A2 request volume.
-    $geoInit = $known->map(fn ($r) => ['code' => $r['value'], 'requests' => $r['requests']])->values()->all();
-
     $countryRows = $known->values();
     if ($unknown->isNotEmpty()) {
         $countryRows->push([
@@ -39,99 +37,179 @@
     $countryRows = $countryRows->sortByDesc('requests')->values();
     $maxRequests = max(1, (int) $countryRows->max('requests'));
 
+    $cityRows = collect($cities ?? []);
+    $maxCityRequests = max(1, (int) $cityRows->max('requests'));
+
+    // Initial marker payload for the globe: one set for each view.
+    $geoInit = trafficGeoMarkers($known->all(), $cityRows->all());
+
     $hasData = $countryRows->isNotEmpty();
     $globeId = ($chartId ?? 'traffic').'-globe';
+    $viewButton = 'h-7 rounded-md px-2.5 text-[12px] font-medium transition-colors';
+    $viewButtonActive = 'bg-white text-black shadow-sm ring-1 ring-neutral-200 dark:bg-white/[0.09] dark:text-fg dark:ring-white/[0.08]';
+    $viewButtonInactive = 'text-neutral-500 hover:text-black dark:text-fg-faint dark:hover:text-fg';
+    $listClass = 'max-h-[320px] overflow-y-auto pr-1 scrollbar-thin scrollbar-track-transparent scrollbar-thumb-neutral-300 dark:scrollbar-thumb-white/10';
+    $rowClass = 'group flex min-h-10 items-center gap-3 rounded-md px-2 py-1.5 transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.03]';
 @endphp
 
-<div class="flex flex-col">
-    @if (! $hasData)
-        <x-empty size="sm" title="No data" description="No country data for the selected range."
-            icon-name="network" />
-    @else
-        <div class="grid grid-cols-1 items-stretch gap-4 border-b border-neutral-200 p-4 lg:grid-cols-[2fr_3fr] dark:border-white/[0.07]">
-            {{-- Interactive dotted globe (40%). wire:ignore so live-poll morphs never tear
-                 down the WebGL canvas. Mounted via Alpine, not Livewire's script directive:
-                 it ran before the lazy-loaded canvas was in the DOM, and only once per
-                 component, so a globe inserted by a later render (no data -> data after a
-                 range change or live poll) never mounted either. Alpine's
-                 init()/destroy() run each time this element enters or leaves the DOM. --}}
-            <div wire:ignore class="flex items-center justify-center"
-                x-data="{
-                    controller: null,
-                    refreshCleanup: null,
-                    isDark() { return document.documentElement.classList.contains('dark'); },
-                    init() {
-                        const canvas = this.$refs.canvas;
-                        if (typeof window.mountTrafficGlobe !== 'function') { return; }
-                        this.controller = window.mountTrafficGlobe(canvas, @js($geoInit), this.isDark());
-                        // Expose for row-hover focus() from the Alpine list scope.
-                        canvas._trafficGlobe = this.controller;
-                        this.refreshCleanup = Livewire.on('refreshChartData-{!! $chartId !!}-status', payload => {
-                            const data = Array.isArray(payload) ? payload[0] : payload;
-                            if (data && Array.isArray(data.geo)) { this.controller.update(data.geo, this.isDark()); }
-                        });
-                    },
-                    destroy() {
-                        if (this.refreshCleanup) { this.refreshCleanup(); this.refreshCleanup = null; }
-                        if (this.controller) { this.controller.destroy(); this.controller = null; }
-                        if (this.$refs.canvas) { this.$refs.canvas._trafficGlobe = null; }
-                    },
-                }">
-                <div class="relative aspect-square w-full max-w-[320px]">
-                    <canvas id="{!! $globeId !!}" x-ref="canvas"
-                        class="h-full w-full [touch-action:none]"
-                        style="width: 100%; height: 100%;"></canvas>
-                </div>
-            </div>
+<x-application.settings-section id="analytics-country-section" title="Locations"
+    helper="Request volume by visitor country and city for the selected range." flush
+    x-data="{
+        // Storage can be blocked (sandboxed iframe, privacy mode, full quota); the switch then works without saving.
+        view: (() => { try { return localStorage.getItem('traffic-geo-view') === 'cities' ? 'cities' : 'countries'; } catch (e) { return 'countries'; } })(),
+        setView(next) {
+            this.view = next;
+            try { localStorage.setItem('traffic-geo-view', next); } catch (e) {}
+        },
+        globe() {
+            const canvas = document.getElementById('{{ $globeId }}');
 
-            {{-- Ranked, scrollable country list (60%). Hover a row to face it on the globe. --}}
-            <div class="min-w-0" x-data="{
-                focus(code) {
-                    const g = document.getElementById('{!! $globeId !!}');
-                    if (g && g._trafficGlobe) { g._trafficGlobe.focus(code); }
-                },
-                blur() {
-                    const g = document.getElementById('{!! $globeId !!}');
-                    if (g && g._trafficGlobe) { g._trafficGlobe.resume(); }
-                },
-            }">
-                <div class="max-h-[320px] overflow-y-auto pr-1 scrollbar-thin scrollbar-track-transparent scrollbar-thumb-neutral-300 dark:scrollbar-thumb-white/10">
-                    @foreach ($countryRows as $row)
-                        @php
-                            $isUnknown = $row['value'] === '';
-                            $width = min(100, round(($row['requests'] / $maxRequests) * 100, 1));
-                        @endphp
-                        <div wire:key="geo-country-{{ $globeId }}-{{ $loop->index }}"
-                            @if (! $isUnknown) @mouseenter="focus('{{ $row['value'] }}')" @mouseleave="blur()" @endif
-                            class="group flex min-h-10 items-center gap-3 rounded-md px-2 py-1.5 transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.03]">
-                            @php $flagUrl = $isUnknown ? null : countryFlagUrl($row['value']); @endphp
-                            @if ($flagUrl)
-                                <img src="{{ $flagUrl }}" srcset="{{ countryFlagUrl($row['value'], '48x36') }} 2x" alt=""
-                                    loading="lazy" width="20" height="15"
-                                    class="h-[15px] w-5 shrink-0 rounded-[2px] object-cover ring-1 ring-black/5 dark:ring-white/10"
-                                    onerror="this.style.visibility='hidden'">
-                            @else
-                                <span class="shrink-0 text-[14px] leading-none" aria-hidden="true">🌐</span>
-                            @endif
-                            <span class="min-w-0 flex-1 truncate text-[12px] text-black dark:text-fg">
-                                {{ $isUnknown ? 'Unknown' : countryName($row['value']) }}
-                            </span>
-                            <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
-                                <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
-                            </div>
-                            <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
-                                title="{{ number_format($row['requests']) }} requests">{{ compactNumber($row['requests']) }}</span>
-                            <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($row['bytesOut']) }}</span>
-                        </div>
-                    @endforeach
-                </div>
-            </div>
+            return canvas ? canvas._trafficGlobe : null;
+        },
+    }">
+    <x-slot:actions>
+        @if ($hasData)
+        <div wire:key="geo-view-{{ $globeId }}"
+            class="inline-flex items-center gap-0.5 rounded-lg bg-neutral-100 p-1 dark:bg-white/[0.04]"
+            role="group" aria-label="Location detail">
+            @foreach (['countries' => 'Countries', 'cities' => 'Cities'] as $viewKey => $viewLabel)
+                <button type="button" @click="setView('{{ $viewKey }}')"
+                    :aria-pressed="view === '{{ $viewKey }}' ? 'true' : 'false'"
+                    class="{{ $viewButton }}"
+                    :class="view === '{{ $viewKey }}' ? '{{ $viewButtonActive }}' : '{{ $viewButtonInactive }}'">{{ $viewLabel }}</button>
+            @endforeach
         </div>
-
-        @if (! empty($attribution))
-            <p class="px-4 py-2 text-[11px] text-neutral-400 dark:text-fg-faint">
-                {{ $attribution }}
-            </p>
         @endif
-    @endif
-</div>
+    </x-slot:actions>
+
+    <div class="flex flex-col">
+        @if (! $hasData)
+            <x-empty size="sm" title="No data" description="No country data for the selected range."
+                icon-name="network" />
+        @else
+            {{-- Keyed so the lazy-load morph inserts fresh nodes instead of reusing the
+                 placeholder skeleton, which has the same shape. --}}
+            <div wire:key="geo-body-{{ $globeId }}"
+                class="grid grid-cols-1 items-start gap-4 border-b border-neutral-200 p-4 lg:grid-cols-[2fr_3fr] dark:border-white/[0.07]">
+                {{-- Interactive dotted globe (40%). wire:ignore so live-poll morphs never tear
+                     down the WebGL canvas. Mounted via Alpine init()/destroy(), which run each
+                     time this element enters or leaves the DOM (a Livewire script directive
+                     runs one time only, before the lazy-loaded canvas exists). --}}
+                <div wire:ignore class="flex items-center justify-center"
+                    x-data="{
+                        controller: null,
+                        refreshCleanup: null,
+                        geo: @js($geoInit),
+                        isDark() { return document.documentElement.classList.contains('dark'); },
+                        // City markers in the Cities view; country markers when there are no cities.
+                        markers() {
+                            return this.view === 'cities' && this.geo.cities.length ? this.geo.cities : this.geo.countries;
+                        },
+                        init() {
+                            const canvas = this.$refs.canvas;
+                            if (typeof window.mountTrafficGlobe !== 'function') { return; }
+                            this.controller = window.mountTrafficGlobe(canvas, this.markers(), this.isDark());
+                            // Expose for row-hover focus() from the list rows.
+                            canvas._trafficGlobe = this.controller;
+                            this.$watch('view', () => this.controller && this.controller.update(this.markers(), this.isDark()));
+                            this.refreshCleanup = Livewire.on('refreshChartData-{!! $chartId !!}-status', payload => {
+                                const data = Array.isArray(payload) ? payload[0] : payload;
+                                if (data && data.geo && Array.isArray(data.geo.countries)) {
+                                    this.geo = data.geo;
+                                    this.controller.update(this.markers(), this.isDark());
+                                }
+                            });
+                        },
+                        destroy() {
+                            if (this.refreshCleanup) { this.refreshCleanup(); this.refreshCleanup = null; }
+                            if (this.controller) { this.controller.destroy(); this.controller = null; }
+                            if (this.$refs.canvas) { this.$refs.canvas._trafficGlobe = null; }
+                        },
+                    }">
+                    <div class="relative aspect-square w-full max-w-[320px]">
+                        <canvas id="{!! $globeId !!}" x-ref="canvas"
+                            class="h-full w-full [touch-action:none]"
+                            style="width: 100%; height: 100%;"></canvas>
+                    </div>
+                </div>
+
+                {{-- Ranked, scrollable lists (60%). Hover a row to face it on the globe. --}}
+                <div class="min-w-0">
+                    <div x-show="view === 'countries'" class="{{ $listClass }}">
+                        @foreach ($countryRows as $row)
+                            @php
+                                $isUnknown = $row['value'] === '';
+                                $width = min(100, round(($row['requests'] / $maxRequests) * 100, 1));
+                                $flagUrl = $isUnknown ? null : countryFlagUrl($row['value']);
+                            @endphp
+                            <div wire:key="geo-country-{{ $globeId }}-{{ $isUnknown ? 'unknown' : $row['value'] }}"
+                                @if (! $isUnknown) @mouseenter="globe()?.focus('{{ $row['value'] }}')" @mouseleave="globe()?.resume()" @endif
+                                class="{{ $rowClass }}">
+                                @if ($flagUrl)
+                                    <img src="{{ $flagUrl }}" srcset="{{ countryFlagUrl($row['value'], '48x36') }} 2x" alt=""
+                                        loading="lazy" width="20" height="15"
+                                        class="h-[15px] w-5 shrink-0 rounded-[2px] object-cover ring-1 ring-black/5 dark:ring-white/10"
+                                        onerror="this.style.visibility='hidden'">
+                                @else
+                                    <span class="w-5 shrink-0 text-center text-[14px] leading-none" aria-hidden="true">🌐</span>
+                                @endif
+                                <span class="min-w-0 flex-1 truncate text-[12px] text-black dark:text-fg">
+                                    {{ $isUnknown ? 'Unknown' : countryName($row['value']) }}
+                                </span>
+                                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
+                                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                                </div>
+                                <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                                    title="{{ number_format($row['requests']) }} requests">{{ compactNumber($row['requests']) }}</span>
+                                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($row['bytesOut']) }}</span>
+                            </div>
+                        @endforeach
+                    </div>
+
+                    <div x-show="view === 'cities'" x-cloak class="{{ $listClass }}">
+                        @forelse ($cityRows as $row)
+                            @php
+                                $hasCoordinates = $row['lat'] !== null && $row['lon'] !== null;
+                                $width = min(100, round(($row['requests'] / $maxCityRequests) * 100, 1));
+                                $flagUrl = countryFlagUrl($row['country']);
+                            @endphp
+                            <div wire:key="geo-city-{{ $globeId }}-{{ md5($row['key']) }}"
+                                @if ($hasCoordinates) @mouseenter="globe()?.focus([{{ (float) $row['lat'] }}, {{ (float) $row['lon'] }}])" @mouseleave="globe()?.resume()" @endif
+                                class="{{ $rowClass }}">
+                                @if ($flagUrl)
+                                    <img src="{{ $flagUrl }}" srcset="{{ countryFlagUrl($row['country'], '48x36') }} 2x" alt=""
+                                        loading="lazy" width="20" height="15"
+                                        class="h-[15px] w-5 shrink-0 rounded-[2px] object-cover ring-1 ring-black/5 dark:ring-white/10"
+                                        onerror="this.style.visibility='hidden'">
+                                @else
+                                    <span class="w-5 shrink-0 text-center text-[14px] leading-none" aria-hidden="true">🌐</span>
+                                @endif
+                                <span class="flex min-w-0 flex-1 items-baseline gap-2" title="{{ $row['label'] }}">
+                                    <span class="truncate text-[12px] text-black dark:text-fg">{{ $row['name'] }}</span>
+                                    @if ($row['detail'] !== '')
+                                        <span class="hidden shrink-0 text-[11px] text-neutral-400 md:inline dark:text-fg-faint">{{ $row['detail'] }}</span>
+                                    @endif
+                                </span>
+                                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
+                                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                                </div>
+                                <span class="w-12 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                                    title="{{ number_format($row['requests']) }} requests">{{ compactNumber($row['requests']) }}</span>
+                                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($row['bytesOut']) }}</span>
+                            </div>
+                        @empty
+                            <x-empty size="sm" title="No city data" description="No city data for the selected range."
+                                icon-name="network" />
+                        @endforelse
+                    </div>
+                </div>
+            </div>
+
+            @if (! empty($attribution))
+                <p class="px-4 py-2 text-[11px] text-neutral-400 dark:text-fg-faint">
+                    {{ $attribution }}
+                </p>
+            @endif
+        @endif
+    </div>
+</x-application.settings-section>
diff --git a/resources/views/livewire/traffic/_hosts-list.blade.php b/resources/views/livewire/traffic/_hosts-list.blade.php
index 710e8fa637..9785bd38eb 100644
--- a/resources/views/livewire/traffic/_hosts-list.blade.php
+++ b/resources/views/livewire/traffic/_hosts-list.blade.php
@@ -1,7 +1,8 @@
 {{--
-    Paginated "top hosts" list — request volume grouped by served hostname (an app's
-    primary domain), with a proportional bar and right-aligned compact metrics.
-    Links each host to its live origin. Expects `$hosts` in scope.
+    Sortable, paginated "top hosts" list — request volume grouped by served hostname
+    (an app's primary domain), with a proportional bar and right-aligned compact
+    metrics. Select a column header to sort by it. Links each host to its live
+    origin. Expects `$hosts` in scope.
 
     @param iterable $hosts      host rows: ['host', 'requests', 'bandwidth']
     @param ?string  $keyPrefix  wire:key prefix (default "analytics-host")
@@ -15,37 +16,42 @@
     <x-empty size="sm" title="No host data" description="No hostnames were recorded for the selected range."
         icon-name="unordered-list" />
 @else
-    <div x-data="{ page: 0, per: 10, total: {{ count($hosts) }} }">
-        <div class="flex items-center gap-3 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:border-white/[0.07] dark:text-fg-dim">
-            <span class="min-w-0 flex-1">Host</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Request volume relative to the busiest row in this list">Volume</span>
-            <span class="w-16 shrink-0 text-right">Requests</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Total response data sent">Bandwidth</span>
+    <div x-data="trafficTable()">
+        <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+            @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Host', 'text' => true, 'class' => 'min-w-0 flex-1'])
+            <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+            @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+            @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
         </div>
-        @foreach ($hosts as $row)
-            @php
-                $host = (string) ($row['host'] ?? '');
-                $known = $host !== '';
-                $requests = (int) ($row['requests'] ?? 0);
-                $width = min(100, round(($requests / $maxRequests) * 100, 1));
-            @endphp
-            <div wire:key="{{ $keyPrefix }}-{{ $loop->index }}"
-                x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                class="flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]">
-                @if ($known)
-                    <a href="https://{{ $host }}" target="_blank" rel="noopener noreferrer nofollow"
-                        class="min-w-0 flex-1 truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $host }}</a>
-                @else
-                    <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim">Unknown host</span>
-                @endif
-                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
-                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+        <div class="flex flex-col">
+            @foreach ($hosts as $row)
+                @php
+                    $host = (string) ($row['host'] ?? '');
+                    $known = $host !== '';
+                    $requests = (int) ($row['requests'] ?? 0);
+                    $bandwidth = (int) ($row['bandwidth'] ?? 0);
+                    $width = min(100, round(($requests / $maxRequests) * 100, 1));
+                @endphp
+                <div wire:key="{{ $keyPrefix }}-{{ md5($host) }}"
+                    data-row="{{ json_encode(['name' => $host, 'requests' => $requests, 'bytesOut' => $bandwidth]) }}" @if (! $known) data-pinned @endif
+                    x-show="shown($el)"
+                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
+                    @if ($known)
+                        <a href="https://{{ $host }}" target="_blank" rel="noopener noreferrer nofollow"
+                            class="min-w-0 flex-1 truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $host }}</a>
+                    @else
+                        <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim">Unknown host</span>
+                    @endif
+                    <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
+                        title="Request volume relative to the busiest row in this list">
+                        <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                    </div>
+                    <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                        title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($bandwidth) }}</span>
                 </div>
-                <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
-                    title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
-                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes((int) ($row['bandwidth'] ?? 0)) }}</span>
-            </div>
-        @endforeach
+            @endforeach
+        </div>
         @include('livewire.traffic._pager')
     </div>
 @endif
diff --git a/resources/views/livewire/traffic/_pager.blade.php b/resources/views/livewire/traffic/_pager.blade.php
index 73aa17cc9b..d0dcf08dd0 100644
--- a/resources/views/livewire/traffic/_pager.blade.php
+++ b/resources/views/livewire/traffic/_pager.blade.php
@@ -1,7 +1,7 @@
 {{--
     Client-side "top 10" pager footer for traffic lists. Expects an enclosing
     Alpine scope that defines reactive `page` (0-based), `per` (page size) and
-    `total` (row count). Rows themselves are toggled with x-show on their index;
+    `total` (row count). Rows themselves are toggled with x-show by their scope;
     this partial only renders the summary + prev/next controls, and hides itself
     when everything fits on one page.
 --}}
diff --git a/resources/views/livewire/traffic/_paths-list.blade.php b/resources/views/livewire/traffic/_paths-list.blade.php
index 2882b0e69b..0287c84996 100644
--- a/resources/views/livewire/traffic/_paths-list.blade.php
+++ b/resources/views/livewire/traffic/_paths-list.blade.php
@@ -1,82 +1,90 @@
 {{--
-    Paginated "top paths" list. Each row shows the request path, a proportional
-    request-volume bar, and right-aligned compact metrics (requests / bytes / p95).
-    The path links to its live URL when the owning domain is known (new tab,
-    rel="noopener noreferrer nofollow"); the domain shows next to the path so the
-    same path of two apps stays apart. Sentinel's `__other__` overflow row reads
-    as "Other paths". Expects `$paths` in scope; optional
-    `$keyPrefix` to namespace wire:keys.
+    Sortable, paginated "top paths" list. Each row shows the request path, a
+    proportional request-volume bar, and right-aligned compact metrics. Select a
+    column header to sort by it. The path links to its live URL when the owning
+    domain is known (new tab, rel="noopener noreferrer nofollow"); the domain shows
+    next to the path so the same path of two apps stays apart. Sentinel's
+    `__other__` overflow row reads as "Other paths" and stays last. Expects
+    `$paths` in scope; optional `$keyPrefix` to namespace wire:keys.
 
-    @param iterable $paths      path rows: ['path', 'domain'?, 'requests', 'bytesOut', 'p95']
+    @param iterable $paths      path rows: ['path', 'domain'?, 'requests', 'bytesOut', 's4xx', 's5xx', 'p95']
     @param ?string  $keyPrefix  wire:key prefix (default "analytics-path")
 --}}
 @php
     $paths = $paths ?? [];
     $keyPrefix = $keyPrefix ?? 'analytics-path';
     $maxRequests = max(1, (int) collect($paths)->max('requests'));
+    $muted = 'text-neutral-300 dark:text-fg-faint';
 @endphp
 @if (collect($paths)->isEmpty())
     <x-empty size="sm" title="No path data" description="No requests were recorded for the selected range."
         icon-name="unordered-list" />
 @else
-    <div x-data="{ page: 0, per: 10, total: {{ count($paths) }} }">
-        <div class="flex items-center gap-3 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:border-white/[0.07] dark:text-fg-dim">
-            <span class="min-w-0 flex-1">Path</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Request volume relative to the busiest row in this list">Volume</span>
-            <span class="w-16 shrink-0 text-right">Requests</span>
-            <span class="hidden w-14 shrink-0 text-right sm:inline" title="HTTP 4xx client-error responses">4xx errors</span>
-            <span class="w-14 shrink-0 text-right" title="HTTP 5xx server-error responses">5xx errors</span>
-            <span class="hidden w-12 shrink-0 text-right lg:inline" title="Percentage of requests with a 4xx or 5xx response">Error %</span>
-            <span class="hidden w-16 shrink-0 text-right sm:inline" title="Total response data sent">Bandwidth</span>
-            <span class="hidden w-16 shrink-0 text-right md:inline" title="95% of requests completed within this response time">p95 latency</span>
+    <div x-data="trafficTable()">
+        <div class="flex items-center gap-3 px-4 py-2 text-[11px] font-medium text-neutral-500 dark:text-fg-dim">
+            @include('livewire.traffic._sort-header', ['column' => 'name', 'label' => 'Path', 'text' => true, 'class' => 'min-w-0 flex-1'])
+            <span class="hidden w-16 shrink-0 sm:inline" aria-hidden="true"></span>
+            @include('livewire.traffic._sort-header', ['column' => 'requests', 'label' => 'Requests', 'class' => 'w-16 shrink-0'])
+            @include('livewire.traffic._sort-header', ['column' => 's4xx', 'label' => '4xx', 'class' => 'hidden w-12 shrink-0 sm:inline-flex', 'title' => 'HTTP 4xx client-error responses'])
+            @include('livewire.traffic._sort-header', ['column' => 's5xx', 'label' => '5xx', 'class' => 'w-12 shrink-0', 'title' => 'HTTP 5xx server-error responses'])
+            @include('livewire.traffic._sort-header', ['column' => 'errorRate', 'label' => 'Error %', 'class' => 'hidden w-14 shrink-0 lg:inline-flex', 'title' => 'Percentage of requests with a 4xx or 5xx response'])
+            @include('livewire.traffic._sort-header', ['column' => 'bytesOut', 'label' => 'Bandwidth', 'class' => 'hidden w-16 shrink-0 sm:inline-flex', 'title' => 'Total response data sent'])
+            @include('livewire.traffic._sort-header', ['column' => 'p95', 'label' => 'p95', 'class' => 'hidden w-16 shrink-0 md:inline-flex', 'title' => '95% of requests completed within this response time'])
         </div>
-        @foreach ($paths as $path)
-            @php
-                $domain = $path['domain'] ?? null;
-                $pathStr = (string) ($path['path'] ?? '');
-                $isOther = $pathStr === '__other__';
-                $href = $domain && ! $isOther ? 'https://'.$domain.$pathStr : null;
-                $requests = (int) ($path['requests'] ?? 0);
-                $s4xx = (int) ($path['s4xx'] ?? 0);
-                $s5xx = (int) ($path['s5xx'] ?? 0);
-                $errorRate = $requests > 0 ? round((($s4xx + $s5xx) / $requests) * 100, 1) : 0;
-                $width = min(100, round(($requests / $maxRequests) * 100, 1));
-            @endphp
-            <div wire:key="{{ $keyPrefix }}-{{ md5($domain."\n".$pathStr) }}"
-                x-show="{{ $loop->index }} >= page * per && {{ $loop->index }} < (page + 1) * per"
-                class="flex min-h-11 items-center gap-3 border-b border-neutral-200 px-4 py-2 last:border-b-0 dark:border-white/[0.07]">
-                @if ($isOther)
-                    <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim"
-                        title="All paths outside the top paths that Sentinel tracks">Other paths</span>
-                @else
-                    <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
-                        @if ($href)
-                            <a href="{{ $href }}" target="_blank" rel="noopener noreferrer nofollow"
-                                class="truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $pathStr }}</a>
-                        @else
-                            <span class="truncate font-mono text-[12px] text-black dark:text-fg">{{ $pathStr }}</span>
-                        @endif
-                        @if ($domain)
-                            <span class="max-w-48 shrink-0 truncate text-[11px] text-neutral-400 dark:text-fg-faint" title="{{ $domain }}">{{ $domain }}</span>
-                        @endif
-                    </span>
-                @endif
-                <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]">
-                    <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+        <div class="flex flex-col">
+            @foreach ($paths as $path)
+                @php
+                    $domain = $path['domain'] ?? null;
+                    $pathStr = (string) ($path['path'] ?? '');
+                    $isOther = $pathStr === '__other__';
+                    $href = $domain && ! $isOther ? 'https://'.$domain.$pathStr : null;
+                    $requests = (int) ($path['requests'] ?? 0);
+                    $s4xx = (int) ($path['s4xx'] ?? 0);
+                    $s5xx = (int) ($path['s5xx'] ?? 0);
+                    $bytesOut = (int) ($path['bytesOut'] ?? 0);
+                    $p95 = (float) ($path['p95'] ?? 0);
+                    $errorRate = $requests > 0 ? round((($s4xx + $s5xx) / $requests) * 100, 1) : 0;
+                    $width = min(100, round(($requests / $maxRequests) * 100, 1));
+                    $sort = ['name' => $pathStr.' '.$domain, 'requests' => $requests, 's4xx' => $s4xx, 's5xx' => $s5xx, 'errorRate' => $errorRate, 'bytesOut' => $bytesOut, 'p95' => $p95];
+                @endphp
+                <div wire:key="{{ $keyPrefix }}-{{ md5($domain."\n".$pathStr) }}"
+                    data-row="{{ json_encode($sort) }}" @if ($isOther) data-pinned @endif
+                    x-show="shown($el)"
+                    class="flex min-h-11 items-center gap-3 border-t border-neutral-200 px-4 py-2 transition-colors hover:bg-neutral-50 dark:border-white/[0.07] dark:hover:bg-white/[0.03]">
+                    @if ($isOther)
+                        <span class="min-w-0 flex-1 truncate text-[12px] text-neutral-500 dark:text-fg-dim"
+                            title="All paths outside the top paths that Sentinel tracks">Other paths</span>
+                    @else
+                        <span class="flex min-w-0 flex-1 items-baseline gap-1.5">
+                            @if ($href)
+                                <a href="{{ $href }}" target="_blank" rel="noopener noreferrer nofollow"
+                                    class="truncate font-mono text-[12px] text-black hover:underline dark:text-fg">{{ $pathStr }}</a>
+                            @else
+                                <span class="truncate font-mono text-[12px] text-black dark:text-fg">{{ $pathStr }}</span>
+                            @endif
+                            @if ($domain)
+                                <span class="max-w-48 shrink-0 truncate text-[11px] text-neutral-400 dark:text-fg-faint" title="{{ $domain }}">{{ $domain }}</span>
+                            @endif
+                        </span>
+                    @endif
+                    <div class="hidden h-1 w-16 shrink-0 overflow-hidden rounded-full bg-neutral-100 sm:block dark:bg-white/[0.06]"
+                        title="Request volume relative to the busiest row in this list">
+                        <div class="h-full rounded-full bg-[var(--chart-status-3xx)]" style="width: {{ $width }}%;"></div>
+                    </div>
+                    <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
+                        title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
+                    <span @class(['hidden w-12 shrink-0 text-right text-[12px] tabular-nums sm:inline', $s4xx > 0 ? 'font-medium text-pink-600 dark:text-pink-400' : $muted])
+                        title="{{ number_format($s4xx) }} client-error responses">{{ compactNumber($s4xx) }}</span>
+                    <span @class(['w-12 shrink-0 text-right text-[12px] tabular-nums', $s5xx > 0 ? 'font-medium text-purple-600 dark:text-purple-400' : $muted])
+                        title="{{ number_format($s5xx) }} server-error responses">{{ compactNumber($s5xx) }}</span>
+                    <span @class(['hidden w-14 shrink-0 text-right text-[11px] tabular-nums lg:inline', $errorRate > 0 ? 'text-neutral-500 dark:text-fg-dim' : $muted])
+                        title="Combined 4xx and 5xx response rate">{{ $errorRate }}%</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes($bytesOut) }}</span>
+                    <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 md:inline dark:text-fg-faint"
+                        title="p95 latency">{{ number_format($p95, 1) }} ms</span>
                 </div>
-                <span class="w-16 shrink-0 text-right text-[12px] font-medium tabular-nums text-black dark:text-fg"
-                    title="{{ number_format($requests) }} requests">{{ compactNumber($requests) }}</span>
-                <span class="hidden w-14 shrink-0 text-right text-[11px] font-medium tabular-nums text-pink-600 sm:inline dark:text-pink-400"
-                    title="{{ number_format($s4xx) }} client-error responses">{{ compactNumber($s4xx) }} 4xx</span>
-                <span class="w-14 shrink-0 text-right text-[11px] font-medium tabular-nums text-purple-600 dark:text-purple-400"
-                    title="{{ number_format($s5xx) }} server-error responses">{{ compactNumber($s5xx) }} 5xx</span>
-                <span class="hidden w-12 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 lg:inline dark:text-fg-faint"
-                    title="Combined 4xx and 5xx response rate">{{ $errorRate }}%</span>
-                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 sm:inline dark:text-fg-faint">{{ formatBytes((int) ($path['bytesOut'] ?? 0)) }}</span>
-                <span class="hidden w-16 shrink-0 text-right text-[11px] tabular-nums text-neutral-400 md:inline dark:text-fg-faint"
-                    title="p95 latency">{{ number_format((float) ($path['p95'] ?? 0), 1) }} ms</span>
-            </div>
-        @endforeach
+            @endforeach
+        </div>
         @include('livewire.traffic._pager')
     </div>
 @endif
diff --git a/resources/views/livewire/traffic/_sort-header.blade.php b/resources/views/livewire/traffic/_sort-header.blade.php
new file mode 100644
index 0000000000..82602ee4cf
--- /dev/null
+++ b/resources/views/livewire/traffic/_sort-header.blade.php
@@ -0,0 +1,31 @@
+{{--
+    One sortable column header for a traffic list. Expects an enclosing Alpine
+    scope from `trafficTable()` (resources/js/traffic-table.js).
+
+    @param string  $column  key in the rows' `data-row` JSON
+    @param string  $label   header text
+    @param ?string $class   width and responsive classes of the column; a column that
+                            hides on small screens passes `hidden <breakpoint>:inline-flex`
+    @param ?string $title   tooltip
+    @param ?bool   $text    true for a text column: left-aligned, first sort ascending
+    @param ?string $dir     first sort direction, when it differs from the default of the alignment
+--}}
+@php
+    $text = $text ?? false;
+    $firstDir = $dir ?? ($text ? 'asc' : 'desc');
+    $class = $class ?? '';
+    // `hidden` and `inline-flex` on one element conflict, so add the display only when the caller sets none.
+    $display = str_contains($class, 'hidden') ? '' : 'inline-flex';
+@endphp
+<button type="button" @click="sortBy('{{ $column }}', '{{ $firstDir }}')"
+    title="{{ $title ?? 'Sort by '.strtolower($label) }}"
+    :aria-label="'Sort by {{ strtolower($label) }}' + (sorted('{{ $column }}') ? ', sorted ' + (sorted('{{ $column }}') === 'asc' ? 'ascending' : 'descending') : '')"
+    class="group {{ $display }} items-center gap-1 whitespace-nowrap rounded-sm transition-colors hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:hover:text-fg {{ $text ? 'justify-start text-left' : 'flex-row-reverse justify-start text-right' }} {{ $class }}"
+    :class="sorted('{{ $column }}') ? 'text-black dark:text-fg' : ''">
+    <span>{{ $label }}</span>
+    <svg class="size-3 shrink-0 transition-[opacity,transform]" viewBox="0 0 24 24" fill="none" stroke="currentColor"
+        stroke-width="2.5" aria-hidden="true"
+        :class="[sorted('{{ $column }}') ? 'opacity-100' : 'opacity-0 group-hover:opacity-50', sorted('{{ $column }}') === 'asc' ? 'rotate-180' : '']">
+        <path stroke-linecap="round" stroke-linejoin="round" d="M6 9l6 6 6-6" />
+    </svg>
+</button>
diff --git a/resources/views/source/all.blade.php b/resources/views/source/all.blade.php
index fc93d4a72c..2a3ebe330b 100644
--- a/resources/views/source/all.blade.php
+++ b/resources/views/source/all.blade.php
@@ -71,7 +71,7 @@
                 matches(values) { const query = this.search.trim().toLowerCase(); return !query || values.some(value => String(value || '').toLowerCase().includes(query)); },
                 setViewMode(mode) { this.viewMode = mode; localStorage.setItem('coolify-sources-view', mode); }
             }">
-            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search sources', 'singular' => 'source', 'plural' => 'sources'])
+            @include('livewire.shared.list-search-controls', ['placeholder' => 'Search sources'])
             <div x-cloak x-show="viewMode === 'grid'" class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
                 @foreach ($sources as $source)
                     @if ($source->getMorphClass() === 'App\Models\GithubApp')
diff --git a/routes/api.php b/routes/api.php
index d372dd144f..f985b94332 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -203,9 +203,9 @@ Route::group([
     Route::post('/servers/{uuid}/proxy/restart', [ServerProxyController::class, 'restart'])->middleware(['api.ability:write']);
 
     Route::post('/servers', [ServersController::class, 'create_server'])->middleware(['api.ability:write']);
+    Route::get('/servers/import/check', [ServerTransferController::class, 'check'])->middleware(['api.ability:write']);
     Route::post('/servers/import', [ServerTransferController::class, 'import'])->middleware(['api.ability:write']);
-    Route::get('/servers/{uuid}/export', [ServerTransferController::class, 'export'])->middleware(['api.ability:read']);
-    Route::post('/servers/{uuid}/export/mailbox', [ServerTransferController::class, 'writeMailbox'])->middleware(['api.ability:write']);
+    Route::get('/servers/{uuid}/transfer', [ServerTransferController::class, 'status'])->middleware(['api.ability:read,write']);
     Route::post('/servers/{uuid}/transfer/complete', [ServerTransferController::class, 'complete'])->middleware(['api.ability:write']);
     Route::post('/servers/{uuid}/migrate', [ServerTransferController::class, 'migrate'])->middleware(['api.ability:write']);
     Route::patch('/servers/{uuid}', [ServersController::class, 'update_server'])->middleware(['api.ability:write']);
diff --git a/routes/web.php b/routes/web.php
index 3cd0ca41bd..2efe33c643 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -15,6 +15,7 @@ use App\Http\Controllers\Api\ServicesController;
 use App\Http\Controllers\Api\SharedVariableCanvasController;
 use App\Http\Controllers\Api\TagCanvasController;
 use App\Http\Controllers\Controller;
+use App\Http\Controllers\FileBrowserDownloadController;
 use App\Http\Controllers\OauthController;
 use App\Http\Controllers\ProfileAvatarController;
 use App\Http\Controllers\ProjectIconController;
@@ -25,6 +26,7 @@ use App\Livewire\Admin\Index as AdminIndex;
 use App\Livewire\Analytics;
 use App\Livewire\Boarding\Index as BoardingIndex;
 use App\Livewire\Dashboard;
+use App\Livewire\Dashboard\Canvas as DashboardCanvas;
 use App\Livewire\DeployCanvas;
 use App\Livewire\Destination\Index as DestinationIndex;
 use App\Livewire\Destination\Resources as DestinationResources;
@@ -64,6 +66,7 @@ use App\Livewire\Project\Service\Index as ServiceIndex;
 use App\Livewire\Project\Service\VolumeBackup\Index;
 use App\Livewire\Project\Service\VolumeBackup\Show;
 use App\Livewire\Project\Shared\ExecuteContainerCommand;
+use App\Livewire\Project\Shared\FileBrowser;
 use App\Livewire\Project\Shared\Logs;
 use App\Livewire\Project\Show as ProjectShow;
 use App\Livewire\Security\ApiTokens;
@@ -105,7 +108,6 @@ use App\Livewire\Server\Sentinel\Show as SentinelShow;
 use App\Livewire\Server\Show as ServerShow;
 use App\Livewire\Server\Swarm as ServerSwarm;
 use App\Livewire\Server\Transfer as ServerTransfer;
-use App\Livewire\Server\TransferImport as ServerTransferImport;
 use App\Livewire\Settings\Advanced as SettingsAdvanced;
 use App\Livewire\Settings\Index as SettingsIndex;
 use App\Livewire\Settings\Updates as SettingsUpdates;
@@ -190,6 +192,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
     });
 
     Route::get('/', Dashboard::class)->name('dashboard');
+    Route::get('/dashboard/canvas', DashboardCanvas::class)->name('dashboard.canvas');
     Route::get('/analytics', Analytics::class)->name('analytics');
     Route::get('/metrics', FleetMetrics::class)->name('metrics');
     Route::get('/canvas', DeployCanvas::class)->name('deploy-canvas');
@@ -218,8 +221,10 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::delete('/shared-variables/{scope}/{uuid}/canvas/links/{link_id}', [SharedVariableCanvasController::class, 'destroyLink'])->whereIn('scope', ['project', 'environment', 'server'])->middleware(['api.ability:write']);
         Route::get('/servers', [ServersController::class, 'servers'])->middleware(['api.ability:read']);
         Route::get('/servers/canvas', [ServerCanvasController::class, 'index'])->middleware(['api.ability:read']);
+        Route::get('/dashboard/canvas', [ServerCanvasController::class, 'dashboard'])->middleware(['api.ability:read']);
         Route::get('/servers/{uuid}/canvas', [ServerCanvasController::class, 'show'])->middleware(['api.ability:read']);
         Route::get('/servers/{uuid}/canvas/containers', [ServerCanvasController::class, 'containers'])->middleware(['api.ability:read']);
+        Route::get('/servers/{uuid}/canvas/usage', [ServerCanvasController::class, 'usage'])->middleware(['api.ability:read']);
         Route::get('/servers/{server_uuid}/destinations', [DestinationsController::class, 'index_by_server'])->middleware(['api.ability:read']);
         Route::get('/github-apps', [GithubController::class, 'list_github_apps'])->middleware(['api.ability:read']);
         Route::get('/github-apps/{github_app_id}/repositories', [GithubController::class, 'load_repositories'])->middleware(['api.ability:read']);
@@ -363,6 +368,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::get('/projects', ProjectIndex::class)->name('project.index');
     Route::get('/projects/canvas', ProjectsCanvas::class)->name('project.canvas.index');
     Route::get('/project/{project_uuid}/icon', ProjectIconController::class)->name('project.icon');
+    Route::get('/files/download/{token}', FileBrowserDownloadController::class)->name('project.files.download')->middleware('can.access.terminal');
     Route::prefix('project/{project_uuid}')->group(function () {
         Route::get('/', ProjectShow::class)->name('project.show');
         Route::get('/canvas', ProjectCanvas::class)->name('project.canvas');
@@ -384,8 +390,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/persistent-storage', ApplicationConfiguration::class)->name('project.application.persistent-storage');
         Route::get('/backups', ApplicationBackupIndex::class)->name('project.application.backup.index');
         Route::get('/backups/{backup_uuid}', ApplicationBackupShow::class)->name('project.application.backup.show');
-        Route::get('/backups/{backup_uuid}/s3', ApplicationBackupShow::class)->name('project.application.backup.s3');
-        Route::get('/backups/{backup_uuid}/retention', ApplicationBackupShow::class)->name('project.application.backup.retention');
+        // S3 and retention settings moved into the general page; keep old links working.
+        Route::redirect('/backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/application/{application_uuid}/backups/{backup_uuid}');
+        Route::redirect('/backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/application/{application_uuid}/backups/{backup_uuid}');
         Route::get('/backups/{backup_uuid}/executions', ApplicationBackupShow::class)->name('project.application.backup.executions');
         Route::get('/backups/{backup_uuid}/danger', ApplicationBackupShow::class)->name('project.application.backup.danger');
         Route::get('/source', ApplicationConfiguration::class)->name('project.application.source');
@@ -406,7 +413,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/deployment/{deployment_uuid}', DeploymentShow::class)->name('project.application.deployment.show');
         Route::get('/logs', Logs::class)->name('project.application.logs');
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.application.command')->middleware('can.access.terminal');
-        Route::get('/tasks/{task_uuid}', ApplicationConfiguration::class)->name('project.application.scheduled-tasks');
+        Route::get('/files', FileBrowser::class)->name('project.application.files')->middleware('can.access.terminal');
+        // Tasks open in a modal on the list page; keep old links (e.g. notifications) working.
+        Route::get('/tasks/{task_uuid}', fn () => redirect()->route('project.application.scheduled-tasks.show', get_route_parameters()))->name('project.application.scheduled-tasks');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}')->group(function () {
         Route::get('/', DatabaseConfiguration::class)->name('project.database.configuration');
@@ -424,10 +433,12 @@ Route::middleware(['auth', 'verified'])->group(function () {
 
         Route::get('/logs', Logs::class)->name('project.database.logs');
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.database.command')->middleware('can.access.terminal');
+        Route::get('/files', FileBrowser::class)->name('project.database.files')->middleware('can.access.terminal');
         Route::get('/backups', DatabaseBackupIndex::class)->name('project.database.backup.index');
         Route::get('/backups/{backup_uuid}', DatabaseBackupExecution::class)->name('project.database.backup.execution');
-        Route::get('/backups/{backup_uuid}/s3', DatabaseBackupExecution::class)->name('project.database.backup.s3');
-        Route::get('/backups/{backup_uuid}/retention', DatabaseBackupExecution::class)->name('project.database.backup.retention');
+        // S3 and retention settings moved into the general page; keep old links working.
+        Route::redirect('/backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}/backups/{backup_uuid}');
+        Route::redirect('/backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}/backups/{backup_uuid}');
         Route::get('/backups/{backup_uuid}/executions', DatabaseBackupExecution::class)->name('project.database.backup.executions');
         Route::get('/backups/{backup_uuid}/danger', DatabaseBackupExecution::class)->name('project.database.backup.danger');
     });
@@ -442,8 +453,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/import-backup/{stack_service_uuid}', ServiceImportBackup::class)->name('project.service.import-backup.database')->middleware('can.update.resource');
         Route::get('/storage-backups', Index::class)->name('project.service.volume-backups.index');
         Route::get('/storage-backups/{backup_uuid}', Show::class)->name('project.service.volume-backups.show');
-        Route::get('/storage-backups/{backup_uuid}/s3', Show::class)->name('project.service.volume-backups.s3');
-        Route::get('/storage-backups/{backup_uuid}/retention', Show::class)->name('project.service.volume-backups.retention');
+        // S3 and retention settings moved into the general page; keep old links working.
+        Route::redirect('/storage-backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/storage-backups/{backup_uuid}');
+        Route::redirect('/storage-backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/storage-backups/{backup_uuid}');
         Route::get('/storage-backups/{backup_uuid}/executions', Show::class)->name('project.service.volume-backups.executions');
         Route::get('/storage-backups/{backup_uuid}/danger', Show::class)->name('project.service.volume-backups.danger');
         Route::get('/scheduled-tasks', ServiceConfiguration::class)->name('project.service.scheduled-tasks.show');
@@ -452,22 +464,23 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/tags', ServiceConfiguration::class)->name('project.service.tags');
         Route::get('/danger', ServiceConfiguration::class)->name('project.service.danger');
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.service.command')->middleware('can.access.terminal');
+        Route::get('/files', FileBrowser::class)->name('project.service.files')->middleware('can.access.terminal');
         Route::get('/{stack_service_uuid}/backups', ServiceDatabaseBackups::class)->name('project.service.database.backups');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}', ServiceDatabaseBackups::class)->name('project.service.database.backup.show');
-        Route::get('/{stack_service_uuid}/backups/{backup_uuid}/s3', ServiceDatabaseBackups::class)->name('project.service.database.backup.s3');
-        Route::get('/{stack_service_uuid}/backups/{backup_uuid}/retention', ServiceDatabaseBackups::class)->name('project.service.database.backup.retention');
+        Route::redirect('/{stack_service_uuid}/backups/{backup_uuid}/s3', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/{stack_service_uuid}/backups/{backup_uuid}');
+        Route::redirect('/{stack_service_uuid}/backups/{backup_uuid}/retention', '/project/{project_uuid}/environment/{environment_uuid}/service/{service_uuid}/{stack_service_uuid}/backups/{backup_uuid}');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/executions', ServiceDatabaseBackups::class)->name('project.service.database.backup.executions');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/danger', ServiceDatabaseBackups::class)->name('project.service.database.backup.danger');
         Route::get('/{stack_service_uuid}/import', ServiceImportBackup::class)->name('project.service.database.import')->middleware('can.update.resource');
         Route::get('/{stack_service_uuid}/advanced', ServiceIndex::class)->name('project.service.index.advanced');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
-        Route::get('/tasks/{task_uuid}', ServiceConfiguration::class)->name('project.service.scheduled-tasks');
+        // Tasks open in a modal on the list page; keep old links (e.g. notifications) working.
+        Route::get('/tasks/{task_uuid}', fn () => redirect()->route('project.service.scheduled-tasks.show', get_route_parameters()))->name('project.service.scheduled-tasks');
     });
 
     Route::get('/servers', ServerIndex::class)->name('server.index');
     Route::get('/servers/canvas', ServerCanvas::class)->name('server.canvas.index');
     Route::get('/registries', ServerDockerRegistries::class)->name('registries.index');
-    Route::get('/servers/import', ServerTransferImport::class)->name('server.transfer.import')->middleware('can:create,'.Server::class);
     Route::get('/servers/new', ServerCreatePage::class)->name('server.create')->middleware('can:create,'.Server::class);
     Route::get('/servers/new/{type}/{token_uuid}', ServerCreatePage::class)->name('server.create.token')->middleware('can:create,'.Server::class)->whereIn('type', ['hetzner', 'vultr', 'digital-ocean', 'hostinger']);
     Route::get('/servers/new/{type}', ServerCreatePage::class)->name('server.create.type')->middleware('can:create,'.Server::class)->whereIn('type', ['hetzner', 'vultr', 'digital-ocean', 'hostinger', 'manual']);
@@ -564,15 +577,29 @@ Route::middleware(['auth'])->group(function () {
                 }
             }
             $filename = data_get($execution, 'filename');
-            if ($execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class) {
-                $server = $execution->scheduledDatabaseBackup->database->service->destination->server;
-            } else {
-                $server = $execution->scheduledDatabaseBackup->database->destination->server;
+            if (! $execution->local_storage_deleted && filled($filename)) {
+                if ($execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class) {
+                    $server = $execution->scheduledDatabaseBackup->database->service->destination->server;
+                } else {
+                    $server = $execution->scheduledDatabaseBackup->database->destination->server;
+                }
+
+                try {
+                    return streamBackupFromServer($server, $filename, 'application/octet-stream');
+                } catch (FileNotFoundException) {
+                    // Fall back to an S3 copy.
+                }
             }
 
-            return streamBackupFromServer($server, $filename, 'application/octet-stream');
-        } catch (FileNotFoundException) {
-            if (isset($execution) && $execution->scheduledDatabaseBackup->disable_local_backup === true && $execution->scheduledDatabaseBackup->save_s3 === true) {
+            // Only storages of the team that owns the database can serve the copy.
+            $s3DownloadUrl = is_null($execution_team_id)
+                ? null
+                : $execution->s3DownloadUrl($execution_team_id, $execution->scheduledDatabaseBackup->s3_storage_id);
+            if ($s3DownloadUrl) {
+                return redirect()->away($s3DownloadUrl);
+            }
+
+            if ($execution->scheduledDatabaseBackup->disable_local_backup && $execution->scheduledDatabaseBackup->save_s3) {
                 return response()->json(['message' => 'Backup not available locally, but available on S3.'], 404);
             }
 
@@ -599,17 +626,29 @@ Route::middleware(['auth'])->group(function () {
             if ($team->id !== 0 && $team->id !== $execution->scheduledVolumeBackup->team_id) {
                 return response()->json(['message' => 'Permission denied.'], 403);
             }
-            if ($execution->local_storage_deleted || blank($execution->filename)) {
+            if (blank($execution->filename)) {
                 return response()->json(['message' => 'Backup not found locally on the server.'], 404);
             }
 
-            $server = $execution->scheduledVolumeBackup->server();
-            if (! $server) {
+            $server = $execution->local_storage_deleted ? null : $execution->scheduledVolumeBackup->server();
+            if ($server) {
+                try {
+                    return streamBackupFromServer($server, $execution->filename, 'application/gzip');
+                } catch (FileNotFoundException) {
+                    // Fall back to an S3 copy.
+                }
+            }
+
+            // Only storages of the team that owns the backup can serve the copy.
+            $s3DownloadUrl = $execution->s3DownloadUrl($execution->scheduledVolumeBackup->team_id, $execution->s3_storage_id);
+            if ($s3DownloadUrl) {
+                return redirect()->away($s3DownloadUrl);
+            }
+
+            if (! $execution->local_storage_deleted && ! $server) {
                 return response()->json(['message' => 'Server not found.'], 404);
             }
 
-            return streamBackupFromServer($server, $execution->filename, 'application/gzip');
-        } catch (FileNotFoundException) {
             return response()->json(['message' => 'Backup not found locally on the server.'], 404);
         } catch (Throwable) {
             return response()->json(['message' => 'Failed to download backup.'], 500);
diff --git a/scripts/dev b/scripts/dev
index 0da92917a2..3102f0b9d7 100755
--- a/scripts/dev
+++ b/scripts/dev
@@ -24,12 +24,17 @@
 #
 # Env: COOLIFY_DEV_SERVER_BACKEND=auto|lima|testing-host, COOLIFY_DEV_KVM_PROFILE=<profile>
 #
+# Side by side: COOLIFY_DEV_INSTANCE=<name> COOLIFY_DEV_SIDE_BY_SIDE=1 starts a second instance of
+# this checkout without stopping the other ones (for example a transfer target, see
+# scripts/transfer-test). It gets its own SSH key folder; the instance remembers the mode.
+#
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
 ROOT="$(pwd -P)"
 
 COMPOSE_FILE="docker-compose.dev-multi.yml"
+SIDE_BY_SIDE_COMPOSE_FILE="docker-compose.dev-side-by-side.yml"
 GIT_COMMON_DIR="$(git rev-parse --path-format=absolute --git-common-dir)"
 # Shared by all worktrees, so slots, APP_KEYs, and data survive worktree removal.
 ENV_DIR="$(dirname "$GIT_COMMON_DIR")/.dev-instances"
@@ -38,7 +43,7 @@ QEMU_STORAGE="${DEVELOPMENT_QEMU_STORAGE_PATH:-/var/lib/libvirt/images/coolify-d
 LEGACY_CONTAINERS=(coolify coolify-db coolify-redis coolify-vite coolify-mail coolify-minio coolify-minio-init coolify-testing-host)
 
 usage() {
-  sed -n '2,26p' "$0" | sed 's/^# \?//'
+  sed -n '2,30p' "$0" | sed 's/^# \?//'
 }
 
 normalize_name() {
@@ -66,6 +71,7 @@ current_instance() {
 project_name() { echo "coolify-dev-$1"; }
 env_file() { echo "$ENV_DIR/$1.env"; }
 env_value() { grep -E "^$2=" "$(env_file "$1")" | cut -d= -f2-; }
+is_side_by_side() { [[ -f "$(env_file "$1")" ]] && grep -qxF 'DEV_SIDE_BY_SIDE=1' "$(env_file "$1")"; }
 
 # Lowest free slot (1..254), stable per instance name. It selects the port block
 # and the libvirt network (10.221.<slot>.0/24) of the instance.
@@ -135,6 +141,11 @@ ensure_env() {
   fi
   printf '%s\n' "$existing_key" >"$ENV_DIR/$name.appkey"
 
+  local side_by_side="${COOLIFY_DEV_SIDE_BY_SIDE:-}"
+  if [[ -z "$side_by_side" ]] && is_side_by_side "$name"; then
+    side_by_side=1
+  fi
+
   cat >"$env_file" <<EOF
 # Generated by scripts/dev for instance ${name} — do not commit
 COMPOSE_PROJECT_NAME=$(project_name "$name")
@@ -158,6 +169,9 @@ PUSHER_APP_ID=coolify-${name}
 PUSHER_APP_KEY=coolify-${name}
 PUSHER_APP_SECRET=coolify-${name}
 EOF
+  if [[ "$side_by_side" == 1 ]]; then
+    echo 'DEV_SIDE_BY_SIDE=1' >>"$env_file"
+  fi
 }
 
 # compose <name> <args...>: .env of the checkout first, generated instance env wins.
@@ -168,7 +182,11 @@ compose() {
   if [[ -f .env ]]; then
     env_files+=(--env-file .env)
   fi
-  docker compose -p "$(project_name "$name")" -f "$COMPOSE_FILE" \
+  local -a compose_files=(-f "$COMPOSE_FILE")
+  if is_side_by_side "$name"; then
+    compose_files+=(-f "$SIDE_BY_SIDE_COMPOSE_FILE")
+  fi
+  docker compose -p "$(project_name "$name")" "${compose_files[@]}" \
     "${env_files[@]}" --env-file "$(env_file "$name")" "${profiles[@]}" "$@"
 }
 
@@ -221,12 +239,14 @@ wait_for_coolify() {
 
 # Only one instance of a checkout runs at a time: they share its ports (main checkout)
 # and its public/hot Vite file. The legacy fixed-name stack also holds the main ports.
+# Side-by-side instances have their own ports and run next to the others on purpose.
 stop_other_checkout_instances() {
   local file other
+  is_side_by_side "$instance" && return 0
   for file in "$ENV_DIR"/*.env; do
     [[ -f "$file" ]] || continue
     other="$(basename "$file" .env)"
-    if [[ "$other" != "$instance" ]] && grep -qxF "DEV_CHECKOUT=$ROOT" "$file" &&
+    if [[ "$other" != "$instance" ]] && ! is_side_by_side "$other" && grep -qxF "DEV_CHECKOUT=$ROOT" "$file" &&
       [[ -n "$(docker ps -q --filter "label=com.docker.compose.project=$(project_name "$other")")" ]]; then
       echo "Stopping instance ${other} (same checkout)"
       docker compose -p "$(project_name "$other")" stop
diff --git a/scripts/install.sh b/scripts/install.sh
index b40db37408..0c8c2ae6a8 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -7,7 +7,7 @@
 ## ROOT_USER_PASSWORD - Predefined root user password
 ## DOCKER_ADDRESS_POOL_BASE - Custom Docker address pool base (default: 10.0.0.0/8)
 ## DOCKER_ADDRESS_POOL_SIZE - Custom Docker address pool size (default: 24)
-## DOCKER_POOL_FORCE_OVERRIDE - Force override Docker address pool configuration (default: false)
+## DOCKER_POOL_FORCE_OVERRIDE - Force override Docker address pool configuration, also when Docker must restart with running containers (default: false)
 ## AUTOUPDATE - Set to "false" to disable auto-updates
 ## REGISTRY_URL - Custom registry URL for Docker images (default: docker.io)
 
@@ -31,14 +31,21 @@ fi
 
 # Resource directories hold data whose owner and mode the resource images or a non-root SSH user need.
 # Set their owner and mode only when they are created, never on an upgrade (#11945).
-for COOLIFY_DIRECTORY in /data/coolify /data/coolify/{applications,databases,backups,services,proxy,proxy/dynamic,sentinel}; do
-    if [ ! -d "$COOLIFY_DIRECTORY" ]; then
-        mkdir -p "$COOLIFY_DIRECTORY"
-        chown 9999:root "$COOLIFY_DIRECTORY"
-        chmod 700 "$COOLIFY_DIRECTORY"
+create_data_directory() {
+    if [ ! -d "$1" ]; then
+        mkdir -p "$1"
+        chown 9999:root "$1"
+        chmod 700 "$1"
     fi
-done
-mkdir -p /data/coolify/source /data/coolify/images /data/coolify/ssh/{keys,mux}
+}
+
+# Run only after the checks and downloads succeed, so a failed run does not change the data directories (#11973).
+create_coolify_directories() {
+    for COOLIFY_DIRECTORY in /data/coolify/{applications,databases,backups,services,proxy,proxy/dynamic,sentinel}; do
+        create_data_directory "$COOLIFY_DIRECTORY"
+    done
+    mkdir -p /data/coolify/images /data/coolify/ssh/{keys,mux}
+}
 
 # Coolify's own directories, used by the coolify container (UID 9999)
 set_coolify_directory_permissions() {
@@ -46,7 +53,9 @@ set_coolify_directory_permissions() {
     chmod -R 700 /data/coolify/{source,ssh,images}
 }
 
-set_coolify_directory_permissions
+# The installation log and the downloaded files go to /data/coolify/source, so only it is created before the checks.
+create_data_directory /data/coolify
+mkdir -p /data/coolify/source
 
 INSTALLATION_LOG_WITH_DATE="/data/coolify/source/installation-${DATE}.log"
 
@@ -828,131 +837,39 @@ step_done "${DOCKER_SERVER_VERSION:+v$DOCKER_SERVER_VERSION}"
 
 step_start "Configuring Docker daemon" "log rotation · address pools"
 
-echo " - Network pool configuration: ${DOCKER_ADDRESS_POOL_BASE}/${DOCKER_ADDRESS_POOL_SIZE}"
-echo " - To override existing configuration: DOCKER_POOL_FORCE_OVERRIDE=true"
-
-mkdir -p /etc/docker
-
-# Backup original daemon.json if it exists
-if [ -f /etc/docker/daemon.json ]; then
-    cp /etc/docker/daemon.json /etc/docker/daemon.json.original-"$DATE"
-fi
-
-# Create coolify configuration with or without address pools based on whether they were explicitly provided
+# Changing daemon.json needs a Docker restart, which stops every running container.
+# Coolify sets log rotation and the network pool only when no pool is configured or DOCKER_POOL_FORCE_OVERRIDE=true,
+# keeps all other keys, and does not restart a Docker daemon with running containers unless DOCKER_POOL_FORCE_OVERRIDE=true.
 if [ "$DOCKER_POOL_FORCE_OVERRIDE" = true ] || [ "$EXISTING_POOL_CONFIGURED" = false ]; then
-    # First check if the configuration would actually change anything
-    if [ -f /etc/docker/daemon.json ]; then
-        CURRENT_POOL_BASE=$(jq -r '.["default-address-pools"][0].base' /etc/docker/daemon.json 2>/dev/null)
-        CURRENT_POOL_SIZE=$(jq -r '.["default-address-pools"][0].size' /etc/docker/daemon.json 2>/dev/null)
-
-        if [ "$CURRENT_POOL_BASE" = "$DOCKER_ADDRESS_POOL_BASE" ] && [ "$CURRENT_POOL_SIZE" = "$DOCKER_ADDRESS_POOL_SIZE" ]; then
-            echo " - Network pool configuration unchanged, skipping update"
-            NEED_MERGE=false
+    mkdir -p /etc/docker
+    CURRENT_DAEMON_CONFIG='{}'
+    if [ -s /etc/docker/daemon.json ] && ! CURRENT_DAEMON_CONFIG=$(jq -S . /etc/docker/daemon.json 2>/dev/null); then
+        CURRENT_DAEMON_CONFIG=""
+    fi
+    if [ -z "$CURRENT_DAEMON_CONFIG" ]; then
+        warn "Docker daemon configuration not changed: /etc/docker/daemon.json is not valid JSON."
+    else
+        NEW_DAEMON_CONFIG=$(jq -S --arg base "$DOCKER_ADDRESS_POOL_BASE" --argjson size "$DOCKER_ADDRESS_POOL_SIZE" \
+            '. * {"log-driver": "json-file", "log-opts": {"max-size": "10m", "max-file": "3"}, "default-address-pools": [{"base": $base, "size": $size}]}' <<<"$CURRENT_DAEMON_CONFIG")
+        RUNNING_CONTAINERS=$({ docker ps -q 2>/dev/null || true; } | wc -l)
+        if [ "$NEW_DAEMON_CONFIG" = "$CURRENT_DAEMON_CONFIG" ]; then
+            echo " - Configuration is up to date"
+        elif [ "$RUNNING_CONTAINERS" -gt 0 ] && [ "$DOCKER_POOL_FORCE_OVERRIDE" != true ]; then
+            warn "Docker daemon configuration not changed: log rotation and the ${DOCKER_ADDRESS_POOL_BASE} (size ${DOCKER_ADDRESS_POOL_SIZE}) network pool need a Docker restart, which stops ${RUNNING_CONTAINERS} running container(s) and can change the docker0 bridge IP. To apply it, run the installer again with DOCKER_POOL_FORCE_OVERRIDE=true."
+            UI_STEP_DETAIL="skipped · containers running"
         else
-            # If force override is enabled or no existing configuration exists,
-            # create a new configuration with the specified address pools
-            echo " - Creating new Docker configuration with network pool: ${DOCKER_ADDRESS_POOL_BASE}/${DOCKER_ADDRESS_POOL_SIZE}"
-            cat >/etc/docker/daemon.json <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  },
-  "default-address-pools": [
-    {"base":"${DOCKER_ADDRESS_POOL_BASE}","size":${DOCKER_ADDRESS_POOL_SIZE}}
-  ]
-}
-EOL
-            NEED_MERGE=true
-        fi
-    else
-        # No existing configuration, create new one
-        echo " - Creating new Docker configuration with network pool: ${DOCKER_ADDRESS_POOL_BASE}/${DOCKER_ADDRESS_POOL_SIZE}"
-        cat >/etc/docker/daemon.json <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  },
-  "default-address-pools": [
-    {"base":"${DOCKER_ADDRESS_POOL_BASE}","size":${DOCKER_ADDRESS_POOL_SIZE}}
-  ]
-}
-EOL
-        NEED_MERGE=true
-    fi
-else
-    # Check if we need to update log settings
-    if [ -f /etc/docker/daemon.json ] && jq -e '.["log-driver"] == "json-file" and .["log-opts"]["max-size"] == "10m" and .["log-opts"]["max-file"] == "3"' /etc/docker/daemon.json >/dev/null 2>&1; then
-        echo " - Log configuration is up to date"
-        NEED_MERGE=false
-    else
-        # Create a configuration without address pools to preserve existing ones
-        cat >/etc/docker/daemon.json.coolify <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  }
-}
-EOL
-        NEED_MERGE=true
-    fi
-fi
-
-# Remove the duplicate daemon.json creation since we handle it above
-if ! [ -f /etc/docker/daemon.json ]; then
-    # If no daemon.json exists, create it with default settings
-    cat >/etc/docker/daemon.json <<EOL
-{
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "10m",
-    "max-file": "3"
-  },
-  "default-address-pools": [
-    {"base":"${DOCKER_ADDRESS_POOL_BASE}","size":${DOCKER_ADDRESS_POOL_SIZE}}
-  ]
-}
-EOL
-    NEED_MERGE=false
-fi
-
-if [ -s /etc/docker/daemon.json.original-"$DATE" ]; then
-    DIFF=$(diff <(jq --sort-keys . /etc/docker/daemon.json) <(jq --sort-keys . /etc/docker/daemon.json.original-"$DATE") || true)
-    if [ "$DIFF" != "" ]; then
-        echo " - Checking configuration changes..."
-
-        # Check if address pools were changed
-        if echo "$DIFF" | grep -q "default-address-pools"; then
-            if [ "$DOCKER_POOL_BASE_PROVIDED" = true ] || [ "$DOCKER_POOL_SIZE_PROVIDED" = true ]; then
-                echo " - Network pool updated per user request"
-            else
-                echo " - Warning: Network pool modified without explicit request"
+            if [ -f /etc/docker/daemon.json ]; then
+                cp /etc/docker/daemon.json /etc/docker/daemon.json.original-"$DATE"
             fi
-        fi
-
-        # Remove this redundant restart since we already restarted when writing the config
-        echo " - Configuration changes confirmed"
-        if [ "$NEED_MERGE" = true ]; then
+            printf '%s\n' "$NEW_DAEMON_CONFIG" >/etc/docker/daemon.json
+            echo " - Network pool configuration: ${DOCKER_ADDRESS_POOL_BASE} (size ${DOCKER_ADDRESS_POOL_SIZE})"
             echo " - Configuration updated - restarting Docker daemon..."
             restart_docker_service
-        else
-            echo " - Configuration is up to date"
         fi
-    else
-        echo " - Configuration is up to date"
     fi
 else
-    if [ "$NEED_MERGE" = true ]; then
-        echo " - Configuration updated - restarting Docker daemon..."
-        restart_docker_service
-    else
-        echo " - Configuration is up to date"
-    fi
+    echo " - Using the existing network pool ${DOCKER_ADDRESS_POOL_BASE} (size ${DOCKER_ADDRESS_POOL_SIZE})"
+    echo " - To override it: DOCKER_POOL_FORCE_OVERRIDE=true"
 fi
 
 step_done
@@ -1070,6 +987,7 @@ step_done
 
 step_start "Checking SSH key for localhost access"
 SSH_KEY_DETAIL="existing key"
+create_coolify_directories
 if [ ! -f ~/.ssh/authorized_keys ]; then
     mkdir -p ~/.ssh
     chmod 700 ~/.ssh
diff --git a/scripts/parser-snapshot-diff b/scripts/parser-snapshot-diff
new file mode 100755
index 0000000000..fc2e1e5d07
--- /dev/null
+++ b/scripts/parser-snapshot-diff
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# Show how a code change alters the service parser output for every template and the reference fixture.
+#
+# Usage:
+#   ./scripts/parser-snapshot-diff save                 # 1. before you change code: save the current output
+#   ./scripts/parser-snapshot-diff baseline             # 2. after the change: compare with the saved output
+#   ./scripts/parser-snapshot-diff [git-ref]            # or compare with a git ref (default: main)
+#   ./scripts/parser-snapshot-diff baseline -- --filter='"template appwrite"'   # extra Pest arguments
+#
+# Each run parses everything with tests/Feature/ServiceParserReferenceTest.php (about 90 seconds).
+# A git ref is exported with git archive to a temporary directory and parsed with the current test,
+# fixtures and templates, so the diff shows only the effect of the code change.
+# The terminal shows one line per changed case; the full diff is written to storage/framework/testing/.
+set -euo pipefail
+
+repo="$(git -C "$(dirname "$0")/.." rev-parse --show-toplevel)"
+mode="${1:-main}"
+shift || true
+[[ "${1:-}" == "--" ]] && shift
+pest_args=("$@")
+
+testing="$repo/storage/framework/testing"   # gitignored, same file system as the repository
+saved="$testing/parser-snapshots-baseline"
+report="$testing/parser-snapshot-diff.diff"
+work="$(mktemp -d "$testing/parser-snapshot-diff.XXXXXX")"
+trap 'rm -rf "$work"' EXIT
+
+# Run the golden test in <dir> with UPDATE_PARSER_SNAPSHOTS=1 and copy its expected files to <target>.
+parse_into() {
+  local dir="$1" target="$2" label="$3" expected="$1/tests/Fixtures/parser/expected" backup="$work/expected-backup" status=0
+  echo "==> Parsing on $label (about 90 seconds)"
+  # The run rewrites the expected files: put the previous ones back afterwards, so the repository is unchanged.
+  rm -rf "$backup"
+  cp -r "$expected" "$backup"
+  rm -rf "$expected/templates"
+  (cd "$dir" && UPDATE_PARSER_SNAPSHOTS=1 php -d memory_limit=2G artisan test --compact \
+    tests/Feature/ServiceParserReferenceTest.php "${pest_args[@]}" >"$work/run.log" 2>&1) || status=$?
+  rm -rf "$target"
+  cp -r "$expected" "$target"
+  rm -rf "$expected"
+  mv "$backup" "$expected"
+  if [[ $status -ne 0 ]]; then
+    echo "Test run on $label failed:" >&2
+    tail -30 "$work/run.log" >&2
+    exit 1
+  fi
+}
+
+case "$mode" in
+  save)
+    parse_into "$repo" "$saved" "working tree"
+    echo "Saved baseline: $saved"
+    echo "Change the code, then run: ./scripts/parser-snapshot-diff baseline"
+    exit 0
+    ;;
+  baseline)
+    [[ -d "$saved" ]] || { echo "No saved baseline. Run ./scripts/parser-snapshot-diff save first." >&2; exit 1; }
+    base_label="saved baseline"
+    cp -r "$saved" "$work/base-expected"
+    ;;
+  *)
+    base_label="$mode"
+    base="$work/base"
+    mkdir -p "$base"
+    echo "==> Exporting $mode ($(git -C "$repo" rev-parse --short "$mode"))"
+    git -C "$repo" archive "$mode" | tar -x -C "$base"
+    # Hard links: fast and no extra disk space. A symlink would make Composer load the classes of $repo.
+    cp -al "$repo/vendor" "$base/vendor"
+    [[ -f "$repo/.env" ]] && cp "$repo/.env" "$base/.env"
+    rm -rf "$base/templates/compose" "$base/tests/Fixtures/parser"
+    cp -r "$repo/templates/compose" "$base/templates/compose"
+    mkdir -p "$base/tests/Fixtures/parser"
+    cp "$repo"/tests/Fixtures/parser/*.yaml "$base/tests/Fixtures/parser/"
+    cp "$repo/tests/Feature/ServiceParserReferenceTest.php" "$base/tests/Feature/"
+    parse_into "$base" "$work/base-expected" "$mode"
+    ;;
+esac
+
+parse_into "$repo" "$work/current-expected" "working tree"
+
+echo
+if diff -ru "$work/base-expected" "$work/current-expected" | sed -E "s#$work/(base|current)-expected/##g" >"$report"; then
+  echo "No differences from $base_label: the parser output of every case is the same."
+  exit 0
+fi
+
+# Line 2 is the first step (1_deploy): an error there means the case did not parse at all on that side.
+first_step_error() { sed -n 2p "$1" | grep '^  error:' | cut -c10-130 || true; }
+
+summary() {
+  local file="$1" base_file="$work/base-expected/$1" current_file="$work/current-expected/$1" base_error current_error
+  [[ -f "$base_file" ]] || { echo "  new case        $file"; return; }
+  [[ -f "$current_file" ]] || { echo "  removed case    $file"; return; }
+  base_error="$(first_step_error "$base_file")"
+  current_error="$(first_step_error "$current_file")"
+  if [[ -n "$base_error" && -z "$current_error" ]]; then
+    echo "  base error      $file: $base_error"
+  elif [[ -n "$current_error" && -z "$base_error" ]]; then
+    echo "  CURRENT ERROR   $file: $current_error"
+  else
+    echo "  changed         $file (+$(diff "$base_file" "$current_file" | grep -c '^>' || true) -$(diff "$base_file" "$current_file" | grep -c '^<' || true))"
+  fi
+}
+
+changed_cases=()
+while IFS= read -r file; do
+  cmp -s "$work/base-expected/$file" "$work/current-expected/$file" || changed_cases+=("$file")
+done < <( (cd "$work/base-expected" && find . -name '*.yaml'; cd "$work/current-expected" && find . -name '*.yaml') | sed 's|^\./||' | sort -u)
+
+lines="$(for file in "${changed_cases[@]}"; do summary "$file"; done)"
+echo "${#changed_cases[@]} case(s) differ from $base_label:"
+echo "$lines"
+echo
+echo "Full diff: $report"
+if grep -q '^  base error' <<<"$lines"; then
+  echo "Note: 'base error' cases did not parse on $base_label, so there is no base output to compare with."
+fi
+exit 1
diff --git a/scripts/transfer-test/README.md b/scripts/transfer-test/README.md
new file mode 100644
index 0000000000..0a90e0f1c4
--- /dev/null
+++ b/scripts/transfer-test/README.md
@@ -0,0 +1,70 @@
+# Server transfer test kit
+
+Live end-to-end tests for the server transfer (moving a server and its resources to another Coolify instance).
+The unit tests in `tests/Unit/ServerTransfer/` fake SSH and HTTP. These scripts use two real dev instances and
+real VMs, so they also find problems with shells, sudo, networks, queues, and running containers.
+
+- **Source (A):** the dev instance of this checkout (`./scripts/dev start`). Its localhost is the `ubuntu-root` VM.
+  The tests transfer its `ubuntu-non-root` and `debian-root` VMs.
+- **Target (B):** a second instance of the same checkout that runs side by side (`transfer-target`). Its localhost is
+  the testing-host container.
+
+Requirements: Linux with KVM (the dev VMs), root or passwordless sudo (VMs and iptables), `jq`, and PHP on the host.
+macOS with Lima is not supported yet.
+
+## Steps
+
+```bash
+./scripts/dev start                        # A, if it does not run yet
+scripts/transfer-test/setup.sh             # start B and connect A, B, and A's VMs (safe to run again)
+scripts/transfer-test/reset.sh             # WIPES BOTH DEV DATABASES, then seeds A with deployed resources (~4 min)
+
+scripts/transfer-test/e2e.sh               # transfer both VMs A -> B through the API (41 checks)
+scripts/transfer-test/reset.sh
+scripts/transfer-test/reverse-e2e.sh       # undo paths: transfer back, transfer over an archive, take back, archive delete (18 checks)
+scripts/transfer-test/reset.sh
+scripts/transfer-test/extras-e2e.sh        # fake tokens, DNS, secret links, runner config, links, icon ... (31 checks)
+scripts/transfer-test/reset.sh
+```
+
+For a manual test, run `scripts/transfer-test/manual-setup.sh`: it resets, adds the fake extra records to A, and
+prints the URLs, logins, and tokens.
+
+Each test ends with `=== N failure(s)` and exits with N. Run `reset.sh` between two tests: a test leaves servers
+transferred. After `reset.sh`, you can also test by hand: log in to A and B with `test@example.com` / `password`, open a
+VM server on A → Transfer, and use the target URL `http://localhost:<B port>` with the token in
+`<main checkout>/.dev-instances/transfer-test/<source>/target.token`.
+
+## Files
+
+| File | What it does |
+|---|---|
+| `lib.sh` | Shared values (from `.dev-instances/*.env` and `config/development-qemu.php`) and helpers |
+| `setup.sh` | Starts B side by side, adds the iptables rule for B → A's VMs, and adds socat forwards when the ports listen on 127.0.0.1 |
+| `reset.sh` | Removes test workloads from the VMs, wipes both databases, seeds A's VMs, makes the helper image available, creates API tokens, runs `seed.sh` |
+| `seed.sh` | Creates and deploys resources on A through the API |
+| `e2e.sh`, `reverse-e2e.sh`, `extras-e2e.sh` | The tests |
+| `seed-extras.php`, `verify-extras-*.php` | Fake records and checks of `extras-e2e.sh` |
+| `manual-setup.sh` | Reset plus the fake extra records, then prints what to open and enter for a manual test |
+| `seed-inventory.php` | Seeds a large database-only demo server (no deploys) on the current instance |
+
+Tokens and the VM SSH key are written to `<main checkout>/.dev-instances/transfer-test/<source>/` (not in git).
+For a full manual test of every transferred setting, see `docs/server-transfer-full-coverage.md`.
+
+## Options
+
+- `TRANSFER_TEST_SOURCE=<instance>`: another source instance than the one of this checkout.
+- `TRANSFER_TEST_TARGET=<instance>`: another target name than `transfer-target`.
+
+## Notes
+
+- A and B share `storage/` of the checkout. The side-by-side mode of `scripts/dev` gives B its own SSH folder, because
+  both instances have a server with the uuid `localhost`.
+- A and B have the same `app.id`, so the DNS owner comment does not change in a transfer here.
+  `extras-e2e.sh` expects that. With different ids, the target must change the comment at the DNS provider.
+- `reset.sh` tags the newest local helper image with the configured helper version when that version is not
+  published yet.
+- Remove the kit: run `./scripts/dev destroy transfer-target` and
+  `docker rm -f $(docker ps -aq --filter name=coolify-transfer-test-forward)`. Then remove the iptables rule that
+  `setup.sh` added: `sudo iptables -D LIBVIRT_FWI -s <B subnet> -d 10.221.<A slot>.0/24 -o cdevbr<A slot> -j ACCEPT`
+  (`setup.sh` prints the subnet; `sudo iptables -S LIBVIRT_FWI` lists the rules).
diff --git a/scripts/transfer-test/e2e.sh b/scripts/transfer-test/e2e.sh
new file mode 100755
index 0000000000..7f13cc253a
--- /dev/null
+++ b/scripts/transfer-test/e2e.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Transfer both VM servers A -> B through the API and check source, target, server, and a redeploy from B.
+# Run reset.sh before and after.
+source "$(dirname "$0")/lib.sh"
+TA="$(source_token)"
+TB="$(target_token)"
+
+for profile in "${TRANSFER_PROFILES[@]}"; do
+  S="$(vm_field "$profile" uuid)"
+  ip="$(vm_field "$profile" ip)"
+  echo "=== $S"
+  before="$(stable_workloads "$profile")"
+  apps="$(tinker "$A" "echo App\\Models\\Server::where('uuid','$S')->first()->applications()->pluck('uuid')->implode(' ');" | tail -1)"
+
+  echo '-- start the transfer on A'
+  r="$(api POST "$A_PORT" "/servers/$S/migrate" "$TA" "$(jq -nc --arg u "http://localhost:$B_PORT" --arg t "$TB" '{target_url:$u,target_token:$t}')")"
+  if [[ "$(jq -r .migration.status <<<"$r" 2>/dev/null)" != running ]]; then
+    bad "transfer request accepted: $r"
+    continue
+  fi
+  ok 'transfer request accepted'
+  for _ in $(seq 1 40); do sleep 3; st="$(api GET "$A_PORT" "/servers/$S/transfer" "$TA" | jq -r .migration.status)"; [[ "$st" != running ]] && break; done
+  check "transfer finished ($st)" test "$st" = succeeded
+
+  echo '-- source A'
+  a="$(api GET "$A_PORT" "/servers/$S/transfer" "$TA")"
+  export_id="$(jq -r .transfer.export_id <<<"$a")"
+  check 'A transfer.status = transferred' test "$(jq -r .transfer.status <<<"$a")" = transferred
+  check 'A force_disabled + Sentinel off' test "$(tinker "$A" "\$s=App\\Models\\Server::where('uuid','$S')->first()->settings; echo (int)\$s->force_disabled.(int)\$s->is_sentinel_enabled;" | tail -1)" = 10
+  check 'A shows the take-back modal' test "$(tinker "$A" "$login_php echo (int) str_contains(Livewire\\Livewire::test(App\\Livewire\\Server\\Show::class, ['server_uuid'=>'$S'])->html(), 'Take back a transferred server?');" | tail -1)" = 1
+  r="$(api POST "$A_PORT" "/servers/$S/migrate" "$TA" "$(jq -nc --arg u "http://localhost:$B_PORT" --arg t "$TB" '{target_url:$u,target_token:$t}')")"
+  check 'second transfer refused by the prechecks' grep -q 'already transferred' <<<"$r"
+
+  echo '-- target B'
+  b="$(api GET "$B_PORT" "/servers/$S/transfer" "$TB")"
+  check 'B transfer.status = claimed' test "$(jq -r .transfer.status <<<"$b")" = claimed
+  check 'same export id on A and B' test "$(jq -r .transfer.export_id <<<"$b")" = "$export_id"
+  for _ in $(seq 1 20); do
+    sleep 3
+    meta="$(tinker "$B" "\$s=App\\Models\\Server::where('uuid','$S')->first(); echo json_encode(['os'=>data_get(\$s->server_metadata,'os'),'reach'=>\$s->settings->is_reachable,'usable'=>\$s->settings->is_usable,'logs'=>\$s->validation_logs,'transfer'=>data_get(\$s->server_metadata,'transfer.status')]);" | tail -1)"
+    [[ "$(jq -r .os <<<"$meta")" != null ]] && break
+  done
+  check "automatic validation filled the metadata ($(jq -r .os <<<"$meta"))" test "$(jq -r .os <<<"$meta")" != null
+  check 'B reachable + usable, no validation error' test "$(jq -c '[.reach,.usable,.logs]' <<<"$meta")" = '[true,true,null]'
+  check 'transfer state kept after validation' test "$(jq -r .transfer <<<"$meta")" = claimed
+  check 'B started the finish list' test "$(tinker "$B" "echo count((array) data_get(App\\Models\\Server::where('uuid','$S')->first()->server_metadata,'transfer.finish.items')) > 0 ? 1 : 0;" | tail -1)" = 1
+  check 'A links to the server on B' test "$(jq -r .migration.target_server_url <<<"$a")" = "$B_URL/server/$S"
+  check 'B has all applications' test "$(tinker "$B" "echo App\\Models\\Server::where('uuid','$S')->first()->applications()->pluck('uuid')->implode(' ');" | tail -1)" = "$apps"
+  check 'B validates the server over SSH' test "$(tinker "$B" "\$r=App\\Models\\Server::where('uuid','$S')->first()->validateConnection(); echo (int)(bool)\$r['uptime'];" | tail -1)" = 1
+
+  echo '-- server'
+  sleep 5
+  after="$(workloads "$profile")"
+  check 'proxy + workloads not recreated' test "$before" = "$after"
+  sentinel_env="$(ssh_vm "$profile" "docker inspect coolify-sentinel --format '{{range .Config.Env}}{{println .}}{{end}}'")"
+  check 'Sentinel sends to B' grep -qx "PUSH_ENDPOINT=$B_URL" <<<"$sentinel_env"
+  for app in $apps; do check "app $app answers over HTTP" bash -c "curl -sf -m5 -H 'Host: $app.$ip.sslip.io' http://$ip/ >/dev/null"; done
+
+  echo '-- redeploy one app from B'
+  app="${apps%% *}"
+  api POST "$B_PORT" "/deploy?uuid=$app&force=false" "$TB" >/dev/null
+  for _ in $(seq 1 40); do sleep 5; ds="$(tinker "$B" "echo App\\Models\\ApplicationDeploymentQueue::where('application_id', App\\Models\\Application::where('uuid','$app')->value('id'))->latest('id')->value('status');" | tail -1)"; [[ "$ds" == finished || "$ds" == failed ]] && break; done
+  check "redeploy from B ($ds)" test "$ds" = finished
+  check 'app answers after the redeploy' bash -c "for i in {1..10}; do curl -sf -m5 -H 'Host: $app.$ip.sslip.io' http://$ip/ >/dev/null && exit 0; sleep 3; done; exit 1"
+done
+
+echo "=== $FAILS failure(s)"
+exit "$FAILS"
diff --git a/scripts/transfer-test/extras-e2e.sh b/scripts/transfer-test/extras-e2e.sh
new file mode 100755
index 0000000000..652ff577aa
--- /dev/null
+++ b/scripts/transfer-test/extras-e2e.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Add fake records around debian-root on A (tokens, DNS, secret manager link, tunnel token, GitHub App + runner config,
+# resource links, canvas positions, team variable, maintenance mode, proxy error page, project icon, and an app of the
+# same project on the other VM), transfer debian-root to B through the Transfer page, and check them on B and A.
+# Run reset.sh before and after.
+source "$(dirname "$0")/lib.sh"
+S="$(vm_field debian-root uuid)"
+
+echo '=== seed fake records on A'
+php_file "$A" "$TT_DIR/seed-extras.php"
+echo "=== transfer $S A -> B"
+echo "status: $(transfer_from_page "$S")"
+
+# The target compares the DNS owner comment, which contains the instance id, with the one of the source.
+tinker "$A" 'echo config("app.id");' | tail -1 | docker exec -i "$B" sh -c 'cat > /tmp/source-app-id'
+
+echo '=== target B'
+b="$(php_file "$B" "$TT_DIR/verify-extras-target.php")"
+echo "$b"
+echo '=== source A'
+a="$(php_file "$A" "$TT_DIR/verify-extras-source.php")"
+echo "$a"
+FAILS="$(printf '%s\n%s\n' "$a" "$b" | grep -c '^FAIL')"
+echo "=== $FAILS failure(s)"
+exit "$FAILS"
diff --git a/scripts/transfer-test/lib.sh b/scripts/transfer-test/lib.sh
new file mode 100644
index 0000000000..bb0b9d975f
--- /dev/null
+++ b/scripts/transfer-test/lib.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Shared values and helpers of the server transfer test kit. The other scripts source this file.
+#
+# Source (A): the dev instance of this checkout, as `./scripts/dev` names it. Override: TRANSFER_TEST_SOURCE.
+# Target (B): a side-by-side instance of the same checkout. Default "transfer-target". Override: TRANSFER_TEST_TARGET.
+# Tokens and the VM SSH key are stored in <main checkout>/.dev-instances/transfer-test/<source>/ (not in git).
+
+set -uo pipefail
+
+TT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+ROOT="$(cd "$TT_DIR/../.." && pwd -P)"
+cd "$ROOT"
+ENV_DIR="$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")/.dev-instances"
+
+SOURCE="${TRANSFER_TEST_SOURCE:-$(./scripts/dev container | sed 's/^coolify-dev-//')}"
+TARGET="${TRANSFER_TEST_TARGET:-transfer-target}"
+A="coolify-dev-$SOURCE"
+B="coolify-dev-$TARGET"
+STATE_DIR="$ENV_DIR/transfer-test/$SOURCE"
+VM_KEY="$STATE_DIR/vm_key"
+
+# The VM servers that the tests transfer, and the profile that is localhost of the source.
+TRANSFER_PROFILES=(ubuntu-non-root debian-root)
+LOCALHOST_PROFILE=ubuntu-root
+
+PRIVILEGED=()
+if [[ $EUID -ne 0 ]]; then
+  PRIVILEGED=(sudo -n -E)
+fi
+
+die() {
+  echo "ERROR: $*" >&2
+  exit 1
+}
+
+env_value() {
+  local file="$ENV_DIR/$1.env"
+  [[ -f "$file" ]] || die "No dev instance '$1' ($file). See ./scripts/dev urls"
+  grep -E "^$2=" "$file" | cut -d= -f2-
+}
+
+A_PORT="$(env_value "$SOURCE" APP_PORT)"
+A_SLOT="$(env_value "$SOURCE" DEVELOPMENT_QEMU_SLOT)"
+A_URL="$(env_value "$SOURCE" APP_URL)"
+
+target_values() {
+  B_PORT="$(env_value "$TARGET" APP_PORT)"
+  B_URL="$(env_value "$TARGET" APP_URL)"
+}
+if [[ -f "$ENV_DIR/$TARGET.env" ]]; then
+  target_values
+fi
+
+# vm_field <profile> <field>: a value of config/development-qemu.php for the source instance (ip, user, uuid).
+vm_field() {
+  DEVELOPMENT_QEMU_INSTANCE="$SOURCE" DEVELOPMENT_QEMU_SLOT="$A_SLOT" php -r '
+    function env($key, $default = null) { $value = getenv($key); return $value === false ? $default : $value; }
+    $config = require "config/development-qemu.php";
+    echo $config["profiles"][$argv[1]][$argv[2]];
+  ' "$1" "$2"
+}
+
+running() { [[ "$(docker inspect --format '{{.State.Running}}' "$1" 2>/dev/null)" == true ]]; }
+
+# tinker <container> <php>: run PHP in a Coolify container.
+tinker() { docker exec -u www-data "$1" php artisan tinker --execute "$2" 2>/dev/null; }
+
+# php_file <container> <file>: run a PHP file of this kit in a Coolify container.
+php_file() {
+  docker cp "$2" "$1:/tmp/$(basename "$2")" >/dev/null &&
+    docker exec -u www-data "$1" php artisan tinker --execute "require '/tmp/$(basename "$2")';" 2>&1 | grep -v '^$'
+}
+
+# api <METHOD> <port> <path> <token> [json]
+api() {
+  curl -sS -m 30 -X "$1" "http://127.0.0.1:$2/api/v1$3" -H "Authorization: Bearer $4" \
+    -H 'Content-Type: application/json' -H 'Accept: application/json' ${5:+-d "$5"}
+}
+
+source_token() { cat "$STATE_DIR/source.token"; }
+target_token() { cat "$STATE_DIR/target.token"; }
+
+# The VMs accept the dev key that the seeders create as private key 1.
+fetch_vm_key() {
+  mkdir -p "$STATE_DIR"
+  tinker "$A" 'echo optional(App\Models\PrivateKey::find(1))->private_key;' >"$VM_KEY.tmp"
+  if grep -q 'PRIVATE KEY' "$VM_KEY.tmp"; then
+    mv "$VM_KEY.tmp" "$VM_KEY"
+    chmod 600 "$VM_KEY"
+    return 0
+  fi
+  rm -f "$VM_KEY.tmp"
+  return 1
+}
+
+# ssh_vm <profile> <command>: run a shell command as root on a VM of the source.
+ssh_vm() {
+  local user ip sudo=''
+  user="$(vm_field "$1" user)"
+  ip="$(vm_field "$1" ip)"
+  [[ "$user" != root ]] && sudo='sudo '
+  ssh -i "$VM_KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=5 \
+    "$user@$ip" "${sudo}sh -c $(printf '%q' "$2")"
+}
+
+# workloads <profile>: the containers on a VM, without Sentinel, which a claim restarts on purpose.
+workloads() { ssh_vm "$1" 'docker ps --format "{{.Names}} {{.ID}}" | grep -v coolify-sentinel | sort'; }
+
+# stable_workloads <profile>: the workloads once they stop changing. reset.sh returns while databases still start.
+stable_workloads() {
+  local previous='' current
+  for _ in $(seq 1 30); do
+    current="$(workloads "$1")"
+    [[ -n "$current" && "$current" == "$previous" ]] && break
+    previous="$current"
+    sleep 10
+  done
+  echo "$current"
+}
+
+# require_dev_instance <container>: refuse to wipe anything that is not a running local dev instance.
+require_dev_instance() {
+  running "$1" || die "Container $1 is not running."
+  [[ "$1" == coolify-dev-* ]] || die "$1 is not a scripts/dev instance."
+  [[ "$(tinker "$1" 'echo app()->environment();' | tail -1)" == local ]] || die "$1 does not run with APP_ENV=local."
+}
+
+# Pass/fail counter of the e2e scripts.
+FAILS=0
+ok() { echo "  PASS $*"; }
+bad() {
+  echo "  FAIL $*"
+  FAILS=$((FAILS + 1))
+}
+check() {
+  local name="$1"
+  shift
+  if "$@" >/dev/null 2>&1; then ok "$name"; else bad "$name"; fi
+}
+
+login_php="auth()->login(App\\Models\\User::find(0)); session(['currentTeam' => App\\Models\\Team::find(0)]);"
+
+# transfer_from_page <server uuid>: start a transfer A -> B through the Transfer page, wait, print the final status.
+transfer_from_page() {
+  local status
+  tinker "$A" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Transfer::class, ['server_uuid' => '$1'])->set('targetUrl', 'http://localhost:$B_PORT')->set('targetToken', '$(target_token)')->call('migrateServer');" >/dev/null
+  for _ in $(seq 1 60); do
+    sleep 3
+    status="$(tinker "$A" "echo data_get(App\\Models\\Server::where('uuid', '$1')->first()?->server_metadata, 'migration.status');" | tail -1)"
+    [[ "$status" != running ]] && break
+  done
+  echo "$status"
+}
diff --git a/scripts/transfer-test/manual-setup.sh b/scripts/transfer-test/manual-setup.sh
new file mode 100755
index 0000000000..bb90def1b1
--- /dev/null
+++ b/scripts/transfer-test/manual-setup.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Prepare A and B for a manual transfer test: reset, then add the fake extra records of extras-e2e.sh to A
+# (tokens, DNS, secret manager link, tunnel token, GitHub App + runner config, resource links, canvas positions,
+# team variable, maintenance mode, proxy error page, project icon, a git app with a system-wide GitHub App, and an
+# app of the same project on the other VM). Prints what to open and what to enter.
+#
+# Usage: scripts/transfer-test/manual-setup.sh
+source "$(dirname "$0")/lib.sh"
+
+"$TT_DIR/reset.sh" || die 'reset.sh failed'
+echo '== add the fake extra records to A'
+php_file "$A" "$TT_DIR/seed-extras.php"
+
+cat <<EOF
+
+Ready for a manual transfer test.
+
+  A (source): $A_URL
+  B (target): $B_URL
+  Login on both: test@example.com / password
+
+  Servers on A:
+    $(vm_field ubuntu-non-root uuid)  $(vm_field ubuntu-non-root ip)  project "Transfer Demo": whoami, nginx-dockerfile, postgres, redis, uptime-kuma
+    $(vm_field debian-root uuid)  $(vm_field debian-root ip)  project "Second Server": whoami-2, mariadb, git-shop, and all the fake extra records
+
+  Transfer on A: open a server -> Transfer
+    Target instance URL: http://localhost:$B_PORT
+    Target API token:    $(target_token)
+  Transfer back on A (archive -> Transfer):
+    Instance that manages the server now: http://localhost:$B_PORT   (same token)
+    URL of this instance:                 http://localhost:$A_PORT
+  Token of A (for a transfer from B to A): $(source_token)
+
+Reset again: scripts/transfer-test/manual-setup.sh
+EOF
diff --git a/scripts/transfer-test/reset.sh b/scripts/transfer-test/reset.sh
new file mode 100755
index 0000000000..0abbea8c42
--- /dev/null
+++ b/scripts/transfer-test/reset.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Put the kit back to its start: A manages its localhost VM and the transfer VMs with deployed resources, B is empty.
+# WIPES BOTH DEV DATABASES (migrate:fresh --seed) and the test workloads on the VMs. VM disks are kept. About 4 minutes.
+#
+# Usage: scripts/transfer-test/reset.sh
+source "$(dirname "$0")/lib.sh"
+
+require_dev_instance "$A"
+require_dev_instance "$B"
+mkdir -p "$STATE_DIR"
+
+echo '== 1. remove test workloads from the VMs (the proxy stays)'
+if fetch_vm_key; then
+  for profile in "${TRANSFER_PROFILES[@]}"; do
+    ssh_vm "$profile" '
+      for c in $(docker ps -aq); do n=$(docker inspect -f "{{.Name}}" $c); case "$n" in /coolify-proxy*) ;; *) docker rm -f $c >/dev/null;; esac; done
+      docker volume ls -q | grep -v "^coolify" | xargs -r docker volume rm >/dev/null 2>&1 || true
+      rm -rf /data/coolify/applications/* /data/coolify/databases/* /data/coolify/services/* /data/coolify/sentinel/* /data/coolify/transfer
+      echo "  $(hostname): $(docker ps --format "{{.Names}}" | tr "\n" " ")"' || echo "  $profile: not reachable, skipped"
+  done
+else
+  echo '  no VM key yet (first run), skipped'
+fi
+
+echo '== 2. fresh databases, Redis, SSH folders'
+for C in "$A" "$B"; do
+  docker exec "$C-redis-1" redis-cli FLUSHALL >/dev/null
+  docker exec "$C" sh -c 'rm -rf /var/www/html/storage/app/ssh/keys/* /var/www/html/storage/app/ssh/mux/*; mkdir -p /var/www/html/storage/app/ssh/keys /var/www/html/storage/app/ssh/mux; chown -R www-data:www-data /var/www/html/storage/app/ssh'
+  docker exec -u www-data "$C" php artisan migrate:fresh --seed --force >/dev/null || die "migrate:fresh failed in $C"
+  echo "  $C: database seeded"
+done
+
+echo '== 3. seed the VM servers of A'
+host="${DEV_BIND_ADDRESS:-$(grep -E '^DEV_BIND_ADDRESS=' .env 2>/dev/null | tail -1 | cut -d= -f2-)}"
+[[ -z "$host" || "$host" == 0.0.0.0 ]] && host=127.0.0.1
+APP_ENV=local APP_CONFIG_CACHE="$ROOT/bootstrap/cache/dev-qemu-$$.php" LOG_CHANNEL=stderr \
+  APP_KEY="$(env_value "$SOURCE" APP_KEY)" DB_HOST="$host" DB_PORT="$(env_value "$SOURCE" FORWARD_DB_PORT)" \
+  REDIS_HOST="$host" REDIS_PORT="$(env_value "$SOURCE" FORWARD_REDIS_PORT)" \
+  DEVELOPMENT_QEMU_INSTANCE="$SOURCE" DEVELOPMENT_QEMU_SLOT="$A_SLOT" \
+  DEVELOPMENT_QEMU_DOCKER_NETWORK="$A" DEVELOPMENT_QEMU_COOLIFY_CONTAINER="$A" \
+  "${PRIVILEGED[@]}" sh -c "php artisan dev:qemu $LOCALHOST_PROFILE --as-localhost && php artisan dev:qemu ${TRANSFER_PROFILES[*]}" 2>&1 | grep -E 'Started|rror'
+docker exec "$A" chown -R www-data:www-data /var/www/html/storage/app/ssh
+fetch_vm_key || die 'The VM key (private key 1) is missing on A after seeding.'
+
+echo '== 4. helper image on the VMs'
+helper="$(tinker "$A" 'echo config("constants.coolify.helper_image").":".config("constants.coolify.helper_version");' | tail -1)"
+for profile in "${TRANSFER_PROFILES[@]}"; do
+  # An unreleased helper version cannot be pulled; tag the newest local helper image with that version instead.
+  ssh_vm "$profile" "docker image inspect $helper >/dev/null 2>&1 || docker pull -q $helper >/dev/null 2>&1 || {
+      latest=\$(docker images --format '{{.Repository}}:{{.Tag}}' | grep -E '(^|/)coollabsio/coolify-helper:' | sort -V | tail -1)
+      [ -n \"\$latest\" ] && docker tag \"\$latest\" $helper && echo \"  \$(hostname): tagged \$latest as $helper (not published yet)\"
+    }"
+done
+
+echo '== 5. proxies, API tokens, new code in Horizon'
+tinker "$A" 'foreach (App\Models\Server::where("id", "!=", 0)->get() as $s) { $s->proxy->set("type", "TRAEFIK"); $s->proxy->set("status", "exited"); $s->save(); App\Actions\Proxy\StartProxy::run($s->fresh(), async: false, force: true); echo "  proxy ok: ".$s->name.PHP_EOL; }'
+for side in source target; do
+  C="$A"
+  [[ "$side" == target ]] && C="$B"
+  tinker "$C" '$s = App\Models\InstanceSettings::get(); $s->is_api_enabled = true; $s->save(); session(["currentTeam" => App\Models\Team::find(0)]); echo App\Models\User::find(0)->createToken("transfer-test", ["root"])->plainTextToken;' | tail -1 >"$STATE_DIR/$side.token"
+  chmod 600 "$STATE_DIR/$side.token"
+  docker exec -u www-data "$C" php artisan horizon:terminate >/dev/null
+done
+
+echo '== 6. create and deploy resources on A'
+sleep 10
+"$TT_DIR/seed.sh" >/dev/null || die 'seed.sh failed'
+echo '  waiting for deployments...'
+for _ in $(seq 1 30); do
+  sleep 10
+  [[ "$(tinker "$A" 'echo App\Models\ApplicationDeploymentQueue::whereIn("status", ["queued", "in_progress"])->count();' | tail -1)" == 0 ]] && break
+done
+tinker "$A" 'foreach (App\Models\ApplicationDeploymentQueue::get() as $d) echo "  deploy ".$d->application_name.": ".$d->status.PHP_EOL;'
+for profile in "${TRANSFER_PROFILES[@]}"; do
+  ssh_vm "$profile" 'echo "  $(hostname): $(docker ps --format "{{.Names}}" | grep -v "^coolify-" | wc -l) workload containers"'
+done
+echo "Done. A: $A_URL  B: $B_URL  (login test@example.com / password)"
diff --git a/scripts/transfer-test/reverse-e2e.sh b/scripts/transfer-test/reverse-e2e.sh
new file mode 100755
index 0000000000..52aea2b887
--- /dev/null
+++ b/scripts/transfer-test/reverse-e2e.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Undo paths: the owner marker, transfer back from the archive, a transfer over an archive, take back with automatic
+# release, and deleting an archive.
+# Uses the debian-root VM. Run reset.sh before and after.
+source "$(dirname "$0")/lib.sh"
+TA="$(source_token)"
+TB="$(target_token)"
+PROFILE=debian-root
+S="$(vm_field "$PROFILE" uuid)"
+
+marker() { ssh_vm "$PROFILE" 'cat /data/coolify/transfer/owner.json 2>/dev/null' | jq -r .claim_id; }
+claim_id() { tinker "$1" "echo data_get(App\\Models\\Server::where('uuid','$S')->first()?->server_metadata,'transfer.claim.claim_id');" | tail -1; }
+status() { tinker "$1" "echo data_get(App\\Models\\Server::withTrashed()->where('uuid','$S')->first()?->server_metadata,'transfer.status','none');" | tail -1; }
+# migrate <from port> <from token> <to port> <to token>: transfer through the API, wait, print the transfer status JSON.
+migrate() {
+  local r
+  api POST "$1" "/servers/$S/migrate" "$2" "$(jq -nc --arg u "http://localhost:$3" --arg t "$4" '{target_url:$u,target_token:$t}')" >/dev/null
+  for _ in $(seq 1 40); do sleep 3; r="$(api GET "$1" "/servers/$S/transfer" "$2")"; [[ "$(jq -r .migration.status <<<"$r")" != running ]] && break; done
+  echo "$r"
+}
+
+before="$(stable_workloads "$PROFILE")"
+
+echo '=== 1. A -> B writes the owner marker of B'
+r="$(migrate "$A_PORT" "$TA" "$B_PORT" "$TB")"
+check "transfer A -> B ($(jq -r .migration.status <<<"$r"))" test "$(jq -r .migration.status <<<"$r")" = succeeded
+cb="$(claim_id "$B")"
+check "marker = claim of B ($cb)" test "$(marker)" = "$cb"
+
+echo '=== 2. Transfer back from the Transfer page of the archive on A'
+tinker "$A" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Transfer::class, ['server_uuid'=>'$S'])->set('managerUrl','http://localhost:$B_PORT')->set('managerToken','$TB')->set('thisInstanceUrl','http://localhost:$A_PORT')->call('transferBack');" >/dev/null
+for _ in $(seq 1 40); do sleep 3; [[ "$(status "$A")" == claimed ]] && break; done
+ca="$(claim_id "$A")"
+check 'A claimed (archive replaced), B transferred' test "$(status "$A")/$(status "$B")" = claimed/transferred
+check 'A has one server with this uuid' test "$(tinker "$A" "echo App\\Models\\Server::withTrashed()->where('uuid','$S')->count();" | tail -1)" = 1
+check "marker = claim of A ($ca)" test "$(marker)" = "$ca"
+check 'workloads unchanged after the transfer back' test "$(workloads "$PROFILE")" = "$before"
+
+echo '=== 3. A -> B again replaces the archive on B'
+r="$(migrate "$A_PORT" "$TA" "$B_PORT" "$TB")"
+check "transfer A -> B again ($(jq -r .migration.status <<<"$r"))" test "$(jq -r .migration.status <<<"$r")" = succeeded
+check 'B claimed, A transferred' test "$(status "$B")/$(status "$A")" = claimed/transferred
+check 'workloads unchanged after the second transfer' test "$(workloads "$PROFILE")" = "$before"
+
+echo '=== 4. Take back on A, then B releases the server on its next connection check'
+tinker "$A" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Show::class, ['server_uuid'=>'$S'])->call('enableManagement');" >/dev/null
+ca="$(claim_id "$A")"
+check 'A claimed again' test "$(status "$A")" = claimed
+check "marker = new claim of A ($ca)" test "$(marker)" = "$ca"
+check 'A started the finish list' test "$(tinker "$A" "echo count((array) data_get(App\\Models\\Server::where('uuid','$S')->first()->server_metadata,'transfer.finish.items')) > 0 ? 1 : 0;" | tail -1)" = 1
+check 'B still claimed before its check' test "$(status "$B")" = claimed
+tinker "$B" "(new App\\Jobs\\ServerConnectionCheckJob(App\\Models\\Server::where('uuid','$S')->first()))->handle();" >/dev/null
+check 'B released the server after its check' test "$(status "$B")" = transferred
+check 'B is force disabled' test "$(tinker "$B" "echo (int) App\\Models\\Server::where('uuid','$S')->first()->settings->force_disabled;" | tail -1)" = 1
+tinker "$A" "(new App\\Jobs\\ServerConnectionCheckJob(App\\Models\\Server::where('uuid','$S')->first()))->handle();" >/dev/null
+check 'A keeps the server after its own check' test "$(status "$A")" = claimed
+
+echo '=== 5. Delete the archive on B (records only)'
+tinker "$B" "$login_php Livewire\\Livewire::test(App\\Livewire\\Server\\Delete::class, ['server_uuid'=>'$S'])->call('delete','password');" >/dev/null
+for _ in $(seq 1 20); do sleep 3; [[ "$(status "$B")" == none ]] && break; done
+check 'archive is gone on B' test "$(status "$B")" = none
+check 'workloads unchanged at the end' test "$(workloads "$PROFILE")" = "$before"
+
+echo "=== $FAILS failure(s)"
+exit "$FAILS"
diff --git a/scripts/transfer-test/seed-extras.php b/scripts/transfer-test/seed-extras.php
new file mode 100644
index 0000000000..11b6a85fde
--- /dev/null
+++ b/scripts/transfer-test/seed-extras.php
@@ -0,0 +1,92 @@
+<?php
+
+// Fake records on the source (A) around development-qemu-debian-root, for extras-e2e.sh.
+// Fake credentials are enough: the test checks that the records move, not that the providers accept them.
+
+use App\Models\Application;
+use App\Models\DnsProviderZone;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\ResourceLink;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneMariadb;
+use App\Services\ProjectIconStorageService;
+
+$quiet = function (string $class, array $attributes) {
+    $model = new $class;
+    $model->forceFill(['uuid' => new_public_id(), ...$attributes])->saveQuietly();
+
+    return $model;
+};
+
+$server = Server::where('uuid', 'development-qemu-debian-root')->firstOrFail();
+$teamId = $server->team_id;
+$app = Application::where('name', 'whoami-2')->firstOrFail();
+$db = StandaloneMariadb::where('name', 'mariadb')->firstOrFail();
+$environment = $app->environment;
+$project = $environment->project;
+
+// Team credentials
+$cloudflare = $quiet(IntegrationToken::class, ['team_id' => $teamId, 'provider' => 'cloudflare', 'name' => 'fake-cloudflare', 'token' => 'fake-cf-token', 'capabilities' => ['dns', 'tunnel']]);
+$infisical = $quiet(IntegrationToken::class, ['team_id' => $teamId, 'provider' => 'infisical', 'name' => 'fake-infisical', 'token' => 'fake-inf-token', 'capabilities' => ['secrets'], 'metadata' => ['client_id' => 'fake-client']]);
+
+// DNS zone + owned record used only by whoami-2
+$zone = $quiet(DnsProviderZone::class, ['integration_token_id' => $cloudflare->id, 'provider_zone_id' => 'fake-zone-id', 'name' => 'example.test', 'account_id' => 'fake-account', 'account_name' => 'Fake']);
+$record = $quiet(ManagedDnsRecord::class, ['team_id' => $teamId, 'integration_token_id' => $cloudflare->id, 'dns_provider_zone_id' => $zone->id, 'provider_record_id' => 'fake-record-id', 'type' => 'A', 'name' => 'whoami2.example.test', 'content' => $server->ip, 'owned' => true]);
+$record->addReference($app);
+
+// Secret manager link
+$quiet(SecretManagerLink::class, ['resourceable_type' => $app->getMorphClass(), 'resourceable_id' => $app->id, 'integration_token_id' => $infisical->id, 'settings' => ['project_id' => 'fake-project', 'environment' => 'prod', 'secret_path' => '/']]);
+
+// Server: Cloudflare tunnel token + custom proxy error page
+$server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $cloudflare->id, 'cloudflare_tunnel_id' => 'fake-tunnel', 'cloudflare_tunnel_account_id' => 'fake-account'])->saveQuietly();
+$server->forceFill(['proxy_error_page' => '<h1>fake error page</h1>'])->saveQuietly();
+
+// GitHub App + runner config (enabled) + one idle runner
+$githubApp = $quiet(GithubApp::class, ['name' => 'fake-gh-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'organization' => 'fake-org', 'app_id' => 123, 'installation_id' => 456, 'client_id' => 'fake-client', 'client_secret' => 'fake-secret', 'webhook_secret' => 'fake-webhook', 'is_system_wide' => false, 'is_public' => false, 'team_id' => $teamId, 'private_key_id' => $server->private_key_id]);
+$runnerConfig = $quiet(GithubRunnerConfig::class, ['server_id' => $server->id, 'github_app_id' => $githubApp->id, 'labels' => ['fake-label'], 'is_enabled' => true, 'max_runners' => 2]);
+$quiet(GithubRunnerExecution::class, ['github_app_id' => $githubApp->id, 'github_runner_config_id' => $runnerConfig->id, 'server_id' => $server->id, 'status' => 'idle', 'trigger_workflow_job_id' => 1, 'runner_name' => 'coolify-runner-fake', 'runner_id' => 99, 'labels' => ['fake-label']]);
+
+// A resource of the same project on the OTHER server: same environment (link that stays) and a staging environment
+$ubuntu = Server::where('uuid', 'development-qemu-ubuntu-non-root')->firstOrFail();
+$ubuntuDestination = StandaloneDocker::where('server_id', $ubuntu->id)->firstOrFail();
+$onUbuntu = fn (Environment $env, string $name) => Application::create([
+    'name' => $name, 'environment_id' => $env->id, 'destination_id' => $ubuntuDestination->id, 'destination_type' => $ubuntuDestination->getMorphClass(),
+    'build_pack' => 'dockerimage', 'docker_registry_image_name' => 'traefik/whoami', 'docker_registry_image_tag' => 'latest', 'ports_exposes' => '80',
+    'git_repository' => 'coollabsio/coolify', 'git_branch' => 'main',
+]);
+$otherServerApp = $onUbuntu($environment, 'fake-on-ubuntu');
+$staging = Environment::firstOrCreate(['project_id' => $project->id, 'name' => 'fake-staging']);
+$onUbuntu($staging, 'fake-staging-on-ubuntu');
+
+// Resource links: one between two resources of this server, one to the other server
+$quiet(ResourceLink::class, ['environment_id' => $environment->id, 'source_type' => $app->getMorphClass(), 'source_id' => $app->id, 'target_type' => $db->getMorphClass(), 'target_id' => $db->id, 'label' => 'uses db']);
+$quiet(ResourceLink::class, ['environment_id' => $environment->id, 'source_type' => $app->getMorphClass(), 'source_id' => $app->id, 'target_type' => $otherServerApp->getMorphClass(), 'target_id' => $otherServerApp->id, 'label' => 'calls other']);
+
+// Canvas positions, team shared variable used by an app variable, maintenance mode
+$environment->forceFill(['canvas_positions' => [$app->uuid => ['x' => 111, 'y' => 222], $db->uuid => ['x' => 333, 'y' => 444]]])->saveQuietly();
+SharedEnvironmentVariable::create(['type' => 'team', 'team_id' => $teamId, 'key' => 'FAKE_TEAM_VAR', 'value' => 'team-value']);
+EnvironmentVariable::create(['key' => 'USES_TEAM', 'value' => '{{team.FAKE_TEAM_VAR}}', 'resourceable_type' => $app->getMorphClass(), 'resourceable_id' => $app->id]);
+$app->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>fake maintenance</h1>'])->saveQuietly();
+
+// A git application that uses a system-wide GitHub App, which the transfer does not move
+$systemApp = $quiet(GithubApp::class, ['name' => 'fake-system-wide-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true, 'is_public' => false]);
+$gitApp = new Application;
+$gitApp->forceFill([
+    'uuid' => new_public_id(), 'name' => 'git-shop', 'build_pack' => 'nixpacks', 'git_repository' => 'acme/shop', 'git_branch' => 'main', 'ports_exposes' => '3000',
+    'environment_id' => $environment->id, 'destination_id' => $app->destination_id, 'destination_type' => $app->destination_type,
+    'source_type' => GithubApp::class, 'source_id' => $systemApp->id,
+])->saveQuietly();
+
+// Project icon: a 1x1 JPEG
+app(ProjectIconStorageService::class)->storeProjectContents($project, base64_decode('/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAP//////////////////////////////////////////////////////////////////////////////////////wgALCAABAAEBAREA/8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQABPxA='));
+
+echo "seeded\n";
diff --git a/scripts/seed-transfer-demo.php b/scripts/transfer-test/seed-inventory.php
similarity index 98%
rename from scripts/seed-transfer-demo.php
rename to scripts/transfer-test/seed-inventory.php
index 03c6ae17d2..e8a29020b6 100644
--- a/scripts/seed-transfer-demo.php
+++ b/scripts/transfer-test/seed-inventory.php
@@ -1,9 +1,10 @@
 <?php
 
 /**
- * Seed a rich transfer-demo inventory on the current Coolify instance.
- * Run: php artisan tinker scripts/seed-transfer-demo.php
- * Or:  ./scripts/dev exec php artisan tinker --execute "require 'scripts/seed-transfer-demo.php';"
+ * Seed a rich transfer-demo inventory on the current Coolify instance, in the database only: a server
+ * "transfer-full-demo" on the testing-host container with many resource types. Nothing is deployed.
+ * For live transfers between two instances, use the other scripts of scripts/transfer-test (see README.md).
+ * Run: ./scripts/dev exec php artisan tinker --execute "require 'scripts/transfer-test/seed-inventory.php';"
  */
 
 use App\Models\Application;
diff --git a/scripts/transfer-test/seed.sh b/scripts/transfer-test/seed.sh
new file mode 100755
index 0000000000..1527c864d5
--- /dev/null
+++ b/scripts/transfer-test/seed.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Create real resources on the two transfer VMs of A through the API, then deploy and start them.
+# Run on a fresh A only (reset.sh calls it); it does not clean up. Writes the uuids to <state>/resources.json.
+source "$(dirname "$0")/lib.sh"
+set -e
+
+T="$(source_token)"
+S1="$(vm_field ubuntu-non-root uuid)"
+S2="$(vm_field debian-root uuid)"
+
+call() { # call METHOD PATH [JSON]: fails on an HTTP error
+  local out code
+  out="$(curl -sS -X "$1" "http://127.0.0.1:$A_PORT/api/v1$2" -H "Authorization: Bearer $T" -H 'Content-Type: application/json' -H 'Accept: application/json' ${3:+-d "$3"} -w $'\n%{http_code}')"
+  code="${out##*$'\n'}"
+  out="${out%$'\n'*}"
+  if [[ "$code" -ge 300 ]]; then
+    echo "FAIL $1 $2 ($code): $out" >&2
+    return 1
+  fi
+  echo "$out"
+}
+uuid() { jq -r '.uuid'; }
+
+echo '== projects'
+P1=$(call POST /projects '{"name":"Transfer Demo","description":"Resources on the ubuntu non-root VM"}' | uuid)
+P2=$(call POST /projects '{"name":"Second Server","description":"Resources on the debian root VM"}' | uuid)
+call POST "/projects/$P1/environments" '{"name":"staging"}' >/dev/null
+
+echo '== server 1 (ubuntu non-root): Docker image app with variables, volume, tag, scheduled task'
+APP1=$(call POST /applications/dockerimage "$(jq -nc --arg p "$P1" --arg s "$S1" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"whoami",docker_registry_image_name:"traefik/whoami",docker_registry_image_tag:"latest",ports_exposes:"80",instant_deploy:false}')" | uuid)
+call POST "/applications/$APP1/envs" '{"key":"WHOAMI_NAME","value":"transfer-demo"}' >/dev/null
+call POST "/applications/$APP1/envs" '{"key":"APP_SECRET","value":"very-secret-value"}' >/dev/null
+call POST "/applications/$APP1/storages" '{"type":"persistent","name":"whoami-data","mount_path":"/data"}' >/dev/null || true
+call POST "/applications/$APP1/tags" '{"tag_name":"transfer-demo"}' >/dev/null || true
+call POST "/applications/$APP1/scheduled-tasks" '{"name":"hello","command":"echo hello","frequency":"*/30 * * * *"}' >/dev/null || true
+
+echo '== server 1: Dockerfile app (staging)'
+DF=$(printf 'FROM nginx:alpine\nRUN echo "built by Coolify A" > /usr/share/nginx/html/index.html\nEXPOSE 80\n' | base64 -w0)
+APP2=$(call POST /applications/dockerfile "$(jq -nc --arg p "$P1" --arg s "$S1" --arg d "$DF" '{project_uuid:$p,server_uuid:$s,environment_name:"staging",name:"nginx-dockerfile",dockerfile:$d,ports_exposes:"80",instant_deploy:false}')" | uuid)
+
+echo '== server 1: PostgreSQL with a backup, Redis'
+PG=$(call POST /databases/postgresql "$(jq -nc --arg p "$P1" --arg s "$S1" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"postgres",postgres_user:"demo",postgres_password:"pg-secret-password",postgres_db:"demo",instant_deploy:false}')" | uuid)
+call POST "/databases/$PG/backups" '{"frequency":"0 3 * * *","enabled":true,"save_s3":false,"databases_to_backup":"demo"}' >/dev/null || true
+RD=$(call POST /databases/redis "$(jq -nc --arg p "$P1" --arg s "$S1" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"redis",instant_deploy:false}')" | uuid)
+
+echo '== server 1: one-click service (uptime-kuma)'
+SV=$(call POST /services "$(jq -nc --arg p "$P1" --arg s "$S1" '{type:"uptime-kuma",project_uuid:$p,server_uuid:$s,environment_name:"production",name:"uptime-kuma",instant_deploy:false}')" | uuid)
+
+echo '== server 2 (debian root): whoami-2, MariaDB'
+APP3=$(call POST /applications/dockerimage "$(jq -nc --arg p "$P2" --arg s "$S2" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"whoami-2",docker_registry_image_name:"traefik/whoami",docker_registry_image_tag:"latest",ports_exposes:"80",instant_deploy:false}')" | uuid)
+MD=$(call POST /databases/mariadb "$(jq -nc --arg p "$P2" --arg s "$S2" '{project_uuid:$p,server_uuid:$s,environment_name:"production",name:"mariadb",instant_deploy:false}')" | uuid)
+
+echo '== deploy and start everything'
+for u in $APP1 $APP2 $APP3; do call POST "/deploy?uuid=$u" >/dev/null && echo "deploy queued $u"; done
+for u in $PG $RD $MD; do call POST "/databases/$u/start" >/dev/null && echo "start queued $u"; done
+call POST "/services/$SV/start" >/dev/null && echo "start queued $SV"
+
+jq -n --arg p1 "$P1" --arg p2 "$P2" --arg app1 "$APP1" --arg app2 "$APP2" --arg app3 "$APP3" --arg pg "$PG" --arg rd "$RD" --arg md "$MD" --arg sv "$SV" \
+  '{projects:[$p1,$p2],apps:[$app1,$app2,$app3],databases:[$pg,$rd,$md],service:$sv}' | tee "$STATE_DIR/resources.json"
diff --git a/scripts/transfer-test/setup.sh b/scripts/transfer-test/setup.sh
new file mode 100755
index 0000000000..55c02fbb96
--- /dev/null
+++ b/scripts/transfer-test/setup.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Prepare the transfer test kit: start the target instance (B) next to the source (A), and let them reach
+# each other and A's VMs. Safe to run again, for example after a host reboot. Linux with KVM only.
+#
+# Usage: scripts/transfer-test/setup.sh    (then scripts/transfer-test/reset.sh)
+source "$(dirname "$0")/lib.sh"
+
+[[ -c /dev/kvm ]] || die 'The kit needs KVM VMs (Linux). See scripts/transfer-test/README.md.'
+running "$A" || die "Start the source instance first: ./scripts/dev start"
+
+echo "== 1. target instance $TARGET (side by side, testing-host as its localhost)"
+# On a new instance, its server seeding can run before the migrations. That does not matter: reset.sh seeds B again.
+COOLIFY_DEV_INSTANCE="$TARGET" COOLIFY_DEV_SIDE_BY_SIDE=1 COOLIFY_DEV_SERVER_BACKEND=testing-host ./scripts/dev start ||
+  echo '  (the seeding of the new instance failed; reset.sh seeds both databases again)'
+running "$B" || die "The target instance $B does not run."
+target_values
+
+echo "== 2. firewall: B may reach the VM network of A (10.221.$A_SLOT.0/24)"
+subnet="$(docker network inspect "$B" --format '{{(index .IPAM.Config 0).Subnet}}')"
+rule=(LIBVIRT_FWI -s "$subnet" -d "10.221.$A_SLOT.0/24" -o "cdevbr$A_SLOT" -j ACCEPT)
+if "${PRIVILEGED[@]}" iptables -C "${rule[@]}" 2>/dev/null; then
+  echo "  rule exists"
+else
+  "${PRIVILEGED[@]}" iptables -I "${rule[0]}" 1 "${rule[@]:1}" && echo "  rule added for $subnet"
+fi
+
+echo "== 3. A and B reach each other's app port"
+bind="$(grep -E '^DEV_BIND_ADDRESS=' .env 2>/dev/null | tail -1 | cut -d= -f2-)"
+if [[ "${bind:-0.0.0.0}" == 127.0.0.1 ]]; then
+  # The ports listen on 127.0.0.1 only; containers reach the host through the docker0 gateway.
+  gateway="$(docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}')"
+  for port in "$A_PORT" "$B_PORT"; do
+    name="coolify-transfer-test-forward-$port"
+    if running "$name"; then
+      echo "  $name runs"
+    else
+      docker rm -f "$name" >/dev/null 2>&1 || true
+      docker run -d --name "$name" --network host --restart unless-stopped alpine/socat \
+        "tcp-listen:$port,bind=$gateway,fork,reuseaddr" "tcp:127.0.0.1:$port" >/dev/null && echo "  $name started ($gateway:$port -> 127.0.0.1:$port)"
+    fi
+  done
+else
+  echo "  not needed: the ports listen on ${bind:-0.0.0.0}"
+fi
+
+echo "Done. A: $A_URL  B: $B_URL"
+echo "Next: scripts/transfer-test/reset.sh"
diff --git a/scripts/transfer-test/verify-extras-source.php b/scripts/transfer-test/verify-extras-source.php
new file mode 100644
index 0000000000..2caeb569c1
--- /dev/null
+++ b/scripts/transfer-test/verify-extras-source.php
@@ -0,0 +1,28 @@
+<?php
+
+// Checks on the source (A) after the debian-root transfer of extras-e2e.sh. Prints PASS/FAIL lines.
+
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\ManagedDnsRecord;
+use App\Models\Server;
+
+$check = function (string $name, bool $ok, string $detail = '') {
+    echo ($ok ? 'PASS ' : 'FAIL ').$name.($detail !== '' ? " ({$detail})" : '')."\n";
+};
+
+$server = Server::where('uuid', 'development-qemu-debian-root')->first();
+$migration = (array) data_get($server?->server_metadata, 'migration');
+$messages = collect($migration['log'] ?? [])->pluck('message');
+$check('source is transferred away', $server?->isTransferredAway() === true);
+$check('transfer succeeded', ($migration['status'] ?? null) === 'succeeded', (string) ($migration['error'] ?? ''));
+$check('precheck NOTE about resources on the other server', $messages->contains(fn ($m) => str_starts_with($m, "NOTE: project 'Second Server' also has 2 resources on other servers")));
+$check('runner config disabled on the source', GithubRunnerConfig::where('server_id', $server?->id)->value('is_enabled') === false);
+$check('runner execution cancelled on the source', GithubRunnerExecution::where('runner_name', 'coolify-runner-fake')->value('status')?->value === 'cancelled');
+$record = ManagedDnsRecord::where('name', 'whoami2.example.test')->first();
+$check('source keeps the DNS record for a take back, not owned', $record !== null && $record->owned === false);
+$check('precheck NOTE about the system-wide GitHub App', $messages->contains(fn ($m) => str_starts_with($m, "NOTE: the system-wide GitHub App 'fake-system-wide-app'")));
+$checklist = implode("\n", (array) ($migration['checklist'] ?? []));
+$check('checklist: GitHub App URLs', str_contains($checklist, 'GitHub App fake-gh-app'));
+$check('checklist: enable GitHub runners', str_contains($checklist, 'enable GitHub runners'));
+echo "--- warnings\n".implode("\n", (array) ($migration['warnings'] ?? []))."\n--- checklist\n{$checklist}\n";
diff --git a/scripts/transfer-test/verify-extras-target.php b/scripts/transfer-test/verify-extras-target.php
new file mode 100644
index 0000000000..b34de610e4
--- /dev/null
+++ b/scripts/transfer-test/verify-extras-target.php
@@ -0,0 +1,69 @@
+<?php
+
+// Checks on the target (B) after the debian-root transfer of extras-e2e.sh. Prints PASS/FAIL lines.
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\ResourceLink;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneMariadb;
+use App\Services\ProjectIconStorageService;
+
+$check = function (string $name, bool $ok, string $detail = '') {
+    echo ($ok ? 'PASS ' : 'FAIL ').$name.($detail !== '' ? " ({$detail})" : '')."\n";
+};
+
+$server = Server::where('uuid', 'development-qemu-debian-root')->first();
+$check('server is on B and claimed', data_get($server?->server_metadata, 'transfer.status') === 'claimed');
+$check('custom proxy error page', $server?->proxy_error_page === '<h1>fake error page</h1>');
+
+$cloudflare = IntegrationToken::where('name', 'fake-cloudflare')->first();
+$infisical = IntegrationToken::where('name', 'fake-infisical')->first();
+$check('Cloudflare token moved with its secret', $cloudflare?->token === 'fake-cf-token');
+$check('Infisical token moved with its secret', $infisical?->token === 'fake-inf-token');
+$check('Cloudflare tunnel uses the moved token', $server?->settings?->cloudflare_tunnel_integration_token_id === $cloudflare?->id && $server?->settings?->cloudflare_tunnel_id === 'fake-tunnel');
+
+$app = Application::where('name', 'whoami-2')->first();
+$link = SecretManagerLink::where('resourceable_type', $app?->getMorphClass())->where('resourceable_id', $app?->id)->first();
+$check('secret manager link moved to the moved token', $link?->integration_token_id === $infisical?->id && data_get($link?->settings, 'project_id') === 'fake-project');
+
+$record = ManagedDnsRecord::where('name', 'whoami2.example.test')->first();
+$check('DNS record + zone moved', $record !== null && $record->zone?->provider_zone_id === 'fake-zone-id' && $record->integration_token_id === $cloudflare?->id);
+$check('DNS record references the moved app', $record?->references()->where('resource_type', $app?->getMorphClass())->where('resource_id', $app?->id)->exists() === true);
+// Same app.id on both instances: the owner comment does not change, so the record stays owned.
+// Different app.id: the target must change the comment at Cloudflare, which fails with a fake token.
+$sourceAppId = trim((string) @file_get_contents('/tmp/source-app-id'));
+$sameInstanceId = $sourceAppId === (string) config('app.id');
+$check('DNS ownership '.($sameInstanceId ? 'kept (same instance ID, no adoption needed)' : 'dropped (fake token cannot adopt)'), $record?->owned === $sameInstanceId);
+
+$githubApp = GithubApp::where('name', 'fake-gh-app')->first();
+$runner = GithubRunnerConfig::where('server_id', $server?->id)->first();
+$check('GitHub App moved (only the runner config uses it)', $githubApp !== null && $githubApp->organization === 'fake-org');
+$check('runner config moved, DISABLED, same App and labels', $runner !== null && $runner->is_enabled === false && $runner->github_app_id === $githubApp?->id && in_array('fake-label', (array) $runner->labels, true));
+
+$db = StandaloneMariadb::where('name', 'mariadb')->first();
+$check('resource link between the two moved resources', ResourceLink::where('source_id', $app?->id)->where('target_type', $db?->getMorphClass())->where('target_id', $db?->id)->where('label', 'uses db')->exists());
+$check('resource link to the other server is not moved', ! ResourceLink::where('label', 'calls other')->exists());
+
+$environment = $app?->environment;
+$check('canvas positions moved', data_get($environment?->canvas_positions, ($app?->uuid).'.x') === 111);
+$check('environment without resources on this server is not moved', ! Environment::where('name', 'fake-staging')->exists());
+$check('apps on the other server are not moved', ! Application::whereIn('name', ['fake-on-ubuntu', 'fake-staging-on-ubuntu'])->exists());
+
+$check('team shared variable created', SharedEnvironmentVariable::where('type', 'team')->where('key', 'FAKE_TEAM_VAR')->value('value') === 'team-value');
+$check('app variable that uses it moved', $app?->environment_variables()->where('key', 'USES_TEAM')->value('value') === '{{team.FAKE_TEAM_VAR}}');
+$check('maintenance mode moved', $app?->is_maintenance_enabled === true && $app?->maintenance_page === '<h1>fake maintenance</h1>');
+
+$gitShop = Application::where('name', 'git-shop')->first();
+$check('git-shop moved without its system-wide source', $gitShop !== null && $gitShop->source_id === null);
+$check('finish list has a git source step for git-shop', collect(data_get($server?->server_metadata, 'transfer.finish.items'))->contains('key', 'git_source:'.$gitShop?->uuid));
+
+$project = $environment?->project;
+$icon = $project ? app(ProjectIconStorageService::class)->projectContents($project) : null;
+$check('project icon moved', $icon !== null && str_starts_with($icon, "\xFF\xD8\xFF"));
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index c2bcabc3f7..1e1e23cadd 100644
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -38,6 +38,65 @@ write_status() {
     echo "${step}|${message}|$(date -Iseconds)" > "$STATUS_FILE"
 }
 
+# Print the first gateway of a network that Docker reports with a prefix length (fd00::1/64).
+# Docker Engine 27.0 to 28.0.0 does this for IPv6 until the daemon restarts (https://github.com/moby/moby/pull/49520).
+# The Docker CLI and Compose in the helper image fail on such a network with a ParseAddr error.
+network_gateway_with_prefix() {
+    docker network inspect "$1" --format '{{range .IPAM.Config}}{{.Gateway}} {{end}}' 2>&1 | grep -oE '[0-9A-Fa-f:.]+/[0-9]+' | head -n1
+}
+
+# Make sure the coolify network exists and the helper image can read it.
+# It is created when starting Coolify with docker compose
+ensure_coolify_network() {
+    log "Checking Docker network 'coolify'..."
+    if ! docker network inspect coolify >/dev/null 2>&1; then
+        log "Network 'coolify' does not exist, creating..."
+        if ! docker network create --attachable --ipv6 coolify 2>/dev/null; then
+            log "Failed to create network with IPv6, trying without IPv6..."
+            docker network create --attachable coolify 2>/dev/null
+            log "Network 'coolify' created without IPv6"
+        elif [ -n "$(network_gateway_with_prefix coolify)" ]; then
+            # No container uses the new network yet, so it is safe to recreate it.
+            log "Docker reports the IPv6 gateway of network 'coolify' with a prefix length, recreating it without IPv6..."
+            docker network rm coolify >/dev/null 2>&1
+            docker network create --attachable coolify 2>/dev/null
+            log "Network 'coolify' created without IPv6"
+        else
+            log "Network 'coolify' created with IPv6 support"
+        fi
+        return 0
+    fi
+
+    log "Network 'coolify' already exists"
+    local gateway
+    gateway=$(network_gateway_with_prefix coolify)
+    if [ -n "$gateway" ]; then
+        local message="Docker Engine $(docker version --format '{{.Server.Version}}' 2>/dev/null) reports the gateway of the 'coolify' network as ${gateway}, which Coolify cannot read (Docker Engine bug, fixed in 28.0.1). Run 'systemctl restart docker' (this restarts all containers) or upgrade Docker Engine, then upgrade Coolify again."
+        log "ERROR: ${message}"
+        write_status "error" "$message"
+        echo "     ERROR: ${message}"
+        return 1
+    fi
+}
+
+# Pull an image. Retry with backoff, because the registry can rate limit many instances that pull at the same time.
+pull_image() {
+    local image="$1"
+    local attempt=1
+    local max_attempts=5
+    local delay=15
+    until docker pull "$image" >>"$LOGFILE" 2>&1; do
+        if [ "$attempt" -ge "$max_attempts" ]; then
+            return 1
+        fi
+        log "Pull of $image failed (attempt $attempt/$max_attempts). Retrying in ${delay}s..."
+        echo "     Pull failed (attempt $attempt/$max_attempts). Retrying in ${delay}s..."
+        sleep "$((delay + RANDOM % 10))"
+        attempt=$((attempt + 1))
+        delay=$((delay * 2))
+    done
+}
+
 echo ""
 echo "=========================================="
 echo "   Coolify Upgrade - ${DATE}"
@@ -159,21 +218,7 @@ fi
 log "Environment variables check complete"
 echo "     Done."
 
-# Make sure coolify network exists
-# It is created when starting Coolify with docker compose
-log "Checking Docker network 'coolify'..."
-if ! docker network inspect coolify >/dev/null 2>&1; then
-    log "Network 'coolify' does not exist, creating..."
-    if ! docker network create --attachable --ipv6 coolify 2>/dev/null; then
-        log "Failed to create network with IPv6, trying without IPv6..."
-        docker network create --attachable coolify 2>/dev/null
-        log "Network 'coolify' created without IPv6"
-    else
-        log "Network 'coolify' created with IPv6 support"
-    fi
-else
-    log "Network 'coolify' already exists"
-fi
+ensure_coolify_network || exit 1
 
 mkdir -p /data/coolify/images/{avatars,project-icons}
 chown -R 9999:root /data/coolify/images
@@ -205,7 +250,7 @@ echo "     This may take a few minutes depending on your connection."
 HELPER_IMAGE="${REGISTRY_URL:-docker.io}/coollabsio/coolify-helper:${LATEST_HELPER_VERSION}"
 echo "     - Pulling $HELPER_IMAGE..."
 log "Pulling image: $HELPER_IMAGE"
-if docker pull "$HELPER_IMAGE" >>"$LOGFILE" 2>&1; then
+if pull_image "$HELPER_IMAGE"; then
     log "Successfully pulled $HELPER_IMAGE"
 else
     log "ERROR: Failed to pull $HELPER_IMAGE"
@@ -220,7 +265,7 @@ for IMAGE in $IMAGES; do
     if [ -n "$IMAGE" ]; then
         echo "     - Pulling $IMAGE..."
         log "Pulling image: $IMAGE"
-        if docker pull "$IMAGE" >>"$LOGFILE" 2>&1; then
+        if pull_image "$IMAGE"; then
             log "Successfully pulled $IMAGE"
         else
             log "ERROR: Failed to pull $IMAGE"
@@ -298,8 +343,16 @@ nohup bash -c "
     fi
 
     log 'Running docker compose up...'
-    docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-docker.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env \${COMPOSE_FILES} up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1
-    log 'Docker compose up completed'
+    if docker run -v /data/coolify/source:/data/coolify/source -v /var/run/docker.sock:/var/run/docker.sock \${DOCKER_CONFIG_MOUNT} --rm \${REGISTRY_URL:-docker.io}/coollabsio/coolify-helper:\${LATEST_HELPER_VERSION} bash -c \"LATEST_IMAGE=\${LATEST_IMAGE} docker compose --env-file /data/coolify/source/.env \${COMPOSE_FILES} up -d --remove-orphans --wait --wait-timeout 60\" >>\"\$LOGFILE\" 2>&1; then
+        log 'Docker compose up completed'
+    elif [ \"\$(docker inspect --format '{{.State.Running}}' coolify 2>/dev/null)\" = 'true' ]; then
+        # A slow first start (for example long migrations) can pass the wait timeout. Coolify is still starting.
+        log 'Docker compose up did not finish waiting, but the coolify container is running'
+    else
+        log 'ERROR: Docker compose up failed and the coolify container is not running'
+        write_status 'error' \"Coolify did not start. Check the upgrade log: \$LOGFILE\"
+        exit 1
+    fi
 
     # Final log entry
     echo '' >>\"\$LOGFILE\"
diff --git a/templates/compose/appflowy.yaml b/templates/compose/appflowy.yaml
index 93ac8fe09b..b5354bd694 100644
--- a/templates/compose/appflowy.yaml
+++ b/templates/compose/appflowy.yaml
@@ -316,13 +316,13 @@ services:
         condition: service_started
 
   minio:
-    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     environment:
       - MINIO_ROOT_USER=${SERVICE_USER_MINIO}
       - MINIO_ROOT_PASSWORD=${SERVICE_PASSWORD_MINIO}
     command: server /data --console-address ":9001"
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      test: ["CMD", "mc", "ready", "local"]
       interval: 30s
       timeout: 20s
       retries: 3
diff --git a/templates/compose/appwrite.yaml b/templates/compose/appwrite.yaml
index c84821dc15..f20cc86649 100644
--- a/templates/compose/appwrite.yaml
+++ b/templates/compose/appwrite.yaml
@@ -3,19 +3,20 @@
 # category: backend
 # tags: backend, backend-as-a-service, platform
 # logo: svgs/appwrite.svg
-# port: 3003
+# port: 80
 
 services:
   appwrite:
-    image: appwrite/appwrite:2.0.0
+    image: appwrite/appwrite:2.5.0
     environment:
       - SERVICE_URL_APPWRITE=/v1
+      - _APP_DNS_EXTERNAL=${_APP_DNS_EXTERNAL}
+      - _APP_ALLOWED_INTERNAL_ADDRESSES=${_APP_ALLOWED_INTERNAL_ADDRESSES}
       - _APP_ENV=${_APP_ENV:-production}
       - _APP_USAGE_STATS=${_APP_USAGE_STATS:-enabled}
       - _APP_USAGE_PASS=$SERVICE_PASSWORD_CLICKHOUSE
       - _APP_CONNECTIONS_DB_USAGE=http://appwrite:$SERVICE_PASSWORD_CLICKHOUSE@appwrite-clickhouse:8123/appwrite
       - _APP_POOL_SIZE_USAGE=${_APP_POOL_SIZE_USAGE:-2}
-      - _APP_EXECUTIONS_DUAL_WRITE=${_APP_EXECUTIONS_DUAL_WRITE:-enabled}
       - _APP_CONNECTIONS_DB_EXECUTIONS=http://appwrite:$SERVICE_PASSWORD_CLICKHOUSE@appwrite-clickhouse:8123/appwrite
       - _APP_POOL_SIZE_EXECUTIONS=${_APP_POOL_SIZE_EXECUTIONS:-2}
       - _APP_MAINTENANCE_RETENTION_USAGE_TTL=${_APP_MAINTENANCE_RETENTION_USAGE_TTL:-180}
@@ -24,7 +25,6 @@ services:
       - _APP_STATS_RESOURCES_INTERVAL=${_APP_STATS_RESOURCES_INTERVAL:-3600}
       - _APP_EDITION=${_APP_EDITION:-self-hosted}
       - _APP_WORKER_PER_CORE=${_APP_WORKER_PER_CORE:-6}
-      - _APP_POOL_ADAPTER=${_APP_POOL_ADAPTER:-stack}
       - _APP_LOCALE=${_APP_LOCALE:-en}
       - _APP_COMPRESSION_ENABLED=${_APP_COMPRESSION_ENABLED:-enabled}
       - _APP_COMPRESSION_MIN_SIZE_BYTES=${_APP_COMPRESSION_MIN_SIZE_BYTES}
@@ -51,14 +51,14 @@ services:
       - _APP_OPTIONS_ABUSE=${_APP_OPTIONS_ABUSE:-enabled}
       - _APP_OPTIONS_ABUSE_INCREASED_LIMIT_PROJECTS=${_APP_OPTIONS_ABUSE_INCREASED_LIMIT_PROJECTS}
       - _APP_OPTIONS_ROUTER_PROTECTION=${_APP_OPTIONS_ROUTER_PROTECTION:-disabled}
-      - _APP_OPTIONS_FORCE_HTTPS=${_APP_OPTIONS_FORCE_HTTPS:-enabled}
+      - _APP_OPTIONS_FORCE_HTTPS=${_APP_OPTIONS_FORCE_HTTPS:-disabled}
       - _APP_OPTIONS_ROUTER_FORCE_HTTPS=${_APP_OPTIONS_ROUTER_FORCE_HTTPS:-disabled}
       - _APP_ROUTER_AUTO_CERTIFICATES=${_APP_ROUTER_AUTO_CERTIFICATES:-disabled}
       - _APP_OPENSSL_KEY_V1=$SERVICE_PASSWORD_64_APPWRITE
       - _APP_NOTIFICATIONS_TRACKING_SECRET=$SERVICE_PASSWORD_64_NOTIFICATIONS
       - _APP_DOMAIN=${_APP_DOMAIN:-$SERVICE_FQDN_APPWRITE}
       - _APP_CONSOLE_DOMAIN=${_APP_CONSOLE_DOMAIN}
-      - _APP_CONSOLE_URL_SCHEME=root
+      - _APP_CONSOLE_URL=${_APP_CONSOLE_URL}
       - _APP_CONSOLE_TRUSTED_PROJECTS=${_APP_CONSOLE_TRUSTED_PROJECTS}
       - _APP_DOMAIN_TARGET_CNAME=${_APP_DOMAIN_TARGET_CNAME:-localhost}
       - _APP_DOMAIN_TARGET_AAAA=${_APP_DOMAIN_TARGET_AAAA:-::1}
@@ -97,6 +97,7 @@ services:
       - _APP_SMTP_PASSWORD=${_APP_SMTP_PASSWORD}
       - _APP_STORAGE_LIMIT=${_APP_STORAGE_LIMIT:-30000000}
       - _APP_STORAGE_PREVIEW_LIMIT=${_APP_STORAGE_PREVIEW_LIMIT:-20000000}
+      - _APP_AUTOGRAVITY_HOST=${_APP_AUTOGRAVITY_HOST}
       - _APP_STORAGE_ANTIVIRUS=${_APP_STORAGE_ANTIVIRUS:-disabled}
       - _APP_STORAGE_ANTIVIRUS_HOST=${_APP_STORAGE_ANTIVIRUS_HOST}
       - _APP_STORAGE_ANTIVIRUS_PORT=${_APP_STORAGE_ANTIVIRUS_PORT:-3310}
@@ -123,6 +124,7 @@ services:
       - _APP_STORAGE_WASABI_REGION=${_APP_STORAGE_WASABI_REGION:-eu-central-1}
       - _APP_STORAGE_WASABI_BUCKET=${_APP_STORAGE_WASABI_BUCKET}
       - _APP_COMPUTE_SIZE_LIMIT=${_APP_COMPUTE_SIZE_LIMIT:-30000000}
+      - _APP_COMPUTE_BUILD_SIZE_LIMIT=${_APP_COMPUTE_BUILD_SIZE_LIMIT:-2000000000}
       - _APP_FUNCTIONS_TIMEOUT=${_APP_FUNCTIONS_TIMEOUT:-900}
       - _APP_SITES_TIMEOUT=${_APP_SITES_TIMEOUT:-900}
       - _APP_COMPUTE_BUILD_TIMEOUT=${_APP_COMPUTE_BUILD_TIMEOUT:-2700}
@@ -146,7 +148,6 @@ services:
       - _APP_MAINTENANCE_RETENTION_ABUSE=${_APP_MAINTENANCE_RETENTION_ABUSE:-86400}
       - _APP_MAINTENANCE_RETENTION_AUDIT=${_APP_MAINTENANCE_RETENTION_AUDIT:-1209600}
       - _APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE=${_APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE}
-      - _APP_MAINTENANCE_RETENTION_USAGE_HOURLY=${_APP_MAINTENANCE_RETENTION_USAGE_HOURLY:-8640000}
       - _APP_MAINTENANCE_RETENTION_SCHEDULES=${_APP_MAINTENANCE_RETENTION_SCHEDULES:-86400}
       - _APP_SMS_PROVIDER=${_APP_SMS_PROVIDER}
       - _APP_SMS_FROM=${_APP_SMS_FROM}
@@ -177,18 +178,17 @@ services:
       - _APP_VCS_WEBHOOK_URL=${_APP_VCS_WEBHOOK_URL}
       - _APP_MIGRATIONS_FIREBASE_CLIENT_ID=${_APP_MIGRATIONS_FIREBASE_CLIENT_ID}
       - _APP_MIGRATIONS_FIREBASE_CLIENT_SECRET=${_APP_MIGRATIONS_FIREBASE_CLIENT_SECRET}
-      - _APP_ASSISTANT_OPENAI_API_KEY=${_APP_ASSISTANT_OPENAI_API_KEY}
       - _APP_CONSOLE_COUNTRIES_DENYLIST=${_APP_CONSOLE_COUNTRIES_DENYLIST}
-      - _APP_EXPERIMENT_LOGGING_PROVIDER=${_APP_EXPERIMENT_LOGGING_PROVIDER}
-      - _APP_EXPERIMENT_LOGGING_CONFIG=${_APP_EXPERIMENT_LOGGING_CONFIG}
       - _APP_DATABASE_SHARED_TABLES=${_APP_DATABASE_SHARED_TABLES}
       - _APP_DATABASE_SHARED_NAMESPACE=${_APP_DATABASE_SHARED_NAMESPACE}
       - _APP_FUNCTIONS_CREATION_ABUSE_LIMIT=${_APP_FUNCTIONS_CREATION_ABUSE_LIMIT}
       - _APP_CUSTOM_DOMAIN_DENY_LIST=${_APP_CUSTOM_DOMAIN_DENY_LIST:-example.com,test.com,app.example.com}
       - _APP_TRUSTED_HEADERS=${_APP_TRUSTED_HEADERS:-x-forwarded-for}
+      - _APP_TRUSTED_PROXIES=${_APP_TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16}
       - _APP_MIGRATION_HOST=${_APP_MIGRATION_HOST:-appwrite}
       - _APP_GEO_SECRET=$SERVICE_PASSWORD_64_GEO
       - _APP_GEO_ENDPOINT=${_APP_GEO_ENDPOINT:-http://appwrite-geo/v1}
+      - _APP_PWNED_PASSWORDS_DSN=${_APP_PWNED_PASSWORDS_DSN:-none://localhost}
       - _APP_LIMIT_DATABASE_BATCH=${_APP_LIMIT_DATABASE_BATCH:-100}
       - _APP_DOCUMENTSDB=${_APP_DOCUMENTSDB:-disabled}
       - _APP_VECTORSDB=${_APP_VECTORSDB:-disabled}
@@ -219,12 +219,12 @@ services:
       start_period: 120s
 
   appwrite-console:
-    image: appwrite/new:1.1.16
+    image: appwrite/new:1.2.74-self-hosted
     environment:
       - SERVICE_URL_APPWRITE_3000=/
       - VITE_CONSOLE_PROFILE=self-hosted
+      - VITE_APPWRITE_VERSION=2.5.0
       - APPWRITE_ENDPOINT_SAME_ORIGIN=true
-      - VITE_GROWTH_ENDPOINT=${VITE_GROWTH_ENDPOINT:-https://growth.appwrite.io/v1}
     depends_on:
       appwrite:
         condition: service_healthy
@@ -235,7 +235,7 @@ services:
       retries: 3
 
   appwrite-realtime:
-    image: appwrite/appwrite:2.0.0
+    image: appwrite/appwrite:2.5.0
     entrypoint: realtime
     environment:
       - SERVICE_URL_APPWRITE=/v1/realtime
@@ -248,6 +248,8 @@ services:
       - _APP_CONSOLE_HOSTNAMES=${_APP_CONSOLE_HOSTNAMES}
       - _APP_REALTIME_TAIL_RATE=${_APP_REALTIME_TAIL_RATE:-50}
       - _APP_OPENSSL_KEY_V1=$SERVICE_PASSWORD_64_APPWRITE
+      - _APP_TRUSTED_HEADERS=${_APP_TRUSTED_HEADERS:-x-forwarded-for}
+      - _APP_TRUSTED_PROXIES=${_APP_TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16}
       - _APP_REDIS_HOST=${_APP_REDIS_HOST:-appwrite-redis}
       - _APP_REDIS_PORT=${_APP_REDIS_PORT:-6379}
       - _APP_REDIS_USER=${_APP_REDIS_USER}
@@ -274,13 +276,11 @@ services:
       - _APP_CONNECTIONS_DATABASE_VECTORSDB=${_APP_CONNECTIONS_DATABASE_VECTORSDB}
       - _APP_LOGGING_CONFIG=${_APP_LOGGING_CONFIG}
       - _APP_LOGGING_FORMAT=${_APP_LOGGING_FORMAT:-pretty}
-      - _APP_LOGGING_CONFIG_REALTIME=${_APP_LOGGING_CONFIG_REALTIME}
       - _APP_DATABASE_SHARED_TABLES=${_APP_DATABASE_SHARED_TABLES}
       - _APP_LIMIT_DATABASE_BATCH=${_APP_LIMIT_DATABASE_BATCH:-100}
       - _APP_DOCUMENTSDB=${_APP_DOCUMENTSDB:-disabled}
       - _APP_VECTORSDB=${_APP_VECTORSDB:-disabled}
       - _APP_EMBEDDING=${_APP_EMBEDDING:-disabled}
-      - _APP_POOL_ADAPTER=swoole
     depends_on:
       appwrite-postgresql:
         condition: service_healthy
@@ -293,15 +293,16 @@ services:
       retries: 3
 
   appwrite-worker:
-    image: appwrite/appwrite:2.0.0
+    image: appwrite/appwrite:2.5.0
     entrypoint: worker
     environment:
       - _APP_ENV=${_APP_ENV:-production}
+      - _APP_DNS_EXTERNAL=${_APP_DNS_EXTERNAL}
+      - _APP_ALLOWED_INTERNAL_ADDRESSES=${_APP_ALLOWED_INTERNAL_ADDRESSES}
       - _APP_USAGE_STATS=${_APP_USAGE_STATS:-enabled}
       - _APP_USAGE_PASS=$SERVICE_PASSWORD_CLICKHOUSE
       - _APP_CONNECTIONS_DB_USAGE=http://appwrite:$SERVICE_PASSWORD_CLICKHOUSE@appwrite-clickhouse:8123/appwrite
       - _APP_POOL_SIZE_USAGE=${_APP_POOL_SIZE_USAGE:-2}
-      - _APP_EXECUTIONS_DUAL_WRITE=${_APP_EXECUTIONS_DUAL_WRITE:-enabled}
       - _APP_CONNECTIONS_DB_EXECUTIONS=http://appwrite:$SERVICE_PASSWORD_CLICKHOUSE@appwrite-clickhouse:8123/appwrite
       - _APP_POOL_SIZE_EXECUTIONS=${_APP_POOL_SIZE_EXECUTIONS:-2}
       - _APP_MAINTENANCE_RETENTION_USAGE_TTL=${_APP_MAINTENANCE_RETENTION_USAGE_TTL:-180}
@@ -311,7 +312,6 @@ services:
       - _APP_WORKERS_NUM=1
       - _APP_WORKER_MAX_COROUTINES=78
       - _APP_WORKER_PER_CORE=${_APP_WORKER_PER_CORE:-6}
-      - _APP_POOL_ADAPTER=${_APP_POOL_ADAPTER:-stack}
       - _APP_OPENSSL_KEY_V1=$SERVICE_PASSWORD_64_APPWRITE
       - _APP_EMAIL_SECURITY=${_APP_EMAIL_SECURITY:-security@appwrite.io}
       - _APP_EMAIL_CERTIFICATES=${_APP_EMAIL_CERTIFICATES}
@@ -341,10 +341,9 @@ services:
       - _APP_REDIS_PASS=${_APP_REDIS_PASS}
       - _APP_LOGGING_CONFIG=${_APP_LOGGING_CONFIG}
       - _APP_LOGGING_FORMAT=${_APP_LOGGING_FORMAT:-pretty}
-      - _APP_LOGGING_PROVIDER=${_APP_LOGGING_PROVIDER}
       - _APP_QUEUE_NAME=${_APP_QUEUE_NAME}
       - _APP_DATABASE_SHARED_TABLES=${_APP_DATABASE_SHARED_TABLES}
-      - _APP_CONSOLE_URL_SCHEME=root
+      - _APP_CONSOLE_URL=${_APP_CONSOLE_URL}
       - _APP_CONSOLE_DOMAIN=${_APP_CONSOLE_DOMAIN}
       - _APP_CONSOLE_TRUSTED_PROJECTS=${_APP_CONSOLE_TRUSTED_PROJECTS}
       - _APP_DOMAIN=${_APP_DOMAIN:-$SERVICE_FQDN_APPWRITE}
@@ -355,7 +354,7 @@ services:
       - _APP_DNS=${_APP_DNS}
       - _APP_DOMAIN_FUNCTIONS=${_APP_DOMAIN_FUNCTIONS:-functions.$SERVICE_FQDN_APPWRITE}
       - _APP_DOMAIN_SITES=${_APP_DOMAIN_SITES:-sites.$SERVICE_FQDN_APPWRITE}
-      - _APP_OPTIONS_FORCE_HTTPS=${_APP_OPTIONS_FORCE_HTTPS:-enabled}
+      - _APP_OPTIONS_FORCE_HTTPS=${_APP_OPTIONS_FORCE_HTTPS:-disabled}
       - _APP_OPTIONS_ROUTER_FORCE_HTTPS=${_APP_OPTIONS_ROUTER_FORCE_HTTPS:-disabled}
       - _APP_WEBHOOK_MAX_FAILED_ATTEMPTS=${_APP_WEBHOOK_MAX_FAILED_ATTEMPTS:-10}
       - _APP_STORAGE_DEVICE=${_APP_STORAGE_DEVICE:-local}
@@ -391,6 +390,7 @@ services:
       - _APP_COMPUTE_MEMORY=${_APP_COMPUTE_MEMORY:-0}
       - _APP_OPEN_RUNTIMES_NFT=${_APP_OPEN_RUNTIMES_NFT:-enabled}
       - _APP_COMPUTE_SIZE_LIMIT=${_APP_COMPUTE_SIZE_LIMIT:-30000000}
+      - _APP_COMPUTE_BUILD_SIZE_LIMIT=${_APP_COMPUTE_BUILD_SIZE_LIMIT:-2000000000}
       - _APP_VCS_GITHUB_APP_NAME=${_APP_VCS_GITHUB_APP_NAME}
       - _APP_VCS_GITHUB_PRIVATE_KEY=${_APP_VCS_GITHUB_PRIVATE_KEY}
       - _APP_VCS_GITHUB_APP_ID=${_APP_VCS_GITHUB_APP_ID}
@@ -462,7 +462,7 @@ services:
       retries: 3
 
   appwrite-task-scheduler:
-    image: appwrite/appwrite:2.0.0
+    image: appwrite/appwrite:2.5.0
     entrypoint: schedule
     environment:
       - _APP_ENV=${_APP_ENV:-production}
@@ -470,7 +470,6 @@ services:
       - _APP_USAGE_PASS=$SERVICE_PASSWORD_CLICKHOUSE
       - _APP_CONNECTIONS_DB_USAGE=http://appwrite:$SERVICE_PASSWORD_CLICKHOUSE@appwrite-clickhouse:8123/appwrite
       - _APP_POOL_SIZE_USAGE=${_APP_POOL_SIZE_USAGE:-2}
-      - _APP_EXECUTIONS_DUAL_WRITE=${_APP_EXECUTIONS_DUAL_WRITE:-enabled}
       - _APP_CONNECTIONS_DB_EXECUTIONS=http://appwrite:$SERVICE_PASSWORD_CLICKHOUSE@appwrite-clickhouse:8123/appwrite
       - _APP_POOL_SIZE_EXECUTIONS=${_APP_POOL_SIZE_EXECUTIONS:-2}
       - _APP_MAINTENANCE_RETENTION_USAGE_TTL=${_APP_MAINTENANCE_RETENTION_USAGE_TTL:-180}
@@ -480,9 +479,8 @@ services:
       - _APP_LOGGING_FORMAT=${_APP_LOGGING_FORMAT:-pretty}
       - _APP_WORKER_MAX_COROUTINES=8
       - _APP_WORKER_PER_CORE=${_APP_WORKER_PER_CORE:-6}
-      - _APP_POOL_ADAPTER=${_APP_POOL_ADAPTER:-stack}
       - _APP_OPENSSL_KEY_V1=$SERVICE_PASSWORD_64_APPWRITE
-      - _APP_OPTIONS_FORCE_HTTPS=${_APP_OPTIONS_FORCE_HTTPS:-enabled}
+      - _APP_OPTIONS_FORCE_HTTPS=${_APP_OPTIONS_FORCE_HTTPS:-disabled}
       - _APP_DOMAIN=${_APP_DOMAIN:-$SERVICE_FQDN_APPWRITE}
       - _APP_CONSOLE_DOMAIN=${_APP_CONSOLE_DOMAIN}
       - _APP_CONSOLE_SCHEMA=${_APP_CONSOLE_SCHEMA:-appwriteio}
@@ -513,13 +511,12 @@ services:
       retries: 3
 
   appwrite-task-maintenance:
-    image: appwrite/appwrite:2.0.0
+    image: appwrite/appwrite:2.5.0
     entrypoint: maintenance
     environment:
       - _APP_ENV=${_APP_ENV:-production}
       - _APP_LOGGING_FORMAT=${_APP_LOGGING_FORMAT:-pretty}
       - _APP_WORKER_PER_CORE=${_APP_WORKER_PER_CORE:-6}
-      - _APP_POOL_ADAPTER=${_APP_POOL_ADAPTER:-stack}
       - _APP_DOMAIN=${_APP_DOMAIN:-$SERVICE_FQDN_APPWRITE}
       - _APP_DOMAIN_TARGET_CNAME=${_APP_DOMAIN_TARGET_CNAME:-localhost}
       - _APP_DOMAIN_TARGET_AAAA=${_APP_DOMAIN_TARGET_AAAA:-::1}
@@ -546,7 +543,6 @@ services:
       - _APP_MAINTENANCE_RETENTION_ABUSE=${_APP_MAINTENANCE_RETENTION_ABUSE:-86400}
       - _APP_MAINTENANCE_RETENTION_AUDIT=${_APP_MAINTENANCE_RETENTION_AUDIT:-1209600}
       - _APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE=${_APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE}
-      - _APP_MAINTENANCE_RETENTION_USAGE_HOURLY=${_APP_MAINTENANCE_RETENTION_USAGE_HOURLY:-8640000}
       - _APP_MAINTENANCE_RETENTION_SCHEDULES=${_APP_MAINTENANCE_RETENTION_SCHEDULES:-86400}
       - _APP_MAINTENANCE_START_TIME=${_APP_MAINTENANCE_START_TIME}
       - _APP_DATABASE_SHARED_TABLES=${_APP_DATABASE_SHARED_TABLES}
@@ -562,13 +558,12 @@ services:
       retries: 3
 
   appwrite-task-interval:
-    image: appwrite/appwrite:2.0.0
+    image: appwrite/appwrite:2.5.0
     entrypoint: interval
     environment:
       - _APP_ENV=${_APP_ENV:-production}
       - _APP_LOGGING_FORMAT=${_APP_LOGGING_FORMAT:-pretty}
       - _APP_WORKER_PER_CORE=${_APP_WORKER_PER_CORE:-6}
-      - _APP_POOL_ADAPTER=${_APP_POOL_ADAPTER:-stack}
       - _APP_DOMAIN=${_APP_DOMAIN:-$SERVICE_FQDN_APPWRITE}
       - _APP_DOMAIN_TARGET_CNAME=${_APP_DOMAIN_TARGET_CNAME:-localhost}
       - _APP_DOMAIN_TARGET_AAAA=${_APP_DOMAIN_TARGET_AAAA:-::1}
@@ -603,7 +598,7 @@ services:
       retries: 3
 
   appwrite-geo:
-    image: appwrite/geo:0.3.1
+    image: appwrite/geo:0.3.2
     environment:
       - GEO_SECRET=$SERVICE_PASSWORD_64_GEO
     healthcheck:
@@ -613,18 +608,17 @@ services:
       retries: 3
       start_period: 10s
 
-  appwrite-assistant:
-    image: appwrite/assistant:0.8.4
-    environment:
-      - _APP_ASSISTANT_OPENAI_API_KEY=${_APP_ASSISTANT_OPENAI_API_KEY}
-    exclude_from_hc: true
-
   appwrite-browser:
-    image: appwrite/browser:0.3.4
+    image: appwrite/browser:0.3.6
+    environment:
+      - ALLOWED_HOSTS=appwrite
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     exclude_from_hc: true
 
   openruntimes-executor:
-    image: openruntimes/executor:0.29.0
+    image: openruntimes/executor:1.1.2
     hostname: openruntimes-executor
     stop_signal: SIGINT
     environment:
@@ -656,7 +650,7 @@ services:
       start_period: 10s
 
   orchestrator:
-    image: ghcr.io/open-runtimes/orchestrator/orchestrator:2.0.1
+    image: ghcr.io/open-runtimes/orchestrator/orchestrator:2.2.2
     hostname: orchestrator
     user: root
     environment:
@@ -710,8 +704,91 @@ services:
       - CLICKHOUSE_USER=appwrite
       - CLICKHOUSE_PASSWORD=$SERVICE_PASSWORD_CLICKHOUSE
       - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
+      - CLICKHOUSE_ALWAYS_RUN_INITDB_SCRIPTS=1
     volumes:
       - appwrite-clickhouse:/var/lib/clickhouse:rw
+      - type: bind
+        source: ./clickhouse-config.xml
+        target: /etc/clickhouse-server/config.d/appwrite.xml
+        read_only: true
+        content: |
+          <?xml version="1.0"?>
+          <!--
+              Retention for ClickHouse's own system log tables.
+
+              Every <ttl> in the image's config.xml sits inside an XML comment, so these
+              tables keep every row forever, and the metric ones add a row per second
+              whether or not the instance serves traffic. Left alone they outgrow the
+              usage data they sit next to and fill the volume.
+
+              When a window here changes, ClickHouse replaces the table on the next
+              restart and keeps the old one, rows and all, as <log>_<N>.
+              clickhouse-init.sh gives those old tables the same window.
+          -->
+          <clickhouse>
+              <!-- The metric, trace and profile logs sample the server every second whether
+                   or not Appwrite serves traffic, and nothing reads them back, so their
+                   writes and the merges behind them are pure overhead. -->
+              <asynchronous_metric_log remove="1"/>
+              <metric_log remove="1"/>
+              <histogram_metric_log remove="1"/>
+              <query_metric_log remove="1"/>
+              <processors_profile_log remove="1"/>
+              <trace_log remove="1"/>
+              <!-- text_log repeats the server log the container already writes. -->
+              <text_log remove="1"/>
+
+              <!-- Kept for debugging, capped so they cannot fill the volume. -->
+              <asynchronous_insert_log><ttl>event_date + INTERVAL 3 DAY DELETE</ttl></asynchronous_insert_log>
+              <query_log><ttl>event_date + INTERVAL 7 DAY DELETE</ttl></query_log>
+              <query_views_log><ttl>event_date + INTERVAL 7 DAY DELETE</ttl></query_views_log>
+              <query_thread_log><ttl>event_date + INTERVAL 7 DAY DELETE</ttl></query_thread_log>
+              <part_log><ttl>event_date + INTERVAL 7 DAY DELETE</ttl></part_log>
+              <background_schedule_pool_log><ttl>event_date + INTERVAL 7 DAY DELETE</ttl></background_schedule_pool_log>
+
+              <!-- Longer, so it still covers a report that reaches us late. crash_log is
+                   deliberately left alone: it is tiny and worth keeping. -->
+              <error_log><ttl>event_date + INTERVAL 14 DAY DELETE</ttl></error_log>
+          </clickhouse>
+      - type: bind
+        source: ./clickhouse-init.sh
+        target: /docker-entrypoint-initdb.d/clickhouse-init.sh
+        read_only: true
+        content: |
+          #!/bin/bash
+          # The ClickHouse entrypoint sources this file, so a subshell keeps these options out of it.
+          (
+            set -euo pipefail
+
+            client() {
+              clickhouse-client --host 127.0.0.1 --user "$CLICKHOUSE_USER" --password "$CLICKHOUSE_PASSWORD" "$@"
+            }
+
+            # Flushing replaces log tables whose definition changed, keeping each old table as <log>_<N>.
+            client --query 'SYSTEM FLUSH LOGS'
+
+            # Tables left behind never expire on their own: take the TTL of the log that
+            # replaced this one, or a week when the log is no longer written at all.
+            # The named logs must match the ones clickhouse-config.xml removes: a log that
+            # is still written gets replaced on the next restart if its TTL is altered here.
+            client --format TSVRaw <<'SQL' | client --multiquery
+          SELECT concat('ALTER TABLE system.', stale.name, ' MODIFY TTL ', if(active.name = '', 'event_date + INTERVAL 7 DAY DELETE', splitByString(' SETTINGS ', splitByString(' TTL ', active.engine_full)[2])[1]), ';')
+          FROM (
+            SELECT name, splitByChar('_', name)[-1] AS suffix, arrayStringConcat(arrayPopBack(splitByChar('_', name)), '_') AS log
+            FROM system.tables
+            WHERE database = 'system'
+              AND position(engine_full, ' TTL ') = 0
+              AND endsWith(engine, 'MergeTree')
+              AND name IN (SELECT table FROM system.columns WHERE database = 'system' AND name = 'event_date' AND type = 'Date')
+          ) AS stale
+          LEFT JOIN system.tables AS active
+            ON active.database = 'system'
+            AND active.name = stale.log
+            AND position(active.engine_full, ' TTL ') > 0
+          WHERE (endsWith(stale.log, '_log') AND toUInt64OrNull(stale.suffix) IS NOT NULL)
+            OR stale.name IN ('asynchronous_metric_log', 'metric_log', 'histogram_metric_log', 'query_metric_log', 'processors_profile_log', 'trace_log', 'text_log')
+          SQL
+          )
     ulimits:
       nofile:
         soft: 262144
diff --git a/templates/compose/azimutt.yaml b/templates/compose/azimutt.yaml
index 5f7beda85d..a4a40b8042 100644
--- a/templates/compose/azimutt.yaml
+++ b/templates/compose/azimutt.yaml
@@ -22,7 +22,7 @@ services:
       retries: 10
 
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: server /data --console-address ":9001"
     environment:
       - MINIO_SERVER_URL=$MINIO_SERVER_URL
@@ -38,16 +38,16 @@ services:
       retries: 10
 
   createbuckets:
-    image: minio/mc:latest
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     restart: no
     depends_on:
       minio:
         condition: service_healthy
     entrypoint: >
       /bin/sh -c "
-        /usr/bin/mc config host add myminio http://minio:9000 $SERVICE_USER_MINIO $SERVICE_PASSWORD_MINIO;
+        /usr/bin/mc alias set myminio http://minio:9000 $SERVICE_USER_MINIO $SERVICE_PASSWORD_MINIO;
         /usr/bin/mc mb -p myminio/azimutt;
-        /usr/bin/mc policy download myminio/azimutt;
+        /usr/bin/mc anonymous set download myminio/azimutt;
         exit 0;
       "
 
diff --git a/templates/compose/budibase.yaml b/templates/compose/budibase.yaml
index 52c4d84a1a..71a9367a36 100644
--- a/templates/compose/budibase.yaml
+++ b/templates/compose/budibase.yaml
@@ -66,7 +66,7 @@ services:
       start_period: 10s
 
   minio-service:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     volumes:
       - minio_data:/data
     environment:
diff --git a/templates/compose/buzz.yaml b/templates/compose/buzz.yaml
index f65fee9087..6a7763bcc7 100644
--- a/templates/compose/buzz.yaml
+++ b/templates/compose/buzz.yaml
@@ -88,7 +88,7 @@ services:
       start_period: 5s
 
   minio:
-    image: 'minio/minio:RELEASE.2025-09-07T16-13-09Z'
+    image: 'pgsty/silo:RELEASE.2026-10-15T00-00-00Z'
     command: 'server /data --console-address ":9001"'
     environment:
       - MINIO_ROOT_USER=${SERVICE_USER_MINIO}
@@ -98,16 +98,16 @@ services:
     healthcheck:
       test:
         - CMD
-        - curl
-        - '-f'
-        - 'http://127.0.0.1:9000/minio/health/live'
+        - mc
+        - ready
+        - local
       interval: 5s
       timeout: 5s
       retries: 12
       start_period: 10s
 
   minio-init:
-    image: 'minio/mc:RELEASE.2025-08-13T08-35-41Z'
+    image: 'pgsty/silo:RELEASE.2026-10-15T00-00-00Z'
     depends_on:
       minio:
         condition: service_healthy
diff --git a/templates/compose/ente-photos-with-s3.yaml b/templates/compose/ente-photos-with-s3.yaml
index acbf696252..55886b7cb8 100644
--- a/templates/compose/ente-photos-with-s3.yaml
+++ b/templates/compose/ente-photos-with-s3.yaml
@@ -86,7 +86,7 @@ services:
       retries: 5
 
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: 'server /data --console-address ":9001"'
     environment:
       - MINIO_SERVER_URL=$MINIO_SERVER_URL
@@ -102,7 +102,7 @@ services:
       retries: 10
       
   minio-init:
-    image: 'minio/mc:RELEASE.2025-08-13T08-35-41Z' # Released at 2025-08-13T08-35-41Z
+    image: 'pgsty/silo:RELEASE.2026-10-15T00-00-00Z'
     depends_on:
       minio:
         condition: service_started
diff --git a/templates/compose/forgejo-with-mariadb.yaml b/templates/compose/forgejo-with-mariadb.yaml
index d3fced6cae..6e28a0d19c 100644
--- a/templates/compose/forgejo-with-mariadb.yaml
+++ b/templates/compose/forgejo-with-mariadb.yaml
@@ -13,11 +13,14 @@ services:
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
       - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - USER_UID=1000
       - USER_GID=1000
       - FORGEJO__database__DB_TYPE=mysql
       - FORGEJO__database__HOST=mariadb
-      - FORGEJO__database__NAME=${MYSQL_DATABASE-forgejo}
+      - FORGEJO__database__NAME=${MYSQL_DATABASE:-forgejo}
       - FORGEJO__database__USER=$SERVICE_USER_MYSQL
       - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_MYSQL
     volumes:
@@ -25,7 +28,7 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     depends_on:
       mariadb:
         condition: service_healthy
@@ -42,7 +45,7 @@ services:
     environment:
       - MYSQL_USER=${SERVICE_USER_MYSQL}
       - MYSQL_PASSWORD=${SERVICE_PASSWORD_MYSQL}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_DATABASE=${MYSQL_DATABASE:-forgejo}
       - MYSQL_ROOT_PASSWORD=${SERVICE_PASSWORD_MYSQLROOT}
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
diff --git a/templates/compose/forgejo-with-mysql.yaml b/templates/compose/forgejo-with-mysql.yaml
index 0863141363..5c37a88ddb 100644
--- a/templates/compose/forgejo-with-mysql.yaml
+++ b/templates/compose/forgejo-with-mysql.yaml
@@ -13,11 +13,14 @@ services:
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
       - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - USER_UID=1000
       - USER_GID=1000
       - FORGEJO__database__DB_TYPE=mysql
       - FORGEJO__database__HOST=mysql
-      - FORGEJO__database__NAME=${MYSQL_DATABASE-forgejo}
+      - FORGEJO__database__NAME=${MYSQL_DATABASE:-forgejo}
       - FORGEJO__database__USER=$SERVICE_USER_MYSQL
       - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_MYSQL
     volumes:
@@ -25,7 +28,7 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     depends_on:
       mysql:
         condition: service_healthy
@@ -42,7 +45,7 @@ services:
     environment:
       - MYSQL_USER=${SERVICE_USER_MYSQL}
       - MYSQL_PASSWORD=${SERVICE_PASSWORD_MYSQL}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_DATABASE=${MYSQL_DATABASE:-forgejo}
       - MYSQL_ROOT_PASSWORD=${SERVICE_PASSWORD_MYSQLROOT}
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1"]
diff --git a/templates/compose/forgejo-with-postgresql.yaml b/templates/compose/forgejo-with-postgresql.yaml
index dd1abf1eb7..ef7c8107de 100644
--- a/templates/compose/forgejo-with-postgresql.yaml
+++ b/templates/compose/forgejo-with-postgresql.yaml
@@ -13,11 +13,14 @@ services:
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
       - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - USER_UID=1000
       - USER_GID=1000
       - FORGEJO__database__DB_TYPE=postgres
       - FORGEJO__database__HOST=postgresql
-      - FORGEJO__database__NAME=${POSTGRESQL_DATABASE-forgejo}
+      - FORGEJO__database__NAME=${POSTGRESQL_DATABASE:-forgejo}
       - FORGEJO__database__USER=$SERVICE_USER_POSTGRESQL
       - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_POSTGRESQL
     volumes:
@@ -25,7 +28,7 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     depends_on:
       postgresql:
         condition: service_healthy
@@ -42,7 +45,7 @@ services:
     environment:
       - POSTGRES_USER=${SERVICE_USER_POSTGRESQL}
       - POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRESQL}
-      - POSTGRES_DB=${POSTGRESQL_DATABASE}
+      - POSTGRES_DB=${POSTGRESQL_DATABASE:-forgejo}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
       interval: 5s
diff --git a/templates/compose/forgejo-with-runner-with-mariadb.yaml b/templates/compose/forgejo-with-runner-with-mariadb.yaml
index 71f35c3429..839c7687b5 100644
--- a/templates/compose/forgejo-with-runner-with-mariadb.yaml
+++ b/templates/compose/forgejo-with-runner-with-mariadb.yaml
@@ -1,4 +1,3 @@
-# ignore: true
 # documentation: https://forgejo.org/docs
 # slogan: Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.
 # category: git
@@ -13,15 +12,22 @@ services:
       - SERVICE_URL_FORGEJO_3000
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
-      - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
-      - USER_UID=1000
-      - USER_GID=1000
+      - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS:-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - FORGEJO__database__DB_TYPE=mysql
       - FORGEJO__database__HOST=mariadb
-      - FORGEJO__database__NAME=${MYSQL_DATABASE-forgejo}
+      - FORGEJO__database__NAME=${MYSQL_DATABASE:-forgejo}
       - FORGEJO__database__USER=$SERVICE_USER_MYSQL
       - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_MYSQL
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET-0000000000000000000000000000000000000000}
+      - USER_UID=1000
+      - USER_GID=1000
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
+      - FORGEJO__security__INSTALL_LOCK=true
+      - FORGEJO_ADMIN_USER=${SERVICE_USER_ADMIN}
+      - FORGEJO_ADMIN_PASSWORD=${SERVICE_PASSWORD_ADMIN}
+      - FORGEJO_ADMIN_EMAIL=${FORGEJO_ADMIN_EMAIL:-admin@example.com}
       - FORGEJO__repository__ENABLE_PUSH_CREATE_USER=true
       - FORGEJO__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
       - FORGEJO__repository__DEFAULT_REPO_UNITS=repo.code,repo.actions
@@ -30,21 +36,23 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     depends_on:
       mariadb:
         condition: service_healthy
+    # Healthy only after the runner is registered, so the runner starts after it.
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:3000"]
-      interval: 2s
+      test: ["CMD-SHELL", "curl -fs http://127.0.0.1:3000 > /dev/null && test -f /tmp/runner-registered"]
+      interval: 5s
       timeout: 10s
-      retries: 15
+      retries: 30
     command: >-
       bash -c '
-      /bin/s6-svscan /etc/s6 &
-      sleep 10 ;
-      su -c "forgejo forgejo-cli actions register --secret ${RUNNER_SHARED_SECRET}" git ;
-      sleep infinity
+      /usr/bin/s6-svscan /etc/s6 &
+      until su -c "forgejo forgejo-cli actions register --keep-labels --secret $${RUNNER_SHARED_SECRET:0:40}" git ; do sleep 5 ; done ;
+      su -c "forgejo admin user create --admin --username \"$$FORGEJO_ADMIN_USER\" --password \"$$FORGEJO_ADMIN_PASSWORD\" --email \"$$FORGEJO_ADMIN_EMAIL\" --must-change-password=false" git || true ;
+      touch /tmp/runner-registered ;
+      wait
       '
 
   mariadb:
@@ -54,7 +62,7 @@ services:
     environment:
       - MYSQL_USER=${SERVICE_USER_MYSQL}
       - MYSQL_PASSWORD=${SERVICE_PASSWORD_MYSQL}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_DATABASE=${MYSQL_DATABASE:-forgejo}
       - MYSQL_ROOT_PASSWORD=${SERVICE_PASSWORD_MYSQLROOT}
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
@@ -67,56 +75,48 @@ services:
     hostname: docker
     privileged: true
     healthcheck:
-      test: ["CMD", "pgrep", "dockerd"]
+      test: ["CMD", "docker", "-H", "unix:///var/run/docker.sock", "info"]
       interval: 10s
       timeout: 30s
       retries: 10
     environment:
-      DOCKER_TLS_CERTDIR: /certs
-      DOCKER_HOST: docker-in-docker
+      - DOCKER_TLS_CERTDIR=/certs
+      - DOCKER_HOST=docker-in-docker
     volumes:
       - forgejo-did-certs:/certs
 
   runner-register:
-    image: code.forgejo.org/forgejo/runner:3.5.0
+    image: data.forgejo.org/forgejo/runner:13.2.0
     restart: 'no'
-    links:
-      - docker-in-docker
-      - forgejo
+    exclude_from_hc: true
     environment:
-      - DOCKER_HOST=tcp://docker-in-docker:2376
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET}
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
     volumes:
       - forgejo-runner-data:/data
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
-    healthcheck:
-      disable: true
     user: 0:0
     command: >-
       bash -ec '
-      while : ; do
-        forgejo-runner create-runner-file --connect --instance http://forgejo:3000 --name runner --secret ${RUNNER_SHARED_SECRET} && break ;
-        sleep 1 ;
-      done ;
-      sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://node:20-bookworm\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" .runner ;
+      secret=$${RUNNER_SHARED_SECRET:0:40} ;
+      uuid=$$(printf %s "$${secret:0:16}" | od -An -tx1 | tr -d " \n" | sed -E "s/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/") ;
       forgejo-runner generate-config > config.yml ;
+      sed -i -e "s|  labels: \[\]|  labels: [\"docker:docker://node:22-bookworm\", \"ubuntu-latest:docker://catthehacker/ubuntu:act-22.04\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" config.yml ;
       sed -i -e "s|network: .*|network: host|" config.yml ;
       sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://docker:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
       sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
       sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
-      chown -R 1000:1000 /data ;
-      exit 0
+      sed -i -e "s|  connections:|  connections:\n    default:\n      url: http://forgejo:3000\n      uuid: $$uuid\n      token: $$secret|" config.yml ;
+      chown -R 1000:1000 /data
       '
 
   runner:
-    image: code.forgejo.org/forgejo/runner:3.5.0
-    links:
-      - docker-in-docker
-      - forgejo
+    image: data.forgejo.org/forgejo/runner:13.2.0
     depends_on:
+      forgejo:
+        condition: service_healthy
       docker-in-docker:
-        condition: service_started
+        condition: service_healthy
+      runner-register:
+        condition: service_completed_successfully
     environment:
       - DOCKER_HOST=tcp://docker:2376
       - DOCKER_CERT_PATH=/certs/client
@@ -125,14 +125,9 @@ services:
     volumes:
       - forgejo-runner-data:/data
       - forgejo-did-certs:/certs
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
     healthcheck:
       test: ["CMD", "pgrep", "forgejo-runner"]
       interval: 10s
       timeout: 30s
       retries: 10
-    command: >-
-      bash -c '
-      while : ; do test -w .runner && forgejo-runner --config config.yml daemon ; sleep 1 ; done
-      '
+    command: forgejo-runner --config config.yml daemon
diff --git a/templates/compose/forgejo-with-runner-with-mysql.yaml b/templates/compose/forgejo-with-runner-with-mysql.yaml
index 7e5b62a9d2..70be0d20c3 100644
--- a/templates/compose/forgejo-with-runner-with-mysql.yaml
+++ b/templates/compose/forgejo-with-runner-with-mysql.yaml
@@ -1,4 +1,3 @@
-# ignore: true
 # documentation: https://forgejo.org/docs
 # slogan: Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.
 # category: git
@@ -13,15 +12,22 @@ services:
       - SERVICE_URL_FORGEJO_3000
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
-      - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
-      - USER_UID=1000
-      - USER_GID=1000
+      - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS:-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - FORGEJO__database__DB_TYPE=mysql
       - FORGEJO__database__HOST=mysql
-      - FORGEJO__database__NAME=${MYSQL_DATABASE-forgejo}
+      - FORGEJO__database__NAME=${MYSQL_DATABASE:-forgejo}
       - FORGEJO__database__USER=$SERVICE_USER_MYSQL
       - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_MYSQL
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET-0000000000000000000000000000000000000000}
+      - USER_UID=1000
+      - USER_GID=1000
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
+      - FORGEJO__security__INSTALL_LOCK=true
+      - FORGEJO_ADMIN_USER=${SERVICE_USER_ADMIN}
+      - FORGEJO_ADMIN_PASSWORD=${SERVICE_PASSWORD_ADMIN}
+      - FORGEJO_ADMIN_EMAIL=${FORGEJO_ADMIN_EMAIL:-admin@example.com}
       - FORGEJO__repository__ENABLE_PUSH_CREATE_USER=true
       - FORGEJO__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
       - FORGEJO__repository__DEFAULT_REPO_UNITS=repo.code,repo.actions
@@ -30,21 +36,23 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     depends_on:
       mysql:
         condition: service_healthy
+    # Healthy only after the runner is registered, so the runner starts after it.
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:3000"]
-      interval: 2s
+      test: ["CMD-SHELL", "curl -fs http://127.0.0.1:3000 > /dev/null && test -f /tmp/runner-registered"]
+      interval: 5s
       timeout: 10s
-      retries: 15
+      retries: 30
     command: >-
       bash -c '
-      /bin/s6-svscan /etc/s6 &
-      sleep 10 ;
-      su -c "forgejo forgejo-cli actions register --secret ${RUNNER_SHARED_SECRET}" git ;
-      sleep infinity
+      /usr/bin/s6-svscan /etc/s6 &
+      until su -c "forgejo forgejo-cli actions register --keep-labels --secret $${RUNNER_SHARED_SECRET:0:40}" git ; do sleep 5 ; done ;
+      su -c "forgejo admin user create --admin --username \"$$FORGEJO_ADMIN_USER\" --password \"$$FORGEJO_ADMIN_PASSWORD\" --email \"$$FORGEJO_ADMIN_EMAIL\" --must-change-password=false" git || true ;
+      touch /tmp/runner-registered ;
+      wait
       '
 
   mysql:
@@ -54,7 +62,7 @@ services:
     environment:
       - MYSQL_USER=${SERVICE_USER_MYSQL}
       - MYSQL_PASSWORD=${SERVICE_PASSWORD_MYSQL}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_DATABASE=${MYSQL_DATABASE:-forgejo}
       - MYSQL_ROOT_PASSWORD=${SERVICE_PASSWORD_MYSQLROOT}
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -67,56 +75,48 @@ services:
     hostname: docker
     privileged: true
     healthcheck:
-      test: ["CMD", "pgrep", "dockerd"]
+      test: ["CMD", "docker", "-H", "unix:///var/run/docker.sock", "info"]
       interval: 10s
       timeout: 30s
       retries: 10
     environment:
-      DOCKER_TLS_CERTDIR: /certs
-      DOCKER_HOST: docker-in-docker
+      - DOCKER_TLS_CERTDIR=/certs
+      - DOCKER_HOST=docker-in-docker
     volumes:
       - forgejo-did-certs:/certs
 
   runner-register:
-    image: code.forgejo.org/forgejo/runner:3.5.0
+    image: data.forgejo.org/forgejo/runner:13.2.0
     restart: 'no'
-    links:
-      - docker-in-docker
-      - forgejo
+    exclude_from_hc: true
     environment:
-      - DOCKER_HOST=tcp://docker-in-docker:2376
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET}
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
     volumes:
       - forgejo-runner-data:/data
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
-    healthcheck:
-      disable: true
     user: 0:0
     command: >-
       bash -ec '
-      while : ; do
-        forgejo-runner create-runner-file --connect --instance http://forgejo:3000 --name runner --secret ${RUNNER_SHARED_SECRET} && break ;
-        sleep 1 ;
-      done ;
-      sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://node:20-bookworm\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" .runner ;
+      secret=$${RUNNER_SHARED_SECRET:0:40} ;
+      uuid=$$(printf %s "$${secret:0:16}" | od -An -tx1 | tr -d " \n" | sed -E "s/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/") ;
       forgejo-runner generate-config > config.yml ;
+      sed -i -e "s|  labels: \[\]|  labels: [\"docker:docker://node:22-bookworm\", \"ubuntu-latest:docker://catthehacker/ubuntu:act-22.04\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" config.yml ;
       sed -i -e "s|network: .*|network: host|" config.yml ;
       sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://docker:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
       sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
       sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
-      chown -R 1000:1000 /data ;
-      exit 0
+      sed -i -e "s|  connections:|  connections:\n    default:\n      url: http://forgejo:3000\n      uuid: $$uuid\n      token: $$secret|" config.yml ;
+      chown -R 1000:1000 /data
       '
 
   runner:
-    image: code.forgejo.org/forgejo/runner:3.5.0
-    links:
-      - docker-in-docker
-      - forgejo
+    image: data.forgejo.org/forgejo/runner:13.2.0
     depends_on:
+      forgejo:
+        condition: service_healthy
       docker-in-docker:
-        condition: service_started
+        condition: service_healthy
+      runner-register:
+        condition: service_completed_successfully
     environment:
       - DOCKER_HOST=tcp://docker:2376
       - DOCKER_CERT_PATH=/certs/client
@@ -125,14 +125,9 @@ services:
     volumes:
       - forgejo-runner-data:/data
       - forgejo-did-certs:/certs
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
     healthcheck:
       test: ["CMD", "pgrep", "forgejo-runner"]
       interval: 10s
       timeout: 30s
       retries: 10
-    command: >-
-      bash -c '
-      while : ; do test -w .runner && forgejo-runner --config config.yml daemon ; sleep 1 ; done
-      '
+    command: forgejo-runner --config config.yml daemon
diff --git a/templates/compose/forgejo-with-runner-with-postgresql.yaml b/templates/compose/forgejo-with-runner-with-postgresql.yaml
index 1f58b2f296..3ffee45dfc 100644
--- a/templates/compose/forgejo-with-runner-with-postgresql.yaml
+++ b/templates/compose/forgejo-with-runner-with-postgresql.yaml
@@ -1,8 +1,7 @@
-# ignore: true
 # documentation: https://forgejo.org/docs
 # slogan: Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.
 # category: git
-# tags: version control, collaboration, code, hosting, lightweight, runner, postresql, actions, cicd, ci
+# tags: version control, collaboration, code, hosting, lightweight, runner, postgresql, actions, cicd, ci
 # logo: svgs/forgejo.svg
 # port: 3000
 
@@ -13,15 +12,22 @@ services:
       - SERVICE_URL_FORGEJO_3000
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
-      - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
-      - USER_UID=1000
-      - USER_GID=1000
+      - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS:-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - FORGEJO__database__DB_TYPE=postgres
       - FORGEJO__database__HOST=postgresql
-      - FORGEJO__database__NAME=${POSTGRESQL_DATABASE-forgejo}
+      - FORGEJO__database__NAME=${POSTGRESQL_DATABASE:-forgejo}
       - FORGEJO__database__USER=$SERVICE_USER_POSTGRESQL
       - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_POSTGRESQL
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET-0000000000000000000000000000000000000000}
+      - USER_UID=1000
+      - USER_GID=1000
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
+      - FORGEJO__security__INSTALL_LOCK=true
+      - FORGEJO_ADMIN_USER=${SERVICE_USER_ADMIN}
+      - FORGEJO_ADMIN_PASSWORD=${SERVICE_PASSWORD_ADMIN}
+      - FORGEJO_ADMIN_EMAIL=${FORGEJO_ADMIN_EMAIL:-admin@example.com}
       - FORGEJO__repository__ENABLE_PUSH_CREATE_USER=true
       - FORGEJO__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
       - FORGEJO__repository__DEFAULT_REPO_UNITS=repo.code,repo.actions
@@ -30,21 +36,23 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     depends_on:
       postgresql:
         condition: service_healthy
+    # Healthy only after the runner is registered, so the runner starts after it.
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:3000"]
-      interval: 2s
+      test: ["CMD-SHELL", "curl -fs http://127.0.0.1:3000 > /dev/null && test -f /tmp/runner-registered"]
+      interval: 5s
       timeout: 10s
-      retries: 15
+      retries: 30
     command: >-
       bash -c '
-      /bin/s6-svscan /etc/s6 &
-      sleep 10 ;
-      su -c "forgejo forgejo-cli actions register --secret ${RUNNER_SHARED_SECRET}" git ;
-      sleep infinity
+      /usr/bin/s6-svscan /etc/s6 &
+      until su -c "forgejo forgejo-cli actions register --keep-labels --secret $${RUNNER_SHARED_SECRET:0:40}" git ; do sleep 5 ; done ;
+      su -c "forgejo admin user create --admin --username \"$$FORGEJO_ADMIN_USER\" --password \"$$FORGEJO_ADMIN_PASSWORD\" --email \"$$FORGEJO_ADMIN_EMAIL\" --must-change-password=false" git || true ;
+      touch /tmp/runner-registered ;
+      wait
       '
 
   postgresql:
@@ -54,7 +62,7 @@ services:
     environment:
       - POSTGRES_USER=${SERVICE_USER_POSTGRESQL}
       - POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRESQL}
-      - POSTGRES_DB=${POSTGRESQL_DATABASE}
+      - POSTGRES_DB=${POSTGRESQL_DATABASE:-forgejo}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
       interval: 5s
@@ -66,56 +74,48 @@ services:
     hostname: docker
     privileged: true
     healthcheck:
-      test: ["CMD", "pgrep", "dockerd"]
+      test: ["CMD", "docker", "-H", "unix:///var/run/docker.sock", "info"]
       interval: 10s
       timeout: 30s
       retries: 10
     environment:
-      DOCKER_TLS_CERTDIR: /certs
-      DOCKER_HOST: docker-in-docker
+      - DOCKER_TLS_CERTDIR=/certs
+      - DOCKER_HOST=docker-in-docker
     volumes:
       - forgejo-did-certs:/certs
 
   runner-register:
-    image: code.forgejo.org/forgejo/runner:3.5.0
+    image: data.forgejo.org/forgejo/runner:13.2.0
     restart: 'no'
-    links:
-      - docker-in-docker
-      - forgejo
+    exclude_from_hc: true
     environment:
-      - DOCKER_HOST=tcp://docker-in-docker:2376
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET}
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
     volumes:
       - forgejo-runner-data:/data
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
-    healthcheck:
-      disable: true
     user: 0:0
     command: >-
       bash -ec '
-      while : ; do
-        forgejo-runner create-runner-file --connect --instance http://forgejo:3000 --name runner --secret ${RUNNER_SHARED_SECRET} && break ;
-        sleep 1 ;
-      done ;
-      sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://node:20-bookworm\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" .runner ;
+      secret=$${RUNNER_SHARED_SECRET:0:40} ;
+      uuid=$$(printf %s "$${secret:0:16}" | od -An -tx1 | tr -d " \n" | sed -E "s/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/") ;
       forgejo-runner generate-config > config.yml ;
+      sed -i -e "s|  labels: \[\]|  labels: [\"docker:docker://node:22-bookworm\", \"ubuntu-latest:docker://catthehacker/ubuntu:act-22.04\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" config.yml ;
       sed -i -e "s|network: .*|network: host|" config.yml ;
       sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://docker:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
       sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
       sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
-      chown -R 1000:1000 /data ;
-      exit 0
+      sed -i -e "s|  connections:|  connections:\n    default:\n      url: http://forgejo:3000\n      uuid: $$uuid\n      token: $$secret|" config.yml ;
+      chown -R 1000:1000 /data
       '
 
   runner:
-    image: code.forgejo.org/forgejo/runner:3.5.0
-    links:
-      - docker-in-docker
-      - forgejo
+    image: data.forgejo.org/forgejo/runner:13.2.0
     depends_on:
+      forgejo:
+        condition: service_healthy
       docker-in-docker:
-        condition: service_started
+        condition: service_healthy
+      runner-register:
+        condition: service_completed_successfully
     environment:
       - DOCKER_HOST=tcp://docker:2376
       - DOCKER_CERT_PATH=/certs/client
@@ -124,14 +124,9 @@ services:
     volumes:
       - forgejo-runner-data:/data
       - forgejo-did-certs:/certs
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
     healthcheck:
       test: ["CMD", "pgrep", "forgejo-runner"]
       interval: 10s
       timeout: 30s
       retries: 10
-    command: >-
-      bash -c '
-      while : ; do test -w .runner && forgejo-runner --config config.yml daemon ; sleep 1 ; done
-      '
+    command: forgejo-runner --config config.yml daemon
diff --git a/templates/compose/forgejo-with-runner.yaml b/templates/compose/forgejo-with-runner.yaml
index d1f0e45826..8ec666f284 100644
--- a/templates/compose/forgejo-with-runner.yaml
+++ b/templates/compose/forgejo-with-runner.yaml
@@ -1,4 +1,3 @@
-# ignore: true
 # documentation: https://forgejo.org/docs
 # slogan: Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.
 # category: git
@@ -14,9 +13,16 @@ services:
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
       - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS:-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - USER_UID=1000
       - USER_GID=1000
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET-0000000000000000000000000000000000000000}
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
+      - FORGEJO__security__INSTALL_LOCK=true
+      - FORGEJO_ADMIN_USER=${SERVICE_USER_ADMIN}
+      - FORGEJO_ADMIN_PASSWORD=${SERVICE_PASSWORD_ADMIN}
+      - FORGEJO_ADMIN_EMAIL=${FORGEJO_ADMIN_EMAIL:-admin@example.com}
       - FORGEJO__repository__ENABLE_PUSH_CREATE_USER=true
       - FORGEJO__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
       - FORGEJO__repository__DEFAULT_REPO_UNITS=repo.code,repo.actions
@@ -25,18 +31,20 @@ services:
       - forgejo-timezone:/etc/timezone:ro
       - forgejo-localtime:/etc/localtime:ro
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
+    # Healthy only after the runner is registered, so the runner starts after it.
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://127.0.0.1:3000"]
-      interval: 2s
+      test: ["CMD-SHELL", "curl -fs http://127.0.0.1:3000 > /dev/null && test -f /tmp/runner-registered"]
+      interval: 5s
       timeout: 10s
-      retries: 15
+      retries: 30
     command: >-
       bash -c '
-      /bin/s6-svscan /etc/s6 &
-      sleep 10 ;
-      su -c "forgejo forgejo-cli actions register --secret ${RUNNER_SHARED_SECRET}" git ;
-      sleep infinity
+      /usr/bin/s6-svscan /etc/s6 &
+      until su -c "forgejo forgejo-cli actions register --keep-labels --secret $${RUNNER_SHARED_SECRET:0:40}" git ; do sleep 5 ; done ;
+      su -c "forgejo admin user create --admin --username \"$$FORGEJO_ADMIN_USER\" --password \"$$FORGEJO_ADMIN_PASSWORD\" --email \"$$FORGEJO_ADMIN_EMAIL\" --must-change-password=false" git || true ;
+      touch /tmp/runner-registered ;
+      wait
       '
 
   docker-in-docker:
@@ -44,56 +52,48 @@ services:
     hostname: docker
     privileged: true
     healthcheck:
-      test: ["CMD", "pgrep", "dockerd"]
+      test: ["CMD", "docker", "-H", "unix:///var/run/docker.sock", "info"]
       interval: 10s
       timeout: 30s
       retries: 10
     environment:
-      DOCKER_TLS_CERTDIR=/certs
-      DOCKER_HOST=docker-in-docker
+      - DOCKER_TLS_CERTDIR=/certs
+      - DOCKER_HOST=docker-in-docker
     volumes:
       - forgejo-did-certs:/certs
 
   runner-register:
-    image: code.forgejo.org/forgejo/runner:3.5.0
+    image: data.forgejo.org/forgejo/runner:13.2.0
     restart: 'no'
-    links:
-      - docker-in-docker
-      - forgejo
+    exclude_from_hc: true
     environment:
-      - DOCKER_HOST=tcp://docker-in-docker:2376
-      - RUNNER_SHARED_SECRET=${RUNNER_SHARED_SECRET}
+      - RUNNER_SHARED_SECRET=${SERVICE_HEX_64_RUNNER}
     volumes:
       - forgejo-runner-data:/data
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
-    healthcheck:
-      disable: true
     user: 0:0
     command: >-
       bash -ec '
-      while : ; do
-        forgejo-runner create-runner-file --connect --instance ${SERVICE_URL_FORGEJO}:3000 --name runner --secret ${RUNNER_SHARED_SECRET} && break ;
-        sleep 1 ;
-      done ;
-      sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://node:20-bookworm\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" .runner ;
+      secret=$${RUNNER_SHARED_SECRET:0:40} ;
+      uuid=$$(printf %s "$${secret:0:16}" | od -An -tx1 | tr -d " \n" | sed -E "s/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/") ;
       forgejo-runner generate-config > config.yml ;
+      sed -i -e "s|  labels: \[\]|  labels: [\"docker:docker://node:22-bookworm\", \"ubuntu-latest:docker://catthehacker/ubuntu:act-22.04\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" config.yml ;
       sed -i -e "s|network: .*|network: host|" config.yml ;
       sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://docker:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
       sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
       sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
-      chown -R 1000:1000 /data ;
-      exit 0
+      sed -i -e "s|  connections:|  connections:\n    default:\n      url: http://forgejo:3000\n      uuid: $$uuid\n      token: $$secret|" config.yml ;
+      chown -R 1000:1000 /data
       '
 
   runner:
-    image: code.forgejo.org/forgejo/runner:3.5.0
-    links:
-      - docker-in-docker
-      - forgejo
+    image: data.forgejo.org/forgejo/runner:13.2.0
     depends_on:
+      forgejo:
+        condition: service_healthy
       docker-in-docker:
-        condition: service_started
+        condition: service_healthy
+      runner-register:
+        condition: service_completed_successfully
     environment:
       - DOCKER_HOST=tcp://docker:2376
       - DOCKER_CERT_PATH=/certs/client
@@ -102,14 +102,9 @@ services:
     volumes:
       - forgejo-runner-data:/data
       - forgejo-did-certs:/certs
-      - forgejo-timezone:/etc/timezone:ro
-      - forgejo-localtime:/etc/localtime:ro
     healthcheck:
       test: ["CMD", "pgrep", "forgejo-runner"]
       interval: 10s
       timeout: 30s
       retries: 10
-    command: >-
-      bash -c '
-      while : ; do test -w .runner && forgejo-runner --config config.yml daemon ; sleep 1 ; done
-      '
+    command: forgejo-runner --config config.yml daemon
diff --git a/templates/compose/forgejo.yaml b/templates/compose/forgejo.yaml
index 9d84b2aaef..4752a68a8f 100644
--- a/templates/compose/forgejo.yaml
+++ b/templates/compose/forgejo.yaml
@@ -13,10 +13,13 @@ services:
       - FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}
       - FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}
       - FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}
+      - FORGEJO__server__DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_DOMAIN=${SERVICE_FQDN_FORGEJO}
+      - FORGEJO__server__SSH_PORT=${FORGEJO_SSH_PORT:-22222}
       - USER_UID=1000
       - USER_GID=1000
     ports:
-      - 22222:22
+      - ${FORGEJO_SSH_PORT:-22222}:22
     volumes:
       - forgejo-data:/data
       - forgejo-timezone:/etc/timezone:ro
diff --git a/templates/compose/formbricks.yaml b/templates/compose/formbricks.yaml
index 7a24ec2102..197b19be25 100644
--- a/templates/compose/formbricks.yaml
+++ b/templates/compose/formbricks.yaml
@@ -111,7 +111,7 @@ services:
       start_period: 3s
 
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: server /data --console-address ":9001"
     environment:
       - MINIO_SERVER_URL=$MINIO_SERVER_URL
@@ -127,7 +127,7 @@ services:
       retries: 10
       
   minio-init:
-    image: minio/mc:latest
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     depends_on:
       minio:
         condition: service_healthy
diff --git a/templates/compose/hatchet.yaml b/templates/compose/hatchet.yaml
index 597d9dc97a..f3d398674f 100644
--- a/templates/compose/hatchet.yaml
+++ b/templates/compose/hatchet.yaml
@@ -10,8 +10,9 @@ services:
     image: ghcr.io/hatchet-dev/hatchet/hatchet-dashboard:latest
     command: sh ./entrypoint.sh --config /hatchet/config
     environment:
-      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/$POSTGRES_DB
+      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/${POSTGRES_DB:-hatchet}
       - SERVICE_URL_HATCHET_80
+      - SERVER_AUTH_SET_EMAIL_VERIFIED=${SERVER_AUTH_SET_EMAIL_VERIFIED:-true}
       # Default credentials are "admin@example.com" and "Admin123!!"
     depends_on:
       postgres:
@@ -40,7 +41,7 @@ services:
       migration:
         condition: service_completed_successfully
     environment:
-      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/$POSTGRES_DB
+      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/${POSTGRES_DB:-hatchet}
       - SERVER_GRPC_BIND_ADDRESS=${SERVER_GRPC_BIND_ADDRESS:-0.0.0.0}
       - SERVER_GRPC_INSECURE=${SERVER_GRPC_INSECURE:-t}
     volumes:
@@ -70,10 +71,11 @@ services:
       - RABBITMQ_DEFAULT_PASS=$SERVICE_PASSWORD_RABBITMQ
       - PORT=${RABBITMQ_PORT:-5672}
     healthcheck:
-      test: rabbitmq-diagnostics -q ping
+      test: rabbitmq-diagnostics -q check_port_connectivity
       interval: 5s
       timeout: 30s
-      retries: 10
+      retries: 20
+      start_period: 60s
     volumes:
       - rabbitmq-data:/var/lib/rabbitmq/
 
@@ -83,7 +85,7 @@ services:
     restart: no
     exclude_from_hc: true
     environment:
-      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/$POSTGRES_DB
+      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/${POSTGRES_DB:-hatchet}
     depends_on:
       postgres:
         condition: service_healthy
@@ -93,7 +95,7 @@ services:
     command: /hatchet/hatchet-admin quickstart --skip certs --generated-config-dir /hatchet/config --overwrite=false
     restart: no
     environment:
-      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/$POSTGRES_DB
+      - DATABASE_URL=postgres://$SERVICE_USER_POSTGRES:$SERVICE_PASSWORD_POSTGRES@postgres:5432/${POSTGRES_DB:-hatchet}
       - SERVER_TASKQUEUE_RABBITMQ_URL=amqp://$SERVICE_USER_RABBITMQ:$SERVICE_PASSWORD_RABBITMQ@rabbitmq:5672/
       - SERVER_AUTH_COOKIE_DOMAIN=${SERVER_AUTH_COOKIE_DOMAIN:-localhost:8080}
       - SERVER_AUTH_COOKIE_INSECURE=${SERVER_AUTH_COOKIE_INSECURE:-t}
@@ -103,8 +105,8 @@ services:
       - SERVER_DEFAULT_ENGINE_VERSION=V1
       - SERVER_INTERNAL_CLIENT_INTERNAL_GRPC_BROADCAST_ADDRESS=${SERVER_INTERNAL_CLIENT_INTERNAL_GRPC_BROADCAST_ADDRESS:-hatchet-engine:7077}
     volumes:
-      - hatchet_certs:/hatchet/certs
-      - hatchet_config:/hatchet/config
+      - hatchet-certs:/hatchet/certs
+      - hatchet-config:/hatchet/config
     depends_on:
       migration:
         condition: service_completed_successfully
diff --git a/templates/compose/hermes-agent-with-webui.yaml b/templates/compose/hermes-agent-with-webui.yaml
index caba7c36a7..09dc728b41 100644
--- a/templates/compose/hermes-agent-with-webui.yaml
+++ b/templates/compose/hermes-agent-with-webui.yaml
@@ -7,7 +7,7 @@
 
 services:
   hermes-agent:
-    image: 'nousresearch/hermes-agent:v2026.6.5'
+    image: 'nousresearch/hermes-agent:v2026.9.24'
     command: 'gateway run'
     environment:
       - HERMES_HOME=/home/hermes/.hermes
@@ -25,6 +25,9 @@ services:
       - 'ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}'
       - 'OPENAI_API_KEY=${OPENAI_API_KEY:-}'
       - 'GOOGLE_API_KEY=${GOOGLE_API_KEY:-}'
+      - API_SERVER_ENABLED=true
+      - API_SERVER_HOST=0.0.0.0
+      - 'API_SERVER_KEY=${SERVICE_PASSWORD_64_HERMESAPI}'
     volumes:
       - 'hermes-home:/home/hermes/.hermes'
       - 'hermes-skills:/home/hermes/.hermes/skills'
@@ -37,7 +40,7 @@ services:
       timeout: 5s
       retries: 5
   hermes-webui:
-    image: 'ghcr.io/nesquena/hermes-webui:0.51.489'
+    image: 'ghcr.io/nesquena/hermes-webui:0.52.458'
     depends_on:
       - hermes-agent
     environment:
@@ -51,6 +54,8 @@ services:
       - WANTED_GID=1000
       - HERMES_WEBUI_USERNAME=${SERVICE_USER_HERMESWEBUI}
       - HERMES_WEBUI_PASSWORD=${SERVICE_PASSWORD_HERMESWEBUI}
+      - HERMES_API_URL=http://hermes-agent:8642
+      - 'HERMES_WEBUI_GATEWAY_API_KEY=${SERVICE_PASSWORD_64_HERMESAPI}'
     volumes:
       - 'hermes-home:/home/hermeswebui/.hermes'
       - 'hermes-agent-src:/home/hermeswebui/.hermes/hermes-agent:ro'
diff --git a/templates/compose/huly.yaml b/templates/compose/huly.yaml
index ff6e9b0691..13438c1d20 100644
--- a/templates/compose/huly.yaml
+++ b/templates/compose/huly.yaml
@@ -15,7 +15,7 @@ services:
     volumes:
       - huly-db:/data/db
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: server /data --address ":9000" --console-address ":9001"
     volumes:
       - huly-files:/data      
diff --git a/templates/compose/mautic5.yaml b/templates/compose/mautic5.yaml
index d385458273..306a1e99cc 100644
--- a/templates/compose/mautic5.yaml
+++ b/templates/compose/mautic5.yaml
@@ -27,10 +27,11 @@ services:
     environment:
       - 'RABBITMQ_DEFAULT_VHOST=${RABBITMQ_DEFAULT_VHOST:-mautic}'
     healthcheck:
-      test: rabbitmq-diagnostics -q ping
+      test: rabbitmq-diagnostics -q check_port_connectivity
       interval: 5s
       timeout: 30s
-      retries: 10
+      retries: 20
+      start_period: 60s
     volumes:
       - 'rabbitmq-data:/var/lib/rabbitmq'
   mautic_web:
diff --git a/templates/compose/minio-community-edition.yaml b/templates/compose/minio-community-edition.yaml
index 49a3936240..5abbce1ae0 100644
--- a/templates/compose/minio-community-edition.yaml
+++ b/templates/compose/minio-community-edition.yaml
@@ -1,5 +1,5 @@
 # ignore: true
-# documentation: https://github.com/coollabsio/minio?tab=readme-ov-file#minio-docker-images
+# documentation: https://silo.pigsty.io/docs/
 # slogan: MinIO is a high performance object storage server compatible with Amazon S3 APIs.
 # category: storage
 # tags: object, storage, server, s3, api
@@ -7,7 +7,7 @@
 
 services:
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: server /data --console-address ":9001"
     environment:
       - MINIO_SERVER_URL=$MINIO_SERVER_URL
diff --git a/templates/compose/minio.yaml b/templates/compose/minio.yaml
index d4d43395b1..532bac71c9 100644
--- a/templates/compose/minio.yaml
+++ b/templates/compose/minio.yaml
@@ -7,7 +7,7 @@
 
 services:
   minio:
-    image: quay.io/minio/minio:latest
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     command: server /data --console-address ":9001"
     environment:
       - MINIO_SERVER_URL=$MINIO_SERVER_URL
diff --git a/templates/compose/penpot-with-s3.yaml b/templates/compose/penpot-with-s3.yaml
index 2f37d78e68..4d6a3a31e0 100644
--- a/templates/compose/penpot-with-s3.yaml
+++ b/templates/compose/penpot-with-s3.yaml
@@ -97,7 +97,7 @@ services:
 
   # MinIO S3 Local server
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: server /data
     environment:
       - MINIO_ROOT_USER=${SERVICE_USER_MINIO}
@@ -112,7 +112,7 @@ services:
       
   # S3 Bucket initialization
   minio-init:
-    image: minio/mc:latest
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     depends_on:
       minio:
         condition: service_healthy
diff --git a/templates/compose/plane.yaml b/templates/compose/plane.yaml
index 440845a1e0..596090dac6 100644
--- a/templates/compose/plane.yaml
+++ b/templates/compose/plane.yaml
@@ -229,14 +229,15 @@ services:
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq
     healthcheck:
-      test: rabbitmq-diagnostics -q ping
+      test: rabbitmq-diagnostics -q check_port_connectivity
       interval: 30s
       timeout: 30s
       retries: 3
+      start_period: 60s
 
   # Comment this if you using any external s3 compatible storage
   plane-minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     command: server /export --console-address ":9090"
     environment:
       <<: *minio-env
diff --git a/templates/compose/posthog.yaml b/templates/compose/posthog.yaml
index d480451030..6845fe1bd7 100644
--- a/templates/compose/posthog.yaml
+++ b/templates/compose/posthog.yaml
@@ -1870,12 +1870,12 @@ services:
       - ALLOW_PLAINTEXT_LISTENER=yes
 
   object_storage:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     environment:
       - MINIO_ROOT_USER=$SERVICE_USER_MINIO
       - MINIO_ROOT_PASSWORD=$SERVICE_PASSWORD_MINIO
     entrypoint: sh
-    command: -c 'mkdir -p /data/posthog && minio server --address ":9000" --console-address ":9001" /data'
+    command: -c 'mkdir -p /data/posthog && silo server --address ":9000" --console-address ":9001" /data'
     volumes:
       - object_storage:/data
     healthcheck:
diff --git a/templates/compose/rabbitmq.yaml b/templates/compose/rabbitmq.yaml
index b80c1d4052..0d7d969610 100644
--- a/templates/compose/rabbitmq.yaml
+++ b/templates/compose/rabbitmq.yaml
@@ -17,9 +17,10 @@ services:
     ports:
       - ${PORT}:5672
     healthcheck:
-      test: rabbitmq-diagnostics -q ping
+      test: rabbitmq-diagnostics -q check_port_connectivity
       interval: 5s
       timeout: 30s
-      retries: 10
+      retries: 20
+      start_period: 60s
     volumes:
       - rabbitmq-data:/var/lib/rabbitmq/
diff --git a/templates/compose/reactive-resume.yaml b/templates/compose/reactive-resume.yaml
index a5c5332ec2..0ecf593dba 100644
--- a/templates/compose/reactive-resume.yaml
+++ b/templates/compose/reactive-resume.yaml
@@ -56,7 +56,7 @@ services:
       retries: 10
 
   minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     command: server /data --console-address ":9001"
     environment:
       - MINIO_SERVER_URL=$MINIO_SERVER_URL
diff --git a/templates/compose/seafile.yaml b/templates/compose/seafile.yaml
index ddd1919d44..0ab40d669a 100644
--- a/templates/compose/seafile.yaml
+++ b/templates/compose/seafile.yaml
@@ -30,6 +30,8 @@ services:
       - JWT_PRIVATE_KEY=${SERVICE_PASSWORD_64_JWT}
       - SEAFILE_LOG_TO_STDOUT=${SEAFILE_LOG_TO_STDOUT:-true}
       - 'FILE_SERVER_ROOT=${SERVICE_URL_SEAFILE}/seafhttp'
+      - ENABLE_SEADOC=${ENABLE_SEADOC:-true}
+      - SEADOC_SERVER_URL=${SERVICE_URL_SEADOC}
     depends_on:
       mariadb:
         condition: service_healthy
@@ -41,6 +43,30 @@ services:
       timeout: 20s
       retries: 5
 
+  seadoc:
+    image: seafileltd/sdoc-server:1.0-latest
+    volumes:
+      - seadoc-data:/shared
+    environment:
+      - SERVICE_URL_SEADOC_80
+      - DB_HOST=mariadb
+      - DB_PORT=3306
+      - DB_USER=${SERVICE_USER_MYSQL}
+      - DB_PASSWORD=${SERVICE_PASSWORD_MYSQL}
+      - DB_NAME=${SEAFILE_MYSQL_DB_SEAHUB_DB_NAME:-seahub_db}
+      - TIME_ZONE=${TIME_ZONE:-UTC}
+      - JWT_PRIVATE_KEY=${SERVICE_PASSWORD_64_JWT}
+      - NON_ROOT=${NON_ROOT:-false}
+      - SEAHUB_SERVICE_URL=http://seafile
+    depends_on:
+      mariadb:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:80/ping"]
+      interval: 10s
+      timeout: 20s
+      retries: 5
+
   mariadb:
     image: mariadb:11
     volumes:
diff --git a/templates/compose/signoz.yaml b/templates/compose/signoz.yaml
index 8025670f06..29376a2529 100644
--- a/templates/compose/signoz.yaml
+++ b/templates/compose/signoz.yaml
@@ -144,6 +144,51 @@ services:
               <user_scripts_path>/var/lib/clickhouse/user_scripts/</user_scripts_path>
               <user_defined_executable_functions_config>*function.xml</user_defined_executable_functions_config>
           </clickhouse>
+      - type: bind
+        source: ./clickhouse/system-logs.xml
+        target: /etc/clickhouse-server/config.d/system-logs.xml
+        content: |
+          <?xml version="1.0"?>
+          <clickhouse>
+              <query_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+                  <flush_interval_milliseconds>30000</flush_interval_milliseconds>
+              </query_log>
+              <query_thread_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+              </query_thread_log>
+              <query_metric_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+              </query_metric_log>
+              <query_views_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+              </query_views_log>
+              <part_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+              </part_log>
+              <metric_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+                  <flush_interval_milliseconds>30000</flush_interval_milliseconds>
+              </metric_log>
+              <asynchronous_metric_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+              </asynchronous_metric_log>
+              <trace_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+                  <flush_interval_milliseconds>30000</flush_interval_milliseconds>
+              </trace_log>
+              <error_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+              </error_log>
+              <processors_profile_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+                  <flush_interval_milliseconds>30000</flush_interval_milliseconds>
+              </processors_profile_log>
+              <text_log>
+                  <ttl>event_date + INTERVAL 1 DAY DELETE</ttl>
+                  <flush_interval_milliseconds>30000</flush_interval_milliseconds>
+              </text_log>
+          </clickhouse>
 
   signoz:
     image: signoz/signoz:v0.137.1
diff --git a/templates/compose/supabase.yaml b/templates/compose/supabase.yaml
index b79eec6043..3bd45a95ad 100644
--- a/templates/compose/supabase.yaml
+++ b/templates/compose/supabase.yaml
@@ -913,7 +913,7 @@ services:
                 kong: 'contains(string!(.appname), "supabase-kong")'
                 auth: 'contains(string!(.appname), "supabase-auth")'
                 rest: 'contains(string!(.appname), "supabase-rest")'
-                realtime: 'contains(string!(.appname), "supabase-realtime")'
+                realtime: 'contains(string!(.appname), "realtime-dev")'
                 storage: 'contains(string!(.appname), "supabase-storage")'
                 functions: 'contains(string!(.appname), "supabase-edge-functions")'
                 db: 'contains(string!(.appname), "supabase-db")'
@@ -1297,7 +1297,7 @@ services:
       - DB_AFTER_CONNECT_QUERY=SET search_path TO _realtime
       - DB_ENC_KEY=supabaserealtime
       - API_JWT_SECRET=${SERVICE_PASSWORD_JWT}
-      - SECRET_KEY_BASE=${SECRET_PASSWORD_REALTIME}
+      - SECRET_KEY_BASE=${SERVICE_PASSWORD_64_REALTIME}
       - METRICS_JWT_SECRET=${SERVICE_PASSWORD_JWT}
       - ERL_AFLAGS=-proto_dist inet_tcp
       - DNS_NODES=''
@@ -1311,7 +1311,7 @@ services:
     command: >
       sh -c "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"
   supabase-minio:
-    image: ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Released on 15 October 2025
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z # Released on 15 October 2026
     environment:
       - MINIO_ROOT_USER=${SERVICE_USER_MINIO}
       - MINIO_ROOT_PASSWORD=${SERVICE_PASSWORD_MINIO}
@@ -1325,7 +1325,7 @@ services:
       - ./volumes/storage:/data
 
   minio-createbucket:
-    image: minio/mc
+    image: pgsty/silo:RELEASE.2026-10-15T00-00-00Z
     restart: "no"
     environment:
       - MINIO_ROOT_USER=${SERVICE_USER_MINIO}
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index 7e7ba6d322..c01c15f46d 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -112,7 +112,7 @@
     "appflowy": {
         "documentation": "https://docs.appflowy.io/docs/documentation/appflowy-cloud?utm_source=coolify.io",
         "slogan": "AppFlowy is the AI collaborative workspace where you achieve more without losing control of your data.",
-        "compose": "c2VydmljZXM6CiAgbmdpbng6CiAgICBpbWFnZTogJ25naW54OjEuMjkuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FETUlOCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9uZ2lueC9uZ2lueC5jb25mCiAgICAgICAgdGFyZ2V0OiAvZXRjL25naW54L25naW54LmNvbmYKICAgICAgICByZWFkX29ubHk6IHRydWUKICAgICAgICBjb250ZW50OiAiIyBQbGVhc2UgZG8gbm90IGRpcmVjdGx5IGVkaXQgdGhpcyBmaWxlLlxuXG5lcnJvcl9sb2cgIC92YXIvbG9nL25naW54L2Vycm9yLmxvZyBub3RpY2U7XG5waWQgICAgICAgIC92YXIvcnVuL25naW54LnBpZDtcblxuXG5ldmVudHMge1xuICAgIHdvcmtlcl9jb25uZWN0aW9ucyAgMTAyNDtcbn1cblxuXG5odHRwIHtcbiAgICByZXNvbHZlciAxMjcuMC4wLjExIHZhbGlkPTEwcztcbiAgICBtYXAgJGh0dHBfdXBncmFkZSAkY29ubmVjdGlvbl91cGdyYWRlIHtcbiAgICAgICAgZGVmYXVsdCB1cGdyYWRlO1xuICAgICAgICAnJyBjbG9zZTtcbiAgICB9XG5cbiAgICBzZXJ2ZXIge1xuICAgICAgICBsaXN0ZW4gODA7XG4gICAgICAgIGNsaWVudF9tYXhfYm9keV9zaXplIDEwTTtcbiAgICAgICAgdW5kZXJzY29yZXNfaW5faGVhZGVycyBvbjtcblxuICAgICAgICAjIEJhY2tlbmQgc2VydmljZXNcbiAgICAgICAgc2V0ICRhcHBmbG93eV9jbG91ZF9iYWNrZW5kIFwiaHR0cDovL2FwcGZsb3d5X2Nsb3VkOjgwMDBcIjtcbiAgICAgICAgc2V0ICRnb3RydWVfYmFja2VuZCBcImh0dHA6Ly9nb3RydWU6OTk5OVwiO1xuICAgICAgICBzZXQgJGFkbWluX2Zyb250ZW5kX2JhY2tlbmQgXCJodHRwOi8vYWRtaW5fZnJvbnRlbmQ6MzAwMFwiO1xuICAgICAgICAjIEdvVHJ1ZSBBdXRoZW50aWNhdGlvbiBTZXJ2aWNlXG4gICAgICAgIGxvY2F0aW9uIC9nb3RydWUvIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGdvdHJ1ZV9iYWNrZW5kO1xuXG4gICAgICAgICAgICByZXdyaXRlIF4vZ290cnVlKC8uKikkICQxIGJyZWFrO1xuICAgICAgICAgICAgXG4gICAgICAgICAgICAjIEFsbG93IGhlYWRlcnMgbGlrZSByZWRpcmVjdF90byB0byBiZSBoYW5kZWQgb3ZlciB0byB0aGUgZ290cnVlXG4gICAgICAgICAgICAjIGZvciBjb3JyZWN0IHJlZGlyZWN0aW5nXG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgJGh0dHBfaG9zdDtcbiAgICAgICAgICAgIHByb3h5X3Bhc3NfcmVxdWVzdF9oZWFkZXJzIG9uO1xuICAgICAgICB9XG5cbiAgICAgICAgIyBXZWJTb2NrZXQgZW5kcG9pbnQgLSBoYW5kbGUgYm90aCAvd3MgYW5kIC93cy92MlxuICAgICAgICBsb2NhdGlvbiAvd3Mge1xuICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcblxuICAgICAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgVXBncmFkZSAkaHR0cF91cGdyYWRlO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBDb25uZWN0aW9uIFwiVXBncmFkZVwiO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBIb3N0ICRob3N0O1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLVJlYWwtSVAgJHJlbW90ZV9hZGRyO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Gb3IgJHByb3h5X2FkZF94X2ZvcndhcmRlZF9mb3I7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtRm9yd2FyZGVkLVByb3RvICRzY2hlbWU7XG4gICAgICAgICAgICBwcm94eV9yZWFkX3RpbWVvdXQgODY0MDBzO1xuICAgICAgICB9XG5cbiAgICAgICAgIyBBUEkgZW5kcG9pbnRzXG4gICAgICAgIGxvY2F0aW9uIC9hcGkge1xuICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZXF1ZXN0LUlkICRyZXF1ZXN0X2lkO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBIb3N0ICRodHRwX2hvc3Q7XG5cbiAgICAgICAgICAgICMgU3BlY2lhbCBoYW5kbGluZyBmb3IgcHVibGlzaCBlbmRwb2ludFxuICAgICAgICAgICAgbG9jYXRpb24gfiogXi9hcGkvd29ya3NwYWNlLyhbYS16QS1aMC05Xy1dKykvcHVibGlzaCQge1xuICAgICAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG4gICAgICAgICAgICAgICAgcHJveHlfcmVxdWVzdF9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgICAgIGNsaWVudF9tYXhfYm9keV9zaXplIDI1Nk07XG4gICAgICAgICAgICB9XG5cbiAgICAgICAgICAgICMgQ2hhdCBlbmRwb2ludCAoc3RyZWFtaW5nKVxuICAgICAgICAgICAgbG9jYXRpb24gL2FwaS9jaGF0IHtcbiAgICAgICAgICAgICAgICBwcm94eV9wYXNzICRhcHBmbG93eV9jbG91ZF9iYWNrZW5kO1xuXG4gICAgICAgICAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIENvbm5lY3Rpb24gXCJcIjtcbiAgICAgICAgICAgICAgICBjaHVua2VkX3RyYW5zZmVyX2VuY29kaW5nIG9uO1xuICAgICAgICAgICAgICAgIHByb3h5X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICAgICAgcHJveHlfY2FjaGUgb2ZmO1xuXG4gICAgICAgICAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfc2VuZF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICB9XG5cbiAgICAgICAgICAgICMgSW1wb3J0IGVuZHBvaW50XG4gICAgICAgICAgICBsb2NhdGlvbiAvYXBpL2ltcG9ydCB7XG4gICAgICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcblxuICAgICAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZXF1ZXN0LUlkICRyZXF1ZXN0X2lkO1xuICAgICAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaHR0cF9ob3N0O1xuXG4gICAgICAgICAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfc2VuZF90aW1lb3V0IDYwMHM7XG5cbiAgICAgICAgICAgICAgICBwcm94eV9yZXF1ZXN0X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICAgICAgcHJveHlfYnVmZmVyaW5nIG9mZjtcbiAgICAgICAgICAgICAgICBwcm94eV9jYWNoZSBvZmY7XG4gICAgICAgICAgICAgICAgY2xpZW50X21heF9ib2R5X3NpemUgMkc7XG4gICAgICAgICAgICB9XG4gICAgICAgIH1cblxuICAgICAgICAjIEFkbWluIEZyb250ZW5kXG4gICAgICAgICMgT3B0aW9uYWwgTW9kdWxlLCBjb21tZW50IHRoaXMgc2VjdGlvbiBpZiB5b3UgZGlkIG5vdCBkZXBsb3kgYWRtaW5fZnJvbnRlbmQgaW4gZG9ja2VyLWNvbXBvc2UueW1sXG4gICAgICAgIGxvY2F0aW9uIC9jb25zb2xlIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFkbWluX2Zyb250ZW5kX2JhY2tlbmQ7XG5cbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1TY2hlbWUgJHNjaGVtZTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaG9zdDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZWFsLUlQICRyZW1vdGVfYWRkcjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtRm9yICRwcm94eV9hZGRfeF9mb3J3YXJkZWRfZm9yO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Qcm90byAkc2NoZW1lO1xuXG4gICAgICAgICAgICBwcm94eV9odHRwX3ZlcnNpb24gMS4xO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBDb25uZWN0aW9uIFwiXCI7XG5cbiAgICAgICAgICAgIHByb3h5X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICBwcm94eV9jYWNoZSBvZmY7XG5cbiAgICAgICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA2MHM7XG4gICAgICAgICAgICBwcm94eV9jb25uZWN0X3RpbWVvdXQgNjBzO1xuICAgICAgICAgICAgcHJveHlfc2VuZF90aW1lb3V0IDYwcztcbiAgICAgICAgfVxuXG4gICAgICAgICMgUmVkaXJlY3Qgcm9vdCBwYXRoIHRvIC9jb25zb2xlXG4gICAgICAgIGxvY2F0aW9uID0gLyB7XG4gICAgICAgICAgICByZXR1cm4gMzAxIC9jb25zb2xlO1xuICAgICAgICB9XG5cbiAgICAgICAgIyBIZWFsdGggY2hlY2sgZW5kcG9pbnRcbiAgICAgICAgbG9jYXRpb24gL2hlYWx0aCB7XG4gICAgICAgICAgICBhY2Nlc3NfbG9nIG9mZjtcbiAgICAgICAgICAgIHJldHVybiAyMDAgXCJoZWFsdGh5XFxuXCI7XG4gICAgICAgICAgICBhZGRfaGVhZGVyIENvbnRlbnQtVHlwZSB0ZXh0L3BsYWluO1xuICAgICAgICB9XG4gICAgfVxufVxuIgogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcHBmbG93eV9jbG91ZAogICAgICAtIGdvdHJ1ZQogICAgICAtIGFkbWluX2Zyb250ZW5kCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNDBzCiAgYXBwZmxvd3lfd2ViOgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQVBQRkxPV1lXRUIKICAgICAgLSAnQVBQRkxPV1lfQkFTRV9VUkw9JHtTRVJWSUNFX1VSTF9BRE1JTn0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0FQUEZMT1dZX1dTX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfQURNSU59L3dzL3YyJwogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hcHBmbG93eV93ZWI6MC45LjEzMicKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBwZmxvd3lfY2xvdWQKICBhcHBmbG93eV9jbG91ZDoKICAgIGltYWdlOiAnYXBwZmxvd3lpbmMvYXBwZmxvd3lfY2xvdWQ6MC45LjE0OScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1pbmZvfScKICAgICAgLSAnQVBQRkxPV1lfQkFTRV9VUkw9JHtTRVJWSUNFX1VSTF9BRE1JTn0nCiAgICAgIC0gQVBQRkxPV1lfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtICdBUFBGTE9XWV9EQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUkVESVNfVVJJPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD1odHRwOi8vZ290cnVlOjk5OTknCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0NSRUFURV9CVUNLRVQ9JHtBUFBGTE9XWV9TM19DUkVBVEVfQlVDS0VUOi10cnVlfScKICAgICAgLSBBUFBGTE9XWV9TM19VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBUFBGTE9XWV9TM19NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0JVQ0tFVD0ke0FQUEZMT1dZX1MzX0JVQ0tFVDotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9TM19SRUdJT049JHtBUFBGTE9XWV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX0hPU1Q9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX1BPUlQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRT0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1VTRVJOQU1FOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX0VNQUlMOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1BBU1NXT1JEOi1lbWFpbF9zZW5kZXJfcGFzc3dvcmR9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1RMU19LSU5EOi1ub25lfScKICAgICAgLSBBUFBGTE9XWV9BQ0NFU1NfQ09OVFJPTD10cnVlCiAgICAgIC0gQVBQRkxPV1lfREFUQUJBU0VfTUFYX0NPTk5FQ1RJT05TPTQwCiAgICAgIC0gQUlfU0VSVkVSX0hPU1Q9YWkKICAgICAgLSBBSV9TRVJWRVJfUE9SVD01MDAxCiAgICAgIC0gJ0FJX09QRU5BSV9BUElfS0VZPSR7QUlfT1BFTkFJX0FQSV9LRVk6LX0nCiAgICAgIC0gJ0FQUEZMT1dZX1dFQl9VUkw9JHtTRVJWSUNFX1VSTF9BUFBGTE9XWVdFQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2N1cmwgLS1mYWlsIGh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9hcGkvaGVhbHRoIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICBkZXBlbmRzX29uOgogICAgICBnb3RydWU6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICBnb3RydWU6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2dvdHJ1ZTowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR09UUlVFX0FQSV9IT1NUPTAuMC4wLjAKICAgICAgLSBHT1RSVUVfQVBJX1BPUlQ9OTk5OQogICAgICAtIFBPUlQ9OTk5OQogICAgICAtICdHT1RSVUVfQURNSU5fRU1BSUw9JHtHT1RSVUVfQURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSAnR09UUlVFX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gR09UUlVFX0RJU0FCTEVfU0lHTlVQPWZhbHNlCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD1hcHBmbG93eS1mbHV0dGVyOi8vJwogICAgICAtICdHT1RSVUVfVVJJX0FMTE9XX0xJU1Q9KionCiAgICAgIC0gJ0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdHT1RSVUVfSldUX0VYUD0ke0dPVFJVRV9KV1RfRVhQOi03MjAwfScKICAgICAgLSBHT1RSVUVfREJfRFJJVkVSPXBvc3RncmVzCiAgICAgIC0gJ0FQSV9FWFRFUk5BTF9VUkw9JHtTRVJWSUNFX1VSTF9BRE1JTn0vZ290cnVlJwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fT9zZWFyY2hfcGF0aD1hdXRoJwogICAgICAtICdHT1RSVUVfU01UUF9IT1NUPSR7R09UUlVFX1NNVFBfSE9TVH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BPUlQ9JHtHT1RSVUVfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdHT1RSVUVfU01UUF9VU0VSPSR7R09UUlVFX1NNVFBfVVNFUn0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BBU1M9JHtHT1RSVUVfU01UUF9QQVNTfScKICAgICAgLSBHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTj0vdmVyaWZ5CiAgICAgIC0gR09UUlVFX01BSUxFUl9VUkxQQVRIU19JTlZJVEU9L3ZlcmlmeQogICAgICAtIEdPVFJVRV9NQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk9L3ZlcmlmeQogICAgICAtIEdPVFJVRV9NQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFPS92ZXJpZnkKICAgICAgLSAnR09UUlVFX1NNVFBfQURNSU5fRU1BSUw9JHtHT1RSVUVfU01UUF9BRE1JTl9FTUFJTH0nCiAgICAgIC0gR09UUlVFX1NNVFBfTUFYX0ZSRVFVRU5DWT0xbnMKICAgICAgLSBHT1RSVUVfUkFURV9MSU1JVF9FTUFJTF9TRU5UPTEwMAogICAgICAtIEdPVFJVRV9NQUlMRVJfQVVUT0NPTkZJUk09dHJ1ZQogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnY3VybCAtLWZhaWwgaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogIGFkbWluX2Zyb250ZW5kOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hZG1pbl9mcm9udGVuZDowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0FQUEZMT1dZX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfQURNSU59JwogICAgZGVwZW5kc19vbjoKICAgICAgZ290cnVlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcGZsb3d5X2Nsb3VkOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgYWk6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FwcGZsb3d5X2FpOjAuOS4xNDknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnT1BFTkFJX0FQSV9LRVk9JHtBSV9PUEVOQUlfQVBJX0tFWTotfScKICAgICAgLSBBSV9TRVJWRVJfUE9SVD01MDAxCiAgICAgIC0gREVGQVVMVF9BSV9NT0RFTD1ncHQtNC4xLW1pbmkKICAgICAgLSBERUZBVUxUX0FJX0NPTVBMRVRJT05fTU9ERUw9Z3B0LTQuMS1taW5pCiAgICAgIC0gJ0FJX0FQUEZMT1dZX0hPU1Q9JHtTRVJWSUNFX1VSTF9BUFBGTE9XWVdFQn0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdBWlVSRV9PUEVOQUlfQVBJX0tFWT0ke0FaVVJFX09QRU5BSV9BUElfS0VZfScKICAgICAgLSAnQVpVUkVfT1BFTkFJX0VORFBPSU5UPSR7QVpVUkVfT1BFTkFJX0VORFBPSU5UfScKICAgICAgLSAnQVpVUkVfT1BFTkFJX0FQSV9WRVJTSU9OPSR7QVpVUkVfT1BFTkFJX0FQSV9WRVJTSU9OfScKICAgICAgLSAnQVBQRkxPV1lfUzNfQUNDRVNTX0tFWT0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX1NFQ1JFVF9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnQVBQRkxPV1lfUzNfQlVDS0VUPSR7QVBQRkxPV1lfUzNfQlVDS0VUOi1hcHBmbG93eX0nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX1JFR0lPTj0ke0FQUEZMT1dZX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnQUlfREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gJ0FJX1JFRElTX1VSTD1yZWRpczovL3JlZGlzOjYzNzknCiAgICAgIC0gQUlfVVNFX01JTklPPXRydWUKICAgICAgLSAnQUlfTUlOSU9fVVJMPWh0dHA6Ly9taW5pbzo5MDAwJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhcHBmbG93eV93b3JrZXI6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FwcGZsb3d5X3dvcmtlcjowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUlVTVF9MT0c9aW5mbwogICAgICAtIEFQUEZMT1dZX0VOVklST05NRU5UPXByb2R1Y3Rpb24KICAgICAgLSBBUFBGTE9XWV9XT1JLRVJfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtICdBUFBGTE9XWV9XT1JLRVJfUkVESVNfVVJMPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSAnQVBQRkxPV1lfV09SS0VSX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9XT1JLRVJfREFUQUJBU0VfTkFNRT0ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gQVBQRkxPV1lfV09SS0VSX0lNUE9SVF9USUNLX0lOVEVSVkFMPTMwCiAgICAgIC0gQVBQRkxPV1lfUzNfVVNFX01JTklPPXRydWUKICAgICAgLSAnQVBQRkxPV1lfUzNfTUlOSU9fVVJMPWh0dHA6Ly9taW5pbzo5MDAwJwogICAgICAtICdBUFBGTE9XWV9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVBQRkxPV1lfUzNfU0VDUkVUX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19CVUNLRVQ9JHtBUFBGTE9XWV9TM19CVUNLRVQ6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUzNfUkVHSU9OPSR7QVBQRkxPV1lfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUPSR7QVBQRkxPV1lfTUFJTEVSX1NNVFBfSE9TVDotc210cC5nbWFpbC5jb219JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUPSR7QVBQRkxPV1lfTUFJTEVSX1NNVFBfUE9SVDotNTg3fScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfVVNFUk5BTUU9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRTotbm90aWZ5QGFwcGZsb3d5LmlvfScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfRU1BSUw9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTDotbm90aWZ5QGFwcGZsb3d5LmlvfScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfUEFTU1dPUkQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRDotZW1haWxfc2VuZGVyX3Bhc3N3b3JkfScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfVExTX0tJTkQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORDotbm9uZX0nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZAogIG1pbmlvOgogICAgaW1hZ2U6ICdtaW5pby9taW5pbzpSRUxFQVNFLjIwMjUtMDktMDdUMTYtMTMtMDlaJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo5MDAwL21pbmlvL2hlYWx0aC9saXZlJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAzCiAgICB2b2x1bWVzOgogICAgICAtICdtaW5pb19kYXRhOi9kYXRhJwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwZ3ZlY3Rvci9wZ3ZlY3RvcjpwZzE2JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1wb3N0Z3JlcwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdfaXNyZWFkeQogICAgICAgIC0gJy1VJwogICAgICAgIC0gJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgICAtICctZCcKICAgICAgICAtICcke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo4LjIuMi1hbHBpbmUzLjIyJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXNfZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIC1oIGxvY2FsaG9zdCAtcCA2Mzc5IHBpbmcnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
+        "compose": "c2VydmljZXM6CiAgbmdpbng6CiAgICBpbWFnZTogJ25naW54OjEuMjkuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FETUlOCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9uZ2lueC9uZ2lueC5jb25mCiAgICAgICAgdGFyZ2V0OiAvZXRjL25naW54L25naW54LmNvbmYKICAgICAgICByZWFkX29ubHk6IHRydWUKICAgICAgICBjb250ZW50OiAiIyBQbGVhc2UgZG8gbm90IGRpcmVjdGx5IGVkaXQgdGhpcyBmaWxlLlxuXG5lcnJvcl9sb2cgIC92YXIvbG9nL25naW54L2Vycm9yLmxvZyBub3RpY2U7XG5waWQgICAgICAgIC92YXIvcnVuL25naW54LnBpZDtcblxuXG5ldmVudHMge1xuICAgIHdvcmtlcl9jb25uZWN0aW9ucyAgMTAyNDtcbn1cblxuXG5odHRwIHtcbiAgICByZXNvbHZlciAxMjcuMC4wLjExIHZhbGlkPTEwcztcbiAgICBtYXAgJGh0dHBfdXBncmFkZSAkY29ubmVjdGlvbl91cGdyYWRlIHtcbiAgICAgICAgZGVmYXVsdCB1cGdyYWRlO1xuICAgICAgICAnJyBjbG9zZTtcbiAgICB9XG5cbiAgICBzZXJ2ZXIge1xuICAgICAgICBsaXN0ZW4gODA7XG4gICAgICAgIGNsaWVudF9tYXhfYm9keV9zaXplIDEwTTtcbiAgICAgICAgdW5kZXJzY29yZXNfaW5faGVhZGVycyBvbjtcblxuICAgICAgICAjIEJhY2tlbmQgc2VydmljZXNcbiAgICAgICAgc2V0ICRhcHBmbG93eV9jbG91ZF9iYWNrZW5kIFwiaHR0cDovL2FwcGZsb3d5X2Nsb3VkOjgwMDBcIjtcbiAgICAgICAgc2V0ICRnb3RydWVfYmFja2VuZCBcImh0dHA6Ly9nb3RydWU6OTk5OVwiO1xuICAgICAgICBzZXQgJGFkbWluX2Zyb250ZW5kX2JhY2tlbmQgXCJodHRwOi8vYWRtaW5fZnJvbnRlbmQ6MzAwMFwiO1xuICAgICAgICAjIEdvVHJ1ZSBBdXRoZW50aWNhdGlvbiBTZXJ2aWNlXG4gICAgICAgIGxvY2F0aW9uIC9nb3RydWUvIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGdvdHJ1ZV9iYWNrZW5kO1xuXG4gICAgICAgICAgICByZXdyaXRlIF4vZ290cnVlKC8uKikkICQxIGJyZWFrO1xuICAgICAgICAgICAgXG4gICAgICAgICAgICAjIEFsbG93IGhlYWRlcnMgbGlrZSByZWRpcmVjdF90byB0byBiZSBoYW5kZWQgb3ZlciB0byB0aGUgZ290cnVlXG4gICAgICAgICAgICAjIGZvciBjb3JyZWN0IHJlZGlyZWN0aW5nXG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgJGh0dHBfaG9zdDtcbiAgICAgICAgICAgIHByb3h5X3Bhc3NfcmVxdWVzdF9oZWFkZXJzIG9uO1xuICAgICAgICB9XG5cbiAgICAgICAgIyBXZWJTb2NrZXQgZW5kcG9pbnQgLSBoYW5kbGUgYm90aCAvd3MgYW5kIC93cy92MlxuICAgICAgICBsb2NhdGlvbiAvd3Mge1xuICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcblxuICAgICAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgVXBncmFkZSAkaHR0cF91cGdyYWRlO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBDb25uZWN0aW9uIFwiVXBncmFkZVwiO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBIb3N0ICRob3N0O1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLVJlYWwtSVAgJHJlbW90ZV9hZGRyO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Gb3IgJHByb3h5X2FkZF94X2ZvcndhcmRlZF9mb3I7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtRm9yd2FyZGVkLVByb3RvICRzY2hlbWU7XG4gICAgICAgICAgICBwcm94eV9yZWFkX3RpbWVvdXQgODY0MDBzO1xuICAgICAgICB9XG5cbiAgICAgICAgIyBBUEkgZW5kcG9pbnRzXG4gICAgICAgIGxvY2F0aW9uIC9hcGkge1xuICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZXF1ZXN0LUlkICRyZXF1ZXN0X2lkO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBIb3N0ICRodHRwX2hvc3Q7XG5cbiAgICAgICAgICAgICMgU3BlY2lhbCBoYW5kbGluZyBmb3IgcHVibGlzaCBlbmRwb2ludFxuICAgICAgICAgICAgbG9jYXRpb24gfiogXi9hcGkvd29ya3NwYWNlLyhbYS16QS1aMC05Xy1dKykvcHVibGlzaCQge1xuICAgICAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG4gICAgICAgICAgICAgICAgcHJveHlfcmVxdWVzdF9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgICAgIGNsaWVudF9tYXhfYm9keV9zaXplIDI1Nk07XG4gICAgICAgICAgICB9XG5cbiAgICAgICAgICAgICMgQ2hhdCBlbmRwb2ludCAoc3RyZWFtaW5nKVxuICAgICAgICAgICAgbG9jYXRpb24gL2FwaS9jaGF0IHtcbiAgICAgICAgICAgICAgICBwcm94eV9wYXNzICRhcHBmbG93eV9jbG91ZF9iYWNrZW5kO1xuXG4gICAgICAgICAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIENvbm5lY3Rpb24gXCJcIjtcbiAgICAgICAgICAgICAgICBjaHVua2VkX3RyYW5zZmVyX2VuY29kaW5nIG9uO1xuICAgICAgICAgICAgICAgIHByb3h5X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICAgICAgcHJveHlfY2FjaGUgb2ZmO1xuXG4gICAgICAgICAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfc2VuZF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICB9XG5cbiAgICAgICAgICAgICMgSW1wb3J0IGVuZHBvaW50XG4gICAgICAgICAgICBsb2NhdGlvbiAvYXBpL2ltcG9ydCB7XG4gICAgICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcblxuICAgICAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZXF1ZXN0LUlkICRyZXF1ZXN0X2lkO1xuICAgICAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaHR0cF9ob3N0O1xuXG4gICAgICAgICAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDYwMHM7XG4gICAgICAgICAgICAgICAgcHJveHlfc2VuZF90aW1lb3V0IDYwMHM7XG5cbiAgICAgICAgICAgICAgICBwcm94eV9yZXF1ZXN0X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICAgICAgcHJveHlfYnVmZmVyaW5nIG9mZjtcbiAgICAgICAgICAgICAgICBwcm94eV9jYWNoZSBvZmY7XG4gICAgICAgICAgICAgICAgY2xpZW50X21heF9ib2R5X3NpemUgMkc7XG4gICAgICAgICAgICB9XG4gICAgICAgIH1cblxuICAgICAgICAjIEFkbWluIEZyb250ZW5kXG4gICAgICAgICMgT3B0aW9uYWwgTW9kdWxlLCBjb21tZW50IHRoaXMgc2VjdGlvbiBpZiB5b3UgZGlkIG5vdCBkZXBsb3kgYWRtaW5fZnJvbnRlbmQgaW4gZG9ja2VyLWNvbXBvc2UueW1sXG4gICAgICAgIGxvY2F0aW9uIC9jb25zb2xlIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFkbWluX2Zyb250ZW5kX2JhY2tlbmQ7XG5cbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1TY2hlbWUgJHNjaGVtZTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaG9zdDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZWFsLUlQICRyZW1vdGVfYWRkcjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtRm9yICRwcm94eV9hZGRfeF9mb3J3YXJkZWRfZm9yO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Qcm90byAkc2NoZW1lO1xuXG4gICAgICAgICAgICBwcm94eV9odHRwX3ZlcnNpb24gMS4xO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBDb25uZWN0aW9uIFwiXCI7XG5cbiAgICAgICAgICAgIHByb3h5X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICBwcm94eV9jYWNoZSBvZmY7XG5cbiAgICAgICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA2MHM7XG4gICAgICAgICAgICBwcm94eV9jb25uZWN0X3RpbWVvdXQgNjBzO1xuICAgICAgICAgICAgcHJveHlfc2VuZF90aW1lb3V0IDYwcztcbiAgICAgICAgfVxuXG4gICAgICAgICMgUmVkaXJlY3Qgcm9vdCBwYXRoIHRvIC9jb25zb2xlXG4gICAgICAgIGxvY2F0aW9uID0gLyB7XG4gICAgICAgICAgICByZXR1cm4gMzAxIC9jb25zb2xlO1xuICAgICAgICB9XG5cbiAgICAgICAgIyBIZWFsdGggY2hlY2sgZW5kcG9pbnRcbiAgICAgICAgbG9jYXRpb24gL2hlYWx0aCB7XG4gICAgICAgICAgICBhY2Nlc3NfbG9nIG9mZjtcbiAgICAgICAgICAgIHJldHVybiAyMDAgXCJoZWFsdGh5XFxuXCI7XG4gICAgICAgICAgICBhZGRfaGVhZGVyIENvbnRlbnQtVHlwZSB0ZXh0L3BsYWluO1xuICAgICAgICB9XG4gICAgfVxufVxuIgogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcHBmbG93eV9jbG91ZAogICAgICAtIGdvdHJ1ZQogICAgICAtIGFkbWluX2Zyb250ZW5kCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QvaGVhbHRoJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogNDBzCiAgYXBwZmxvd3lfd2ViOgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQVBQRkxPV1lXRUIKICAgICAgLSAnQVBQRkxPV1lfQkFTRV9VUkw9JHtTRVJWSUNFX1VSTF9BRE1JTn0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0FQUEZMT1dZX1dTX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfQURNSU59L3dzL3YyJwogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hcHBmbG93eV93ZWI6MC45LjEzMicKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBwZmxvd3lfY2xvdWQKICBhcHBmbG93eV9jbG91ZDoKICAgIGltYWdlOiAnYXBwZmxvd3lpbmMvYXBwZmxvd3lfY2xvdWQ6MC45LjE0OScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1pbmZvfScKICAgICAgLSAnQVBQRkxPV1lfQkFTRV9VUkw9JHtTRVJWSUNFX1VSTF9BRE1JTn0nCiAgICAgIC0gQVBQRkxPV1lfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtICdBUFBGTE9XWV9EQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUkVESVNfVVJJPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD1odHRwOi8vZ290cnVlOjk5OTknCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0NSRUFURV9CVUNLRVQ9JHtBUFBGTE9XWV9TM19DUkVBVEVfQlVDS0VUOi10cnVlfScKICAgICAgLSBBUFBGTE9XWV9TM19VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBUFBGTE9XWV9TM19NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0JVQ0tFVD0ke0FQUEZMT1dZX1MzX0JVQ0tFVDotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9TM19SRUdJT049JHtBUFBGTE9XWV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX0hPU1Q9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX1BPUlQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRT0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1VTRVJOQU1FOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX0VNQUlMOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1BBU1NXT1JEOi1lbWFpbF9zZW5kZXJfcGFzc3dvcmR9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1RMU19LSU5EOi1ub25lfScKICAgICAgLSBBUFBGTE9XWV9BQ0NFU1NfQ09OVFJPTD10cnVlCiAgICAgIC0gQVBQRkxPV1lfREFUQUJBU0VfTUFYX0NPTk5FQ1RJT05TPTQwCiAgICAgIC0gQUlfU0VSVkVSX0hPU1Q9YWkKICAgICAgLSBBSV9TRVJWRVJfUE9SVD01MDAxCiAgICAgIC0gJ0FJX09QRU5BSV9BUElfS0VZPSR7QUlfT1BFTkFJX0FQSV9LRVk6LX0nCiAgICAgIC0gJ0FQUEZMT1dZX1dFQl9VUkw9JHtTRVJWSUNFX1VSTF9BUFBGTE9XWVdFQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2N1cmwgLS1mYWlsIGh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9hcGkvaGVhbHRoIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICBkZXBlbmRzX29uOgogICAgICBnb3RydWU6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICBnb3RydWU6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2dvdHJ1ZTowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR09UUlVFX0FQSV9IT1NUPTAuMC4wLjAKICAgICAgLSBHT1RSVUVfQVBJX1BPUlQ9OTk5OQogICAgICAtIFBPUlQ9OTk5OQogICAgICAtICdHT1RSVUVfQURNSU5fRU1BSUw9JHtHT1RSVUVfQURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSAnR09UUlVFX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gR09UUlVFX0RJU0FCTEVfU0lHTlVQPWZhbHNlCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD1hcHBmbG93eS1mbHV0dGVyOi8vJwogICAgICAtICdHT1RSVUVfVVJJX0FMTE9XX0xJU1Q9KionCiAgICAgIC0gJ0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdHT1RSVUVfSldUX0VYUD0ke0dPVFJVRV9KV1RfRVhQOi03MjAwfScKICAgICAgLSBHT1RSVUVfREJfRFJJVkVSPXBvc3RncmVzCiAgICAgIC0gJ0FQSV9FWFRFUk5BTF9VUkw9JHtTRVJWSUNFX1VSTF9BRE1JTn0vZ290cnVlJwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fT9zZWFyY2hfcGF0aD1hdXRoJwogICAgICAtICdHT1RSVUVfU01UUF9IT1NUPSR7R09UUlVFX1NNVFBfSE9TVH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BPUlQ9JHtHT1RSVUVfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdHT1RSVUVfU01UUF9VU0VSPSR7R09UUlVFX1NNVFBfVVNFUn0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BBU1M9JHtHT1RSVUVfU01UUF9QQVNTfScKICAgICAgLSBHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTj0vdmVyaWZ5CiAgICAgIC0gR09UUlVFX01BSUxFUl9VUkxQQVRIU19JTlZJVEU9L3ZlcmlmeQogICAgICAtIEdPVFJVRV9NQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk9L3ZlcmlmeQogICAgICAtIEdPVFJVRV9NQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFPS92ZXJpZnkKICAgICAgLSAnR09UUlVFX1NNVFBfQURNSU5fRU1BSUw9JHtHT1RSVUVfU01UUF9BRE1JTl9FTUFJTH0nCiAgICAgIC0gR09UUlVFX1NNVFBfTUFYX0ZSRVFVRU5DWT0xbnMKICAgICAgLSBHT1RSVUVfUkFURV9MSU1JVF9FTUFJTF9TRU5UPTEwMAogICAgICAtIEdPVFJVRV9NQUlMRVJfQVVUT0NPTkZJUk09dHJ1ZQogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnY3VybCAtLWZhaWwgaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogIGFkbWluX2Zyb250ZW5kOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hZG1pbl9mcm9udGVuZDowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0FQUEZMT1dZX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfQURNSU59JwogICAgZGVwZW5kc19vbjoKICAgICAgZ290cnVlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcGZsb3d5X2Nsb3VkOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgYWk6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FwcGZsb3d5X2FpOjAuOS4xNDknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnT1BFTkFJX0FQSV9LRVk9JHtBSV9PUEVOQUlfQVBJX0tFWTotfScKICAgICAgLSBBSV9TRVJWRVJfUE9SVD01MDAxCiAgICAgIC0gREVGQVVMVF9BSV9NT0RFTD1ncHQtNC4xLW1pbmkKICAgICAgLSBERUZBVUxUX0FJX0NPTVBMRVRJT05fTU9ERUw9Z3B0LTQuMS1taW5pCiAgICAgIC0gJ0FJX0FQUEZMT1dZX0hPU1Q9JHtTRVJWSUNFX1VSTF9BUFBGTE9XWVdFQn0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdBWlVSRV9PUEVOQUlfQVBJX0tFWT0ke0FaVVJFX09QRU5BSV9BUElfS0VZfScKICAgICAgLSAnQVpVUkVfT1BFTkFJX0VORFBPSU5UPSR7QVpVUkVfT1BFTkFJX0VORFBPSU5UfScKICAgICAgLSAnQVpVUkVfT1BFTkFJX0FQSV9WRVJTSU9OPSR7QVpVUkVfT1BFTkFJX0FQSV9WRVJTSU9OfScKICAgICAgLSAnQVBQRkxPV1lfUzNfQUNDRVNTX0tFWT0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX1NFQ1JFVF9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnQVBQRkxPV1lfUzNfQlVDS0VUPSR7QVBQRkxPV1lfUzNfQlVDS0VUOi1hcHBmbG93eX0nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX1JFR0lPTj0ke0FQUEZMT1dZX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnQUlfREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gJ0FJX1JFRElTX1VSTD1yZWRpczovL3JlZGlzOjYzNzknCiAgICAgIC0gQUlfVVNFX01JTklPPXRydWUKICAgICAgLSAnQUlfTUlOSU9fVVJMPWh0dHA6Ly9taW5pbzo5MDAwJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhcHBmbG93eV93b3JrZXI6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FwcGZsb3d5X3dvcmtlcjowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUlVTVF9MT0c9aW5mbwogICAgICAtIEFQUEZMT1dZX0VOVklST05NRU5UPXByb2R1Y3Rpb24KICAgICAgLSBBUFBGTE9XWV9XT1JLRVJfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtICdBUFBGTE9XWV9XT1JLRVJfUkVESVNfVVJMPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSAnQVBQRkxPV1lfV09SS0VSX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9XT1JLRVJfREFUQUJBU0VfTkFNRT0ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gQVBQRkxPV1lfV09SS0VSX0lNUE9SVF9USUNLX0lOVEVSVkFMPTMwCiAgICAgIC0gQVBQRkxPV1lfUzNfVVNFX01JTklPPXRydWUKICAgICAgLSAnQVBQRkxPV1lfUzNfTUlOSU9fVVJMPWh0dHA6Ly9taW5pbzo5MDAwJwogICAgICAtICdBUFBGTE9XWV9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVBQRkxPV1lfUzNfU0VDUkVUX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19CVUNLRVQ9JHtBUFBGTE9XWV9TM19CVUNLRVQ6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUzNfUkVHSU9OPSR7QVBQRkxPV1lfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUPSR7QVBQRkxPV1lfTUFJTEVSX1NNVFBfSE9TVDotc210cC5nbWFpbC5jb219JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUPSR7QVBQRkxPV1lfTUFJTEVSX1NNVFBfUE9SVDotNTg3fScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfVVNFUk5BTUU9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRTotbm90aWZ5QGFwcGZsb3d5LmlvfScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfRU1BSUw9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTDotbm90aWZ5QGFwcGZsb3d5LmlvfScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfUEFTU1dPUkQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRDotZW1haWxfc2VuZGVyX3Bhc3N3b3JkfScKICAgICAgLSAnQVBQRkxPV1lfTUFJTEVSX1NNVFBfVExTX0tJTkQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORDotbm9uZX0nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZAogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW9fZGF0YTovZGF0YScKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncGd2ZWN0b3IvcGd2ZWN0b3I6cGcxNicKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYXBwZmxvd3l9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtIFBPU1RHUkVTX0hPU1Q9cG9zdGdyZXMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzX2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBnX2lzcmVhZHkKICAgICAgICAtICctVScKICAgICAgICAtICcke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgICAgLSAnLWQnCiAgICAgICAgLSAnJHtQT1NUR1JFU19EQjotYXBwZmxvd3l9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTIKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6OC4yLjItYWxwaW5lMy4yMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzX2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3JlZGlzLWNsaSAtaCBsb2NhbGhvc3QgLXAgNjM3OSBwaW5nJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "appflowy",
             "notion",
@@ -162,7 +162,7 @@
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
         "slogan": "A backend-as-a-service platform that simplifies the web & mobile app development.",
-        "compose": "c2VydmljZXM6CiAgYXBwd3JpdGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQVBQV1JJVEU9L3YxCiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0VYRUNVVElPTlNfRFVBTF9XUklURT0ke19BUFBfRVhFQ1VUSU9OU19EVUFMX1dSSVRFOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9FWEVDVVRJT05TPWh0dHA6Ly9hcHB3cml0ZTokU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFQGFwcHdyaXRlLWNsaWNraG91c2U6ODEyMy9hcHB3cml0ZScKICAgICAgLSAnX0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUz0ke19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM6LTJ9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9UVEw9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9UVEw6LTE4MH0nCiAgICAgIC0gJ19BUFBfU1RBVFNfVVNBR0VfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfVVNBR0VfUVVFVUVfTkFNRTotdjEtc3RhdHMtdXNhZ2V9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRTotdjEtc3RhdHMtcmVzb3VyY2VzfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTDotMzYwMH0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9QT09MX0FEQVBURVI9JHtfQVBQX1BPT0xfQURBUFRFUjotc3RhY2t9JwogICAgICAtICdfQVBQX0xPQ0FMRT0ke19BUFBfTE9DQUxFOi1lbn0nCiAgICAgIC0gJ19BUFBfQ09NUFJFU1NJT05fRU5BQkxFRD0ke19BUFBfQ09NUFJFU1NJT05fRU5BQkxFRDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09NUFJFU1NJT05fTUlOX1NJWkVfQllURVM9JHtfQVBQX0NPTVBSRVNTSU9OX01JTl9TSVpFX0JZVEVTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9ST09UPSR7X0FQUF9DT05TT0xFX1dISVRFTElTVF9ST09UOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9FTUFJTFM9JHtfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0VNQUlMU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9TRVNTSU9OX0FMRVJUUz0ke19BUFBfQ09OU09MRV9TRVNTSU9OX0FMRVJUUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0lQUz0ke19BUFBfQ09OU09MRV9XSElURUxJU1RfSVBTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0hPU1ROQU1FUz0ke19BUFBfQ09OU09MRV9IT1NUTkFNRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRIVUJfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUSFVCX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HSVRIVUJfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVExBQl9BUFBfSUQ9JHtfQVBQX0NPTlNPTEVfR0lUTEFCX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRMQUJfU0VDUkVUPSR7X0FQUF9DT05TT0xFX0dJVExBQl9TRUNSRVR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUTEFCX0VORFBPSU5UPSR7X0FQUF9DT05TT0xFX0dJVExBQl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9CSVRCVUNLRVRfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0JJVEJVQ0tFVF9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQklUQlVDS0VUX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9CSVRCVUNLRVRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dPT0dMRV9BUFBfSUQ9JHtfQVBQX0NPTlNPTEVfR09PR0xFX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HT09HTEVfU0VDUkVUPSR7X0FQUF9DT05TT0xFX0dPT0dMRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9OQU1FPSR7X0FQUF9TWVNURU1fRU1BSUxfTkFNRTotQXBwd3JpdGV9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTPSR7X0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUzotbm9yZXBseUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU1lTVEVNX1RFQU1fRU1BSUw9JHtfQVBQX1NZU1RFTV9URUFNX0VNQUlMOi10ZWFtQGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9FTUFJTF9TRUNVUklUWT0ke19BUFBfRU1BSUxfU0VDVVJJVFk6LXNlY3VyaXR5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TWVNURU1fUkVTUE9OU0VfRk9STUFUPSR7X0FQUF9TWVNURU1fUkVTUE9OU0VfRk9STUFUfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0FCVVNFPSR7X0FQUF9PUFRJT05TX0FCVVNFOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0FCVVNFX0lOQ1JFQVNFRF9MSU1JVF9QUk9KRUNUUz0ke19BUFBfT1BUSU9OU19BQlVTRV9JTkNSRUFTRURfTElNSVRfUFJPSkVDVFN9JwogICAgICAtICdfQVBQX09QVElPTlNfUk9VVEVSX1BST1RFQ1RJT049JHtfQVBQX09QVElPTlNfUk9VVEVSX1BST1RFQ1RJT046LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX1JPVVRFUl9GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9ST1VURVJfQVVUT19DRVJUSUZJQ0FURVM9JHtfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUzotZGlzYWJsZWR9JwogICAgICAtIF9BUFBfT1BFTlNTTF9LRVlfVjE9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfQVBQV1JJVEUKICAgICAgLSBfQVBQX05PVElGSUNBVElPTlNfVFJBQ0tJTkdfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X05PVElGSUNBVElPTlMKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSBfQVBQX0NPTlNPTEVfVVJMX1NDSEVNRT1yb290CiAgICAgIC0gJ19BUFBfQ09OU09MRV9UUlVTVEVEX1BST0pFQ1RTPSR7X0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFN9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX1NNVFBfSE9TVD0ke19BUFBfU01UUF9IT1NUfScKICAgICAgLSAnX0FQUF9TTVRQX1BPUlQ9JHtfQVBQX1NNVFBfUE9SVH0nCiAgICAgIC0gJ19BUFBfU01UUF9TRUNVUkU9JHtfQVBQX1NNVFBfU0VDVVJFfScKICAgICAgLSAnX0FQUF9TTVRQX1VTRVJOQU1FPSR7X0FQUF9TTVRQX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9TTVRQX1BBU1NXT1JEPSR7X0FQUF9TTVRQX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTUlUPSR7X0FQUF9TVE9SQUdFX0xJTUlUOi0zMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9QUkVWSUVXX0xJTUlUPSR7X0FQUF9TVE9SQUdFX1BSRVZJRVdfTElNSVQ6LTIwMDAwMDAwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVUz0ke19BUFBfU1RPUkFHRV9BTlRJVklSVVM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVU19IT1NUPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVU19IT1NUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVU19QT1JUPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVU19QT1JUOi0zMzEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9TSVpFX0xJTUlUPSR7X0FQUF9DT01QVVRFX1NJWkVfTElNSVQ6LTMwMDAwMDAwfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTPSR7X0FQUF9GVU5DVElPTlNfUlVOVElNRVM6LW5vZGUtMjJ9JwogICAgICAtICdfQVBQX1NJVEVTX1JVTlRJTUVTPSR7X0FQUF9TSVRFU19SVU5USU1FUzotc3RhdGljLTEsbm9kZS0yMn0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gJ19BUFBfRVhFQ1VUT1JfSE9TVD0ke19BUFBfRVhFQ1VUT1JfSE9TVDotaHR0cDovL29wZW5ydW50aW1lcy1leGVjdXRvci92MX0nCiAgICAgIC0gJ19BUFBfQlVJTERTX1ZPTFVNRT0ke0NPTVBPU0VfUFJPSkVDVF9OQU1FfV9hcHB3cml0ZS1idWlsZHMnCiAgICAgIC0gJ19BUFBfSk9CU19IT1NUPSR7X0FQUF9KT0JTX0hPU1Q6LWh0dHA6Ly9vcmNoZXN0cmF0b3I6ODA4MH0nCiAgICAgIC0gX0FQUF9KT0JTX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9KT0JTCiAgICAgIC0gJ19BUFBfSk9CU19FTkRQT0lOVD0ke19BUFBfSk9CU19FTkRQT0lOVDotaHR0cDovL2FwcHdyaXRlfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0NPTkZJRz0ke19BUFBfTE9HR0lOR19DT05GSUd9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSAnX0FQUF9MT0NLSU5HX0VOQUJMRUQ9JHtfQVBQX0xPQ0tJTkdfRU5BQkxFRDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX0hPVVJMWT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX0hPVVJMWTotODY0MDAwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX1NNU19QUk9WSURFUj0ke19BUFBfU01TX1BST1ZJREVSfScKICAgICAgLSAnX0FQUF9TTVNfRlJPTT0ke19BUFBfU01TX0ZST019JwogICAgICAtICdfQVBQX0dSQVBIUUxfSU5UUk9TUEVDVElPTj0ke19BUFBfR1JBUEhRTF9JTlRST1NQRUNUSU9OOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX01BWF9CQVRDSF9TSVpFPSR7X0FQUF9HUkFQSFFMX01BWF9CQVRDSF9TSVpFOi0xMH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfQ09NUExFWElUWT0ke19BUFBfR1JBUEhRTF9NQVhfQ09NUExFWElUWTotMjUwfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX01BWF9ERVBUSD0ke19BUFBfR1JBUEhRTF9NQVhfREVQVEg6LTN9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQVBQX05BTUU9JHtfQVBQX1ZDU19HSVRIVUJfQVBQX05BTUV9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfUFJJVkFURV9LRVk9JHtfQVBQX1ZDU19HSVRIVUJfUFJJVkFURV9LRVl9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQVBQX0lEPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEhVQl9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lURUFfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9CUk9XU0VSX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVEVBX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRFQV9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVExBQl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVExBQl9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfSUQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9DTElFTlRfSUQ9JHtfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfT1JJR0lOX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfT1JJR0lOX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfV0VCSE9PS19VUkw9JHtfQVBQX1ZDU19XRUJIT09LX1VSTH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQVNTSVNUQU5UX09QRU5BSV9BUElfS0VZPSR7X0FQUF9BU1NJU1RBTlRfT1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQ09VTlRSSUVTX0RFTllMSVNUPSR7X0FQUF9DT05TT0xFX0NPVU5UUklFU19ERU5ZTElTVH0nCiAgICAgIC0gJ19BUFBfRVhQRVJJTUVOVF9MT0dHSU5HX1BST1ZJREVSPSR7X0FQUF9FWFBFUklNRU5UX0xPR0dJTkdfUFJPVklERVJ9JwogICAgICAtICdfQVBQX0VYUEVSSU1FTlRfTE9HR0lOR19DT05GSUc9JHtfQVBQX0VYUEVSSU1FTlRfTE9HR0lOR19DT05GSUd9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9OQU1FU1BBQ0U9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9OQU1FU1BBQ0V9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19DUkVBVElPTl9BQlVTRV9MSU1JVD0ke19BUFBfRlVOQ1RJT05TX0NSRUFUSU9OX0FCVVNFX0xJTUlUfScKICAgICAgLSAnX0FQUF9DVVNUT01fRE9NQUlOX0RFTllfTElTVD0ke19BUFBfQ1VTVE9NX0RPTUFJTl9ERU5ZX0xJU1Q6LWV4YW1wbGUuY29tLHRlc3QuY29tLGFwcC5leGFtcGxlLmNvbX0nCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9IRUFERVJTPSR7X0FQUF9UUlVTVEVEX0hFQURFUlM6LXgtZm9yd2FyZGVkLWZvcn0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9HRU9fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0dFTwogICAgICAtICdfQVBQX0dFT19FTkRQT0lOVD0ke19BUFBfR0VPX0VORFBPSU5UOi1odHRwOi8vYXBwd3JpdGUtZ2VvL3YxfScKICAgICAgLSAnX0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSD0ke19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g6LTEwMH0nCiAgICAgIC0gJ19BUFBfRE9DVU1FTlRTREI9JHtfQVBQX0RPQ1VNRU5UU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfVkVDVE9SU0RCPSR7X0FQUF9WRUNUT1JTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9FTUJFRERJTkc9JHtfQVBQX0VNQkVERElORzotZGlzYWJsZWR9JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtdXBsb2Fkczovc3RvcmFnZS91cGxvYWRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1pbXBvcnRzOi9zdG9yYWdlL2ltcG9ydHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNhY2hlOi9zdG9yYWdlL2NhY2hlOnJ3JwogICAgICAtICdhcHB3cml0ZS1jb25maWc6L3N0b3JhZ2UvY29uZmlnOnJ3JwogICAgICAtICdhcHB3cml0ZS1jZXJ0aWZpY2F0ZXM6L3N0b3JhZ2UvY2VydGlmaWNhdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1mdW5jdGlvbnM6L3N0b3JhZ2UvZnVuY3Rpb25zOnJ3JwogICAgICAtICdhcHB3cml0ZS1zaXRlczovc3RvcmFnZS9zaXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgIGRlcGVuZHNfb246CiAgICAgIGFwcHdyaXRlLXBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1nZW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1vIC9kZXYvbnVsbCBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aC92ZXJzaW9uIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA2CiAgICAgIHN0YXJ0X3BlcmlvZDogMTIwcwogIGFwcHdyaXRlLWNvbnNvbGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL25ldzoxLjEuMTYnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9BUFBXUklURV8zMDAwPS8KICAgICAgLSBWSVRFX0NPTlNPTEVfUFJPRklMRT1zZWxmLWhvc3RlZAogICAgICAtIEFQUFdSSVRFX0VORFBPSU5UX1NBTUVfT1JJR0lOPXRydWUKICAgICAgLSAnVklURV9HUk9XVEhfRU5EUE9JTlQ9JHtWSVRFX0dST1dUSF9FTkRQT0lOVDotaHR0cHM6Ly9ncm93dGguYXBwd3JpdGUuaW8vdjF9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGU6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnYnVuIC1lICJmZXRjaCgnJ2h0dHA6Ly9sb2NhbGhvc3Q6MzAwMCcnKS50aGVuKHIgPT4gcHJvY2Vzcy5leGl0KHIuc3RhdHVzIDwgNTAwID8gMCA6IDEpKS5jYXRjaCgoKSA9PiBwcm9jZXNzLmV4aXQoMSkpIicKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtcmVhbHRpbWU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW50cnlwb2ludDogcmVhbHRpbWUKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FQUFdSSVRFPS92MS9yZWFsdGltZQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTj0ke19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfSE9TVE5BTUVTPSR7X0FQUF9DT05TT0xFX0hPU1ROQU1FU30nCiAgICAgIC0gJ19BUFBfUkVBTFRJTUVfVEFJTF9SQVRFPSR7X0FQUF9SRUFMVElNRV9UQUlMX1JBVEU6LTUwfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUdfUkVBTFRJTUU9JHtfQVBQX0xPR0dJTkdfQ09ORklHX1JFQUxUSU1FfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSD0ke19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g6LTEwMH0nCiAgICAgIC0gJ19BUFBfRE9DVU1FTlRTREI9JHtfQVBQX0RPQ1VNRU5UU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfVkVDVE9SU0RCPSR7X0FQUF9WRUNUT1JTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9FTUJFRERJTkc9JHtfQVBQX0VNQkVERElORzotZGlzYWJsZWR9JwogICAgICAtIF9BUFBfUE9PTF9BREFQVEVSPXN3b29sZQogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1zIGxvY2FsaG9zdCA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLXdvcmtlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi4wLjAnCiAgICBlbnRyeXBvaW50OiB3b3JrZXIKICAgIGVudmlyb25tZW50OgogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9FWEVDVVRJT05TX0RVQUxfV1JJVEU9JHtfQVBQX0VYRUNVVElPTlNfRFVBTF9XUklURTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfRVhFQ1VUSU9OUz1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM9JHtfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TOi0yfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMOi0xODB9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU6LXYxLXN0YXRzLXJlc291cmNlc30nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw6LTM2MDB9JwogICAgICAtIF9BUFBfV09SS0VSU19OVU09MQogICAgICAtIF9BUFBfV09SS0VSX01BWF9DT1JPVVRJTkVTPTc4CiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX1BPT0xfQURBUFRFUj0ke19BUFBfUE9PTF9BREFQVEVSOi1zdGFja30nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX0VNQUlMX1NFQ1VSSVRZPSR7X0FQUF9FTUFJTF9TRUNVUklUWTotc2VjdXJpdHlAYXBwd3JpdGUuaW99JwogICAgICAtICdfQVBQX0VNQUlMX0NFUlRJRklDQVRFUz0ke19BUFBfRU1BSUxfQ0VSVElGSUNBVEVTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0NPTkZJRz0ke19BUFBfTE9HR0lOR19DT05GSUd9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSAnX0FQUF9MT0dHSU5HX1BST1ZJREVSPSR7X0FQUF9MT0dHSU5HX1BST1ZJREVSfScKICAgICAgLSAnX0FQUF9RVUVVRV9OQU1FPSR7X0FQUF9RVUVVRV9OQU1FfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSBfQVBQX0NPTlNPTEVfVVJMX1NDSEVNRT1yb290CiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX1JPVVRFUl9GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9XRUJIT09LX01BWF9GQUlMRURfQVRURU1QVFM9JHtfQVBQX1dFQkhPT0tfTUFYX0ZBSUxFRF9BVFRFTVBUUzotMTB9JwogICAgICAtICdfQVBQX1NUT1JBR0VfREVWSUNFPSR7X0FQUF9TVE9SQUdFX0RFVklDRTotbG9jYWx9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9TM19TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9TM19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlQ9JHtfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT049JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfUkVHSU9OOi11cy13ZXN0LTAwNH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9MSU5PREVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT049JHtfQVBQX1NUT1JBR0VfTElOT0RFX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9XQVNBQklfUkVHSU9OOi1ldS1jZW50cmFsLTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfQlVDS0VUfScKICAgICAgLSBfQVBQX0VYRUNVVE9SX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9FWEVDVVRPUgogICAgICAtICdfQVBQX0VYRUNVVE9SX0hPU1Q9JHtfQVBQX0VYRUNVVE9SX0hPU1Q6LWh0dHA6Ly9vcGVucnVudGltZXMtZXhlY3V0b3IvdjF9JwogICAgICAtICdfQVBQX0RPQ0tFUl9IVUJfVVNFUk5BTUU9JHtfQVBQX0RPQ0tFUl9IVUJfVVNFUk5BTUV9JwogICAgICAtICdfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkQ9JHtfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkR9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19USU1FT1VUPSR7X0FQUF9GVU5DVElPTlNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9TSVRFU19USU1FT1VUPSR7X0FQUF9TSVRFU19USU1FT1VUOi05MDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVD0ke19BUFBfQ09NUFVURV9CVUlMRF9USU1FT1VUOi0yNzAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0NQVVM9JHtfQVBQX0NPTVBVVEVfQ1BVUzotMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9NRU1PUlk9JHtfQVBQX0NPTVBVVEVfTUVNT1JZOi0wfScKICAgICAgLSAnX0FQUF9PUEVOX1JVTlRJTUVTX05GVD0ke19BUFBfT1BFTl9SVU5USU1FU19ORlQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0NPTVBVVEVfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9TSVpFX0xJTUlUOi0zMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9BUFBfTkFNRT0ke19BUFBfVkNTX0dJVEhVQl9BUFBfTkFNRX0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX0dJVEhVQl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9BUFBfSUQ9JHtfQVBQX1ZDU19HSVRIVUJfQVBQX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRFQV9CUk9XU0VSX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEVBX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lUTEFCX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVExBQl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX1dFQkhPT0tfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX1dFQkhPT0tfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRD0ke19BUFBfVkNTX09SSUdJTl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fUFJJVkFURV9LRVk9JHtfQVBQX1ZDU19PUklHSU5fUFJJVkFURV9LRVl9JwogICAgICAtICdfQVBQX1ZDU19XRUJIT09LX1VSTD0ke19BUFBfVkNTX1dFQkhPT0tfVVJMfScKICAgICAgLSAnX0FQUF9CVUlMRFNfVk9MVU1FPSR7Q09NUE9TRV9QUk9KRUNUX05BTUV9X2FwcHdyaXRlLWJ1aWxkcycKICAgICAgLSAnX0FQUF9KT0JTX0hPU1Q9JHtfQVBQX0pPQlNfSE9TVDotaHR0cDovL29yY2hlc3RyYXRvcjo4MDgwfScKICAgICAgLSBfQVBQX0pPQlNfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0pPQlMKICAgICAgLSAnX0FQUF9KT0JTX0VORFBPSU5UPSR7X0FQUF9KT0JTX0VORFBPSU5UOi1odHRwOi8vYXBwd3JpdGV9JwogICAgICAtICdfQVBQX0JST1dTRVJfSE9TVD0ke19BUFBfQlJPV1NFUl9IT1NUOi1odHRwOi8vYXBwd3JpdGUtYnJvd3NlcjozMDAwL3YxfScKICAgICAgLSAnX0FQUF9XT1JLRVJfU0NSRUVOU0hPVFNfUk9VVEVSPSR7X0FQUF9XT1JLRVJfU0NSRUVOU0hPVFNfUk9VVEVSOi1odHRwOi8vYXBwd3JpdGV9JwogICAgICAtIF9BUFBfTk9USUZJQ0FUSU9OU19UUkFDS0lOR19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfTk9USUZJQ0FUSU9OUwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9OQU1FPSR7X0FQUF9TWVNURU1fRU1BSUxfTkFNRTotQXBwd3JpdGV9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTPSR7X0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUzotbm9yZXBseUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU01UUF9IT1NUPSR7X0FQUF9TTVRQX0hPU1R9JwogICAgICAtICdfQVBQX1NNVFBfUE9SVD0ke19BUFBfU01UUF9QT1JUfScKICAgICAgLSAnX0FQUF9TTVRQX1NFQ1VSRT0ke19BUFBfU01UUF9TRUNVUkV9JwogICAgICAtICdfQVBQX1NNVFBfVVNFUk5BTUU9JHtfQVBQX1NNVFBfVVNFUk5BTUV9JwogICAgICAtICdfQVBQX1NNVFBfUEFTU1dPUkQ9JHtfQVBQX1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdfQVBQX1NNU19GUk9NPSR7X0FQUF9TTVNfRlJPTX0nCiAgICAgIC0gJ19BUFBfU01TX1BST1ZJREVSPSR7X0FQUF9TTVNfUFJPVklERVJ9JwogICAgICAtICdfQVBQX1NNU19QUk9KRUNUU19ERU5ZX0xJU1Q9JHtfQVBQX1NNU19QUk9KRUNUU19ERU5ZX0xJU1R9JwogICAgICAtICdfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfU0VDUkVUPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX01JR1JBVElPTl9IT1NUPSR7X0FQUF9NSUdSQVRJT05fSE9TVDotYXBwd3JpdGV9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEV9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICB2b2x1bWVzOgogICAgICAtICdhcHB3cml0ZS11cGxvYWRzOi9zdG9yYWdlL3VwbG9hZHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWltcG9ydHM6L3N0b3JhZ2UvaW1wb3J0czpydycKICAgICAgLSAnYXBwd3JpdGUtY2FjaGU6L3N0b3JhZ2UvY2FjaGU6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNvbmZpZzovc3RvcmFnZS9jb25maWc6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNlcnRpZmljYXRlczovc3RvcmFnZS9jZXJ0aWZpY2F0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWZ1bmN0aW9uczovc3RvcmFnZS9mdW5jdGlvbnM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLXNpdGVzOi9zdG9yYWdlL3NpdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1idWlsZHM6L3N0b3JhZ2UvYnVpbGRzOnJ3JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9wZW5ydW50aW1lcy1leGVjdXRvcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBvcmNoZXN0cmF0b3I6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAicHMgYXV4IHwgZ3JlcCAtcSAnW3BdaHAnIHx8IGV4aXQgMSIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtdGFzay1zY2hlZHVsZXI6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW50cnlwb2ludDogc2NoZWR1bGUKICAgIGVudmlyb25tZW50OgogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9FWEVDVVRJT05TX0RVQUxfV1JJVEU9JHtfQVBQX0VYRUNVVElPTlNfRFVBTF9XUklURTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfRVhFQ1VUSU9OUz1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM9JHtfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TOi0yfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMOi0xODB9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU6LXYxLXN0YXRzLXJlc291cmNlc30nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw6LTM2MDB9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSBfQVBQX1dPUktFUl9NQVhfQ09ST1VUSU5FUz04CiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX1BPT0xfQURBUFRFUj0ke19BUFBfUE9PTF9BREFQVEVSOi1zdGFja30nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX09QVElPTlNfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfRk9SQ0VfSFRUUFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ9JHtfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ6LTB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLW1haW50ZW5hbmNlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjAuMCcKICAgIGVudHJ5cG9pbnQ6IG1haW50ZW5hbmNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9QT09MX0FEQVBURVI9JHtfQVBQX1BPT0xfQURBUFRFUjotc3RhY2t9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NOQU1FPSR7X0FQUF9ET01BSU5fVEFSR0VUX0NOQU1FOi1sb2NhbGhvc3R9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBOi06OjF9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9BOi0xMjcuMC4wLjF9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0NBQX0nCiAgICAgIC0gJ19BUFBfRE5TPSR7X0FQUF9ETlN9JwogICAgICAtICdfQVBQX0RPTUFJTl9GVU5DVElPTlM9JHtfQVBQX0RPTUFJTl9GVU5DVElPTlM6LWZ1bmN0aW9ucy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9FRElUSU9OPSR7X0FQUF9FRElUSU9OOi1zZWxmLWhvc3RlZH0nCiAgICAgIC0gJ19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTPSR7X0FQUF9ST1VURVJfQVVUT19DRVJUSUZJQ0FURVM6LWRpc2FibGVkfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9JTlRFUlZBTD0ke19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw6LTg2NDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fRVhFQ1VUSU9OPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fRVhFQ1VUSU9OOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9DQUNIRTotMjU5MjAwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQUJVU0U6LTg2NDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVDotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEU9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfSE9VUkxZPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfSE9VUkxZOi04NjQwMDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fU0NIRURVTEVTPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fU0NIRURVTEVTOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfU1RBUlRfVElNRT0ke19BUFBfTUFJTlRFTkFOQ0VfU1RBUlRfVElNRX0nCiAgICAgIC0gJ19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFUz0ke19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFU30nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgLXEgJ1twXWhwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLXRhc2staW50ZXJ2YWw6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW50cnlwb2ludDogaW50ZXJ2YWwKICAgIGVudmlyb25tZW50OgogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX1BPT0xfQURBUFRFUj0ke19BUFBfUE9PTF9BREFQVEVSOi1zdGFja30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9JTlRFUlZBTF9ET01BSU5fVkVSSUZJQ0FUSU9OPSR7X0FQUF9JTlRFUlZBTF9ET01BSU5fVkVSSUZJQ0FUSU9OOi0xMjB9JwogICAgICAtICdfQVBQX0lOVEVSVkFMX0NMRUFOVVBfU1RBTEVfRVhFQ1VUSU9OUz0ke19BUFBfSU5URVJWQUxfQ0xFQU5VUF9TVEFMRV9FWEVDVVRJT05TOi0zMDB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS1nZW86CiAgICBpbWFnZTogJ2FwcHdyaXRlL2dlbzowLjMuMScKICAgIGVudmlyb25tZW50OgogICAgICAtIEdFT19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfR0VPCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBocCAtciBcImV4aXQoanNvbl9kZWNvZGUoZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9sb2NhbGhvc3QvdjEvaGVhbHRoJykpLT5zdGF0dXMgPT09ICdvaycgPyAwIDogMSk7XCIiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGFwcHdyaXRlLWFzc2lzdGFudDoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXNzaXN0YW50OjAuOC40JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfQVNTSVNUQU5UX09QRU5BSV9BUElfS0VZPSR7X0FQUF9BU1NJU1RBTlRfT1BFTkFJX0FQSV9LRVl9JwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgYXBwd3JpdGUtYnJvd3NlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYnJvd3NlcjowLjMuNCcKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogIG9wZW5ydW50aW1lcy1leGVjdXRvcjoKICAgIGltYWdlOiAnb3BlbnJ1bnRpbWVzL2V4ZWN1dG9yOjAuMjkuMCcKICAgIGhvc3RuYW1lOiBvcGVucnVudGltZXMtZXhlY3V0b3IKICAgIHN0b3Bfc2lnbmFsOiBTSUdJTlQKICAgIGVudmlyb25tZW50OgogICAgICAtICdPUFJfRVhFQ1VUT1JfSU1BR0VTPSR7X0FQUF9FWEVDVVRPUl9JTUFHRVM6LW9wZW5ydW50aW1lcy9ub2RlOnY1LTIyLG9wZW5ydW50aW1lcy9zdGF0aWM6djUtMX0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9JTkFDVElWRV9USFJFU0hPTEQ9JHtfQVBQX0NPTVBVVEVfSU5BQ1RJVkVfVEhSRVNIT0xEOi02MDB9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX0NPTVBVVEVfTUFJTlRFTkFOQ0VfSU5URVJWQUw6LTYwMH0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9ORVRXT1JLPSR7X0FQUF9DT01QVVRFX1JVTlRJTUVTX05FVFdPUks6LXJ1bnRpbWVzfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0RPQ0tFUl9IVUJfVVNFUk5BTUU9JHtfQVBQX0RPQ0tFUl9IVUJfVVNFUk5BTUV9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfRE9DS0VSX0hVQl9QQVNTV09SRD0ke19BUFBfRE9DS0VSX0hVQl9QQVNTV09SRH0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9SVU5USU1FUz0ke19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTOi1ub2RlLTIyfSwke19BUFBfU0lURVNfUlVOVElNRVM6LXN0YXRpYy0xLG5vZGUtMjJ9JwogICAgICAtIE9QUl9FWEVDVVRPUl9TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfRVhFQ1VUT1IKICAgICAgLSBPUFJfRVhFQ1VUT1JfUlVOVElNRV9WRVJTSU9OUz12NQogICAgICAtICdPUEVOX1JVTlRJTUVTX05GVD0ke19BUFBfT1BFTl9SVU5USU1FU19ORlQ6LWVuYWJsZWR9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0NPTk5FQ1RJT05fU1RPUkFHRT0ke19BUFBfRVhFQ1VUT1JfQ09OTkVDVElPTl9TVE9SQUdFOi1sb2NhbDovL2xvY2FsaG9zdH0nCiAgICAgIC0gT1BSX0VYRUNVVE9SX0NPTk5FQ1RJT05fQlVJTERfQ0FDSEVfU1RPUkFHRT0KICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAtICdhcHB3cml0ZS1idWlsZHM6L3N0b3JhZ2UvYnVpbGRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1mdW5jdGlvbnM6L3N0b3JhZ2UvZnVuY3Rpb25zOnJ3JwogICAgICAtICdhcHB3cml0ZS1zaXRlczovc3RvcmFnZS9zaXRlczpydycKICAgICAgLSAnL3RtcDovdG1wOnJ3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mc1MgLUggIkF1dGhvcml6YXRpb246IEJlYXJlciAkJE9QUl9FWEVDVVRPUl9TRUNSRVQiIGh0dHA6Ly9sb2NhbGhvc3QvdjEvaGVhbHRoID4gL2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgb3JjaGVzdHJhdG9yOgogICAgaW1hZ2U6ICdnaGNyLmlvL29wZW4tcnVudGltZXMvb3JjaGVzdHJhdG9yL29yY2hlc3RyYXRvcjoyLjAuMScKICAgIGhvc3RuYW1lOiBvcmNoZXN0cmF0b3IKICAgIHVzZXI6IHJvb3QKICAgIGVudmlyb25tZW50OgogICAgICAtIE9SQ0hFU1RSQVRPUl9CQUNLRU5EPWRvY2tlcgogICAgICAtICdPUkNIRVNUUkFUT1JfTkVUV09SSz0ke0NPTVBPU0VfUFJPSkVDVF9OQU1FfScKICAgICAgLSAnRE9DS0VSX05FVFdPUks9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX0nCiAgICAgIC0gJ0FSVElGQUNUX0VORFBPSU5UPWh0dHA6Ly9vcmNoZXN0cmF0b3I6ODA4MCcKICAgICAgLSAnUzNfRU5EUE9JTlQ9JHtfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlR9JwogICAgICAtICdTM19SRUdJT049JHtfQVBQX1NUT1JBR0VfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdTM19BQ0NFU1NfS0VZX0lEPSR7X0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVl9JwogICAgICAtICdTM19TRUNSRVRfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9TM19TRUNSRVR9JwogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL2tvLWFwcC9vcmNoZXN0cmF0b3IKICAgICAgICAtICctY2hlY2stcmVhZHknCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGFwcHdyaXRlLXBvc3RncmVzcWw6CiAgICBpbWFnZTogJ2FwcHdyaXRlL3Bvc3RncmVzOjAuMS4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBQT1NUR1JFU19VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBQT1NUR1JFU19QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtcG9zdGdyZXNxbDovdmFyL2xpYi9wb3N0Z3Jlc3FsOnJ3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGFwcHdyaXRlLXJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQuNy1hbHBpbmUnCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tbWF4bWVtb3J5IDUxMm1iIC0tbWF4bWVtb3J5LXBvbGljeSBhbGxrZXlzLWxydSAtLW1heG1lbW9yeS1zYW1wbGVzIDUnCiAgICB2b2x1bWVzOgogICAgICAtICdhcHB3cml0ZS1yZWRpczovZGF0YTpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQogIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjYuNC4zLWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtIENMSUNLSE9VU0VfREI9YXBwd3JpdGUKICAgICAgLSBDTElDS0hPVVNFX1VTRVI9YXBwd3JpdGUKICAgICAgLSBDTElDS0hPVVNFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSBDTElDS0hPVVNFX0RFRkFVTFRfQUNDRVNTX01BTkFHRU1FTlQ9MQogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtY2xpY2tob3VzZTovdmFyL2xpYi9jbGlja2hvdXNlOnJ3JwogICAgdWxpbWl0czoKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjbGlja2hvdXNlLWNsaWVudCAtLXVzZXIgIiQkQ0xJQ0tIT1VTRV9VU0VSIiAtLXBhc3N3b3JkICIkJENMSUNLSE9VU0VfUEFTU1dPUkQiIC0tcXVlcnkgIlNFTEVDVCAxIiA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMjAKICAgICAgc3RhcnRfcGVyaW9kOiAzMHMK",
+        "compose": "c2VydmljZXM6CiAgYXBwd3JpdGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuNS4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQVBQV1JJVEU9L3YxCiAgICAgIC0gJ19BUFBfRE5TX0VYVEVSTkFMPSR7X0FQUF9ETlNfRVhURVJOQUx9JwogICAgICAtICdfQVBQX0FMTE9XRURfSU5URVJOQUxfQUREUkVTU0VTPSR7X0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFU30nCiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSAnX0FQUF9FRElUSU9OPSR7X0FQUF9FRElUSU9OOi1zZWxmLWhvc3RlZH0nCiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX0xPQ0FMRT0ke19BUFBfTE9DQUxFOi1lbn0nCiAgICAgIC0gJ19BUFBfQ09NUFJFU1NJT05fRU5BQkxFRD0ke19BUFBfQ09NUFJFU1NJT05fRU5BQkxFRDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09NUFJFU1NJT05fTUlOX1NJWkVfQllURVM9JHtfQVBQX0NPTVBSRVNTSU9OX01JTl9TSVpFX0JZVEVTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9ST09UPSR7X0FQUF9DT05TT0xFX1dISVRFTElTVF9ST09UOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9FTUFJTFM9JHtfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0VNQUlMU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9TRVNTSU9OX0FMRVJUUz0ke19BUFBfQ09OU09MRV9TRVNTSU9OX0FMRVJUUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0lQUz0ke19BUFBfQ09OU09MRV9XSElURUxJU1RfSVBTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0hPU1ROQU1FUz0ke19BUFBfQ09OU09MRV9IT1NUTkFNRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRIVUJfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUSFVCX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HSVRIVUJfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVExBQl9BUFBfSUQ9JHtfQVBQX0NPTlNPTEVfR0lUTEFCX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRMQUJfU0VDUkVUPSR7X0FQUF9DT05TT0xFX0dJVExBQl9TRUNSRVR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUTEFCX0VORFBPSU5UPSR7X0FQUF9DT05TT0xFX0dJVExBQl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9CSVRCVUNLRVRfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0JJVEJVQ0tFVF9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQklUQlVDS0VUX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9CSVRCVUNLRVRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dPT0dMRV9BUFBfSUQ9JHtfQVBQX0NPTlNPTEVfR09PR0xFX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HT09HTEVfU0VDUkVUPSR7X0FQUF9DT05TT0xFX0dPT0dMRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9OQU1FPSR7X0FQUF9TWVNURU1fRU1BSUxfTkFNRTotQXBwd3JpdGV9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTPSR7X0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUzotbm9yZXBseUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU1lTVEVNX1RFQU1fRU1BSUw9JHtfQVBQX1NZU1RFTV9URUFNX0VNQUlMOi10ZWFtQGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9FTUFJTF9TRUNVUklUWT0ke19BUFBfRU1BSUxfU0VDVVJJVFk6LXNlY3VyaXR5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TWVNURU1fUkVTUE9OU0VfRk9STUFUPSR7X0FQUF9TWVNURU1fUkVTUE9OU0VfRk9STUFUfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0FCVVNFPSR7X0FQUF9PUFRJT05TX0FCVVNFOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0FCVVNFX0lOQ1JFQVNFRF9MSU1JVF9QUk9KRUNUUz0ke19BUFBfT1BUSU9OU19BQlVTRV9JTkNSRUFTRURfTElNSVRfUFJPSkVDVFN9JwogICAgICAtICdfQVBQX09QVElPTlNfUk9VVEVSX1BST1RFQ1RJT049JHtfQVBQX09QVElPTlNfUk9VVEVSX1BST1RFQ1RJT046LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTPSR7X0FQUF9ST1VURVJfQVVUT19DRVJUSUZJQ0FURVM6LWRpc2FibGVkfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0NPTlNPTEVfRE9NQUlOPSR7X0FQUF9DT05TT0xFX0RPTUFJTn0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9VUkw9JHtfQVBQX0NPTlNPTEVfVVJMfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfU01UUF9IT1NUPSR7X0FQUF9TTVRQX0hPU1R9JwogICAgICAtICdfQVBQX1NNVFBfUE9SVD0ke19BUFBfU01UUF9QT1JUfScKICAgICAgLSAnX0FQUF9TTVRQX1NFQ1VSRT0ke19BUFBfU01UUF9TRUNVUkV9JwogICAgICAtICdfQVBQX1NNVFBfVVNFUk5BTUU9JHtfQVBQX1NNVFBfVVNFUk5BTUV9JwogICAgICAtICdfQVBQX1NNVFBfUEFTU1dPUkQ9JHtfQVBQX1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElNSVQ9JHtfQVBQX1NUT1JBR0VfTElNSVQ6LTMwMDAwMDAwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1BSRVZJRVdfTElNSVQ9JHtfQVBQX1NUT1JBR0VfUFJFVklFV19MSU1JVDotMjAwMDAwMDB9JwogICAgICAtICdfQVBQX0FVVE9HUkFWSVRZX0hPU1Q9JHtfQVBQX0FVVE9HUkFWSVRZX0hPU1R9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQU5USVZJUlVTPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQU5USVZJUlVTX0hPU1Q9JHtfQVBQX1NUT1JBR0VfQU5USVZJUlVTX0hPU1R9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQU5USVZJUlVTX1BPUlQ9JHtfQVBQX1NUT1JBR0VfQU5USVZJUlVTX1BPUlQ6LTMzMTB9JwogICAgICAtICdfQVBQX1NUT1JBR0VfREVWSUNFPSR7X0FQUF9TVE9SQUdFX0RFVklDRTotbG9jYWx9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9TM19TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9TM19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlQ9JHtfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT049JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfUkVHSU9OOi11cy13ZXN0LTAwNH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9MSU5PREVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT049JHtfQVBQX1NUT1JBR0VfTElOT0RFX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9XQVNBQklfUkVHSU9OOi1ldS1jZW50cmFsLTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfQlVDS0VUfScKICAgICAgLSAnX0FQUF9DT01QVVRFX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfU0laRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9CVUlMRF9TSVpFX0xJTUlUOi0yMDAwMDAwMDAwfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTPSR7X0FQUF9GVU5DVElPTlNfUlVOVElNRVM6LW5vZGUtMjJ9JwogICAgICAtICdfQVBQX1NJVEVTX1JVTlRJTUVTPSR7X0FQUF9TSVRFU19SVU5USU1FUzotc3RhdGljLTEsbm9kZS0yMn0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gJ19BUFBfRVhFQ1VUT1JfSE9TVD0ke19BUFBfRVhFQ1VUT1JfSE9TVDotaHR0cDovL29wZW5ydW50aW1lcy1leGVjdXRvci92MX0nCiAgICAgIC0gJ19BUFBfQlVJTERTX1ZPTFVNRT0ke0NPTVBPU0VfUFJPSkVDVF9OQU1FfV9hcHB3cml0ZS1idWlsZHMnCiAgICAgIC0gJ19BUFBfSk9CU19IT1NUPSR7X0FQUF9KT0JTX0hPU1Q6LWh0dHA6Ly9vcmNoZXN0cmF0b3I6ODA4MH0nCiAgICAgIC0gX0FQUF9KT0JTX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9KT0JTCiAgICAgIC0gJ19BUFBfSk9CU19FTkRQT0lOVD0ke19BUFBfSk9CU19FTkRQT0lOVDotaHR0cDovL2FwcHdyaXRlfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0NPTkZJRz0ke19BUFBfTE9HR0lOR19DT05GSUd9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSAnX0FQUF9MT0NLSU5HX0VOQUJMRUQ9JHtfQVBQX0xPQ0tJTkdfRU5BQkxFRDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX1NNU19QUk9WSURFUj0ke19BUFBfU01TX1BST1ZJREVSfScKICAgICAgLSAnX0FQUF9TTVNfRlJPTT0ke19BUFBfU01TX0ZST019JwogICAgICAtICdfQVBQX0dSQVBIUUxfSU5UUk9TUEVDVElPTj0ke19BUFBfR1JBUEhRTF9JTlRST1NQRUNUSU9OOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX01BWF9CQVRDSF9TSVpFPSR7X0FQUF9HUkFQSFFMX01BWF9CQVRDSF9TSVpFOi0xMH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfQ09NUExFWElUWT0ke19BUFBfR1JBUEhRTF9NQVhfQ09NUExFWElUWTotMjUwfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX01BWF9ERVBUSD0ke19BUFBfR1JBUEhRTF9NQVhfREVQVEg6LTN9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQVBQX05BTUU9JHtfQVBQX1ZDU19HSVRIVUJfQVBQX05BTUV9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfUFJJVkFURV9LRVk9JHtfQVBQX1ZDU19HSVRIVUJfUFJJVkFURV9LRVl9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQVBQX0lEPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEhVQl9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lURUFfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9CUk9XU0VSX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVEVBX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRFQV9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVExBQl9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVExBQl9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfSUQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9XRUJIT09LX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9DTElFTlRfSUQ9JHtfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfT1JJR0lOX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfT1JJR0lOX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfV0VCSE9PS19VUkw9JHtfQVBQX1ZDU19XRUJIT09LX1VSTH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9DT1VOVFJJRVNfREVOWUxJU1Q9JHtfQVBQX0NPTlNPTEVfQ09VTlRSSUVTX0RFTllMSVNUfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfTkFNRVNQQUNFPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfTkFNRVNQQUNFfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfQ1JFQVRJT05fQUJVU0VfTElNSVQ9JHtfQVBQX0ZVTkNUSU9OU19DUkVBVElPTl9BQlVTRV9MSU1JVH0nCiAgICAgIC0gJ19BUFBfQ1VTVE9NX0RPTUFJTl9ERU5ZX0xJU1Q9JHtfQVBQX0NVU1RPTV9ET01BSU5fREVOWV9MSVNUOi1leGFtcGxlLmNvbSx0ZXN0LmNvbSxhcHAuZXhhbXBsZS5jb219JwogICAgICAtICdfQVBQX1RSVVNURURfSEVBREVSUz0ke19BUFBfVFJVU1RFRF9IRUFERVJTOi14LWZvcndhcmRlZC1mb3J9JwogICAgICAtICdfQVBQX1RSVVNURURfUFJPWElFUz0ke19BUFBfVFJVU1RFRF9QUk9YSUVTOi0xMjcuMC4wLjEsOjoxLDEwLjAuMC4wLzgsMTAwLjY0LjAuMC8xMCwxNzIuMTYuMC4wLzEyLDE5Mi4xNjguMC4wLzE2fScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0dFT19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfR0VPCiAgICAgIC0gJ19BUFBfR0VPX0VORFBPSU5UPSR7X0FQUF9HRU9fRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZS1nZW8vdjF9JwogICAgICAtICdfQVBQX1BXTkVEX1BBU1NXT1JEU19EU049JHtfQVBQX1BXTkVEX1BBU1NXT1JEU19EU046LW5vbmU6Ly9sb2NhbGhvc3R9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICB2b2x1bWVzOgogICAgICAtICdhcHB3cml0ZS11cGxvYWRzOi9zdG9yYWdlL3VwbG9hZHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWltcG9ydHM6L3N0b3JhZ2UvaW1wb3J0czpydycKICAgICAgLSAnYXBwd3JpdGUtY2FjaGU6L3N0b3JhZ2UvY2FjaGU6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNvbmZpZzovc3RvcmFnZS9jb25maWc6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNlcnRpZmljYXRlczovc3RvcmFnZS9jZXJ0aWZpY2F0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWZ1bmN0aW9uczovc3RvcmFnZS9mdW5jdGlvbnM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLXNpdGVzOi9zdG9yYWdlL3NpdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1idWlsZHM6L3N0b3JhZ2UvYnVpbGRzOnJ3JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWdlbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mc1MgLW8gL2Rldi9udWxsIGh0dHA6Ly9sb2NhbGhvc3QvdjEvaGVhbHRoL3ZlcnNpb24gfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDYKICAgICAgc3RhcnRfcGVyaW9kOiAxMjBzCiAgYXBwd3JpdGUtY29uc29sZToKICAgIGltYWdlOiAnYXBwd3JpdGUvbmV3OjEuMi43NC1zZWxmLWhvc3RlZCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FQUFdSSVRFXzMwMDA9LwogICAgICAtIFZJVEVfQ09OU09MRV9QUk9GSUxFPXNlbGYtaG9zdGVkCiAgICAgIC0gVklURV9BUFBXUklURV9WRVJTSU9OPTIuNS4wCiAgICAgIC0gQVBQV1JJVEVfRU5EUE9JTlRfU0FNRV9PUklHSU49dHJ1ZQogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGU6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnYnVuIC1lICJmZXRjaCgnJ2h0dHA6Ly9sb2NhbGhvc3Q6MzAwMCcnKS50aGVuKHIgPT4gcHJvY2Vzcy5leGl0KHIuc3RhdHVzIDwgNTAwID8gMCA6IDEpKS5jYXRjaCgoKSA9PiBwcm9jZXNzLmV4aXQoMSkpIicKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtcmVhbHRpbWU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuNS4wJwogICAgZW50cnlwb2ludDogcmVhbHRpbWUKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0FQUFdSSVRFPS92MS9yZWFsdGltZQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTj0ke19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfSE9TVE5BTUVTPSR7X0FQUF9DT05TT0xFX0hPU1ROQU1FU30nCiAgICAgIC0gJ19BUFBfUkVBTFRJTUVfVEFJTF9SQVRFPSR7X0FQUF9SRUFMVElNRV9UQUlMX1JBVEU6LTUwfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9IRUFERVJTPSR7X0FQUF9UUlVTVEVEX0hFQURFUlM6LXgtZm9yd2FyZGVkLWZvcn0nCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9QUk9YSUVTPSR7X0FQUF9UUlVTVEVEX1BST1hJRVM6LTEyNy4wLjAuMSw6OjEsMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4xNi4wLjAvMTIsMTkyLjE2OC4wLjAvMTZ9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgbG9jYWxob3N0ID4gL2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtd29ya2VyOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IHdvcmtlcgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX0ROU19FWFRFUk5BTD0ke19BUFBfRE5TX0VYVEVSTkFMfScKICAgICAgLSAnX0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFUz0ke19BUFBfQUxMT1dFRF9JTlRFUk5BTF9BRERSRVNTRVN9JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSBfQVBQX1dPUktFUlNfTlVNPTEKICAgICAgLSBfQVBQX1dPUktFUl9NQVhfQ09ST1VUSU5FUz03OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfQ0VSVElGSUNBVEVTPSR7X0FQUF9FTUFJTF9DRVJUSUZJQ0FURVN9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1FVRVVFX05BTUU9JHtfQVBQX1FVRVVFX05BTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfVVJMPSR7X0FQUF9DT05TT0xFX1VSTH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfV0VCSE9PS19NQVhfRkFJTEVEX0FUVEVNUFRTPSR7X0FQUF9XRUJIT09LX01BWF9GQUlMRURfQVRURU1QVFM6LTEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gX0FQUF9FWEVDVVRPUl9TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfRVhFQ1VUT1IKICAgICAgLSAnX0FQUF9FWEVDVVRPUl9IT1NUPSR7X0FQUF9FWEVDVVRPUl9IT1NUOi1odHRwOi8vb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yL3YxfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEPSR7X0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT01QVVRFX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfU0laRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9CVUlMRF9TSVpFX0xJTUlUOi0yMDAwMDAwMDAwfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfQlJPV1NFUl9IT1NUPSR7X0FQUF9CUk9XU0VSX0hPU1Q6LWh0dHA6Ly9hcHB3cml0ZS1icm93c2VyOjMwMDAvdjF9JwogICAgICAtICdfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI9JHtfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX05BTUU9JHtfQVBQX1NZU1RFTV9FTUFJTF9OQU1FOi1BcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M9JHtfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTOi1ub3JlcGx5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TTVRQX0hPU1Q9JHtfQVBQX1NNVFBfSE9TVH0nCiAgICAgIC0gJ19BUFBfU01UUF9QT1JUPSR7X0FQUF9TTVRQX1BPUlR9JwogICAgICAtICdfQVBQX1NNVFBfU0VDVVJFPSR7X0FQUF9TTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ19BUFBfU01UUF9VU0VSTkFNRT0ke19BUFBfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ19BUFBfU01UUF9QQVNTV09SRD0ke19BUFBfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVD0ke19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g9JHtfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIOi0xMDB9JwogICAgICAtICdfQVBQX0RPQ1VNRU5UU0RCPSR7X0FQUF9ET0NVTUVOVFNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1ZFQ1RPUlNEQj0ke19BUFBfVkVDVE9SU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfRU1CRURESU5HPSR7X0FQUF9FTUJFRERJTkc6LWRpc2FibGVkfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXVwbG9hZHM6L3N0b3JhZ2UvdXBsb2FkczpydycKICAgICAgLSAnYXBwd3JpdGUtaW1wb3J0czovc3RvcmFnZS9pbXBvcnRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1jYWNoZTovc3RvcmFnZS9jYWNoZTpydycKICAgICAgLSAnYXBwd3JpdGUtY29uZmlnOi9zdG9yYWdlL2NvbmZpZzpydycKICAgICAgLSAnYXBwd3JpdGUtY2VydGlmaWNhdGVzOi9zdG9yYWdlL2NlcnRpZmljYXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWJ1aWxkczovc3RvcmFnZS9idWlsZHM6cncnCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9yY2hlc3RyYXRvcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLXNjaGVkdWxlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi41LjAnCiAgICBlbnRyeXBvaW50OiBzY2hlZHVsZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gX0FQUF9XT1JLRVJfTUFYX0NPUk9VVElORVM9OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ9JHtfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ6LTB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLW1haW50ZW5hbmNlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IG1haW50ZW5hbmNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUz0ke19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTOi1kaXNhYmxlZH0nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUU9JHtfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLWludGVydmFsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IGludGVydmFsCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfT1BFTlNTTF9LRVlfVjE9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfQVBQV1JJVEUKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT049JHtfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT046LTEyMH0nCiAgICAgIC0gJ19BUFBfSU5URVJWQUxfQ0xFQU5VUF9TVEFMRV9FWEVDVVRJT05TPSR7X0FQUF9JTlRFUlZBTF9DTEVBTlVQX1NUQUxFX0VYRUNVVElPTlM6LTMwMH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgLXEgJ1twXWhwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLWdlbzoKICAgIGltYWdlOiAnYXBwd3JpdGUvZ2VvOjAuMy4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR0VPX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9HRU8KICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAicGhwIC1yIFwiZXhpdChqc29uX2RlY29kZShmaWxlX2dldF9jb250ZW50cygnaHR0cDovL2xvY2FsaG9zdC92MS9oZWFsdGgnKSktPnN0YXR1cyA9PT0gJ29rJyA/IDAgOiAxKTtcIiIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgYXBwd3JpdGUtYnJvd3NlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYnJvd3NlcjowLjMuNicKICAgIGVudmlyb25tZW50OgogICAgICAtIEFMTE9XRURfSE9TVFM9YXBwd3JpdGUKICAgIGRuczoKICAgICAgLSAxLjEuMS4xCiAgICAgIC0gOC44LjguOAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgaW1hZ2U6ICdvcGVucnVudGltZXMvZXhlY3V0b3I6MS4xLjInCiAgICBob3N0bmFtZTogb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yCiAgICBzdG9wX3NpZ25hbDogU0lHSU5UCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnT1BSX0VYRUNVVE9SX0lNQUdFUz0ke19BUFBfRVhFQ1VUT1JfSU1BR0VTOi1vcGVucnVudGltZXMvbm9kZTp2NS0yMixvcGVucnVudGltZXMvc3RhdGljOnY1LTF9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfSU5BQ1RJVkVfVEhSRVNIT0xEPSR7X0FQUF9DT01QVVRFX0lOQUNUSVZFX1RIUkVTSE9MRDotNjAwfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9DT01QVVRFX01BSU5URU5BTkNFX0lOVEVSVkFMOi02MDB9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTkVUV09SSz0ke19BUFBfQ09NUFVURV9SVU5USU1FU19ORVRXT1JLOi1ydW50aW1lc30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0RPQ0tFUl9IVUJfUEFTU1dPUkQ9JHtfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkR9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdPUFJfRVhFQ1VUT1JfUlVOVElNRVM9JHtfQVBQX0ZVTkNUSU9OU19SVU5USU1FUzotbm9kZS0yMn0sJHtfQVBQX1NJVEVTX1JVTlRJTUVTOi1zdGF0aWMtMSxub2RlLTIyfScKICAgICAgLSBPUFJfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gT1BSX0VYRUNVVE9SX1JVTlRJTUVfVkVSU0lPTlM9djUKICAgICAgLSAnT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9DT05ORUNUSU9OX1NUT1JBR0U9JHtfQVBQX0VYRUNVVE9SX0NPTk5FQ1RJT05fU1RPUkFHRTotbG9jYWw6Ly9sb2NhbGhvc3R9JwogICAgICAtIE9QUl9FWEVDVVRPUl9DT05ORUNUSU9OX0JVSUxEX0NBQ0hFX1NUT1JBR0U9CiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJy90bXA6L3RtcDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1IICJBdXRob3JpemF0aW9uOiBCZWFyZXIgJCRPUFJfRVhFQ1VUT1JfU0VDUkVUIiBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aCA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG9yY2hlc3RyYXRvcjoKICAgIGltYWdlOiAnZ2hjci5pby9vcGVuLXJ1bnRpbWVzL29yY2hlc3RyYXRvci9vcmNoZXN0cmF0b3I6Mi4yLjInCiAgICBob3N0bmFtZTogb3JjaGVzdHJhdG9yCiAgICB1c2VyOiByb290CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBPUkNIRVNUUkFUT1JfQkFDS0VORD1kb2NrZXIKICAgICAgLSAnT1JDSEVTVFJBVE9SX05FVFdPUks9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX0nCiAgICAgIC0gJ0RPQ0tFUl9ORVRXT1JLPSR7Q09NUE9TRV9QUk9KRUNUX05BTUV9JwogICAgICAtICdBUlRJRkFDVF9FTkRQT0lOVD1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODAnCiAgICAgIC0gJ1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnUzNfQUNDRVNTX0tFWV9JRD0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnUzNfU0VDUkVUX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9rby1hcHAvb3JjaGVzdHJhdG9yCiAgICAgICAgLSAnLWNoZWNrLXJlYWR5JwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9wb3N0Z3JlczowLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXBvc3RncmVzcWw6L3Zhci9saWIvcG9zdGdyZXNxbDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTAKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1yZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LjctYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLW1heG1lbW9yeSA1MTJtYiAtLW1heG1lbW9yeS1wb2xpY3kgYWxsa2V5cy1scnUgLS1tYXhtZW1vcnktc2FtcGxlcyA1JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtcmVkaXM6L2RhdGE6cncnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUKICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI2LjQuMy1hbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBDTElDS0hPVVNFX0RCPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9VU0VSPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gQ0xJQ0tIT1VTRV9ERUZBVUxUX0FDQ0VTU19NQU5BR0VNRU5UPTEKICAgICAgLSBDTElDS0hPVVNFX0FMV0FZU19SVU5fSU5JVERCX1NDUklQVFM9MQogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtY2xpY2tob3VzZTovdmFyL2xpYi9jbGlja2hvdXNlOnJ3JwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvYXBwd3JpdGUueG1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIjw/eG1sIHZlcnNpb249XCIxLjBcIj8+XG48IS0tXG4gICAgUmV0ZW50aW9uIGZvciBDbGlja0hvdXNlJ3Mgb3duIHN5c3RlbSBsb2cgdGFibGVzLlxuXG4gICAgRXZlcnkgPHR0bD4gaW4gdGhlIGltYWdlJ3MgY29uZmlnLnhtbCBzaXRzIGluc2lkZSBhbiBYTUwgY29tbWVudCwgc28gdGhlc2VcbiAgICB0YWJsZXMga2VlcCBldmVyeSByb3cgZm9yZXZlciwgYW5kIHRoZSBtZXRyaWMgb25lcyBhZGQgYSByb3cgcGVyIHNlY29uZFxuICAgIHdoZXRoZXIgb3Igbm90IHRoZSBpbnN0YW5jZSBzZXJ2ZXMgdHJhZmZpYy4gTGVmdCBhbG9uZSB0aGV5IG91dGdyb3cgdGhlXG4gICAgdXNhZ2UgZGF0YSB0aGV5IHNpdCBuZXh0IHRvIGFuZCBmaWxsIHRoZSB2b2x1bWUuXG5cbiAgICBXaGVuIGEgd2luZG93IGhlcmUgY2hhbmdlcywgQ2xpY2tIb3VzZSByZXBsYWNlcyB0aGUgdGFibGUgb24gdGhlIG5leHRcbiAgICByZXN0YXJ0IGFuZCBrZWVwcyB0aGUgb2xkIG9uZSwgcm93cyBhbmQgYWxsLCBhcyA8bG9nPl88Tj4uXG4gICAgY2xpY2tob3VzZS1pbml0LnNoIGdpdmVzIHRob3NlIG9sZCB0YWJsZXMgdGhlIHNhbWUgd2luZG93LlxuLS0+XG48Y2xpY2tob3VzZT5cbiAgICA8IS0tIFRoZSBtZXRyaWMsIHRyYWNlIGFuZCBwcm9maWxlIGxvZ3Mgc2FtcGxlIHRoZSBzZXJ2ZXIgZXZlcnkgc2Vjb25kIHdoZXRoZXJcbiAgICAgICAgIG9yIG5vdCBBcHB3cml0ZSBzZXJ2ZXMgdHJhZmZpYywgYW5kIG5vdGhpbmcgcmVhZHMgdGhlbSBiYWNrLCBzbyB0aGVpclxuICAgICAgICAgd3JpdGVzIGFuZCB0aGUgbWVyZ2VzIGJlaGluZCB0aGVtIGFyZSBwdXJlIG92ZXJoZWFkLiAtLT5cbiAgICA8YXN5bmNocm9ub3VzX21ldHJpY19sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxoaXN0b2dyYW1fbWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxxdWVyeV9tZXRyaWNfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPHByb2Nlc3NvcnNfcHJvZmlsZV9sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPCEtLSB0ZXh0X2xvZyByZXBlYXRzIHRoZSBzZXJ2ZXIgbG9nIHRoZSBjb250YWluZXIgYWxyZWFkeSB3cml0ZXMuIC0tPlxuICAgIDx0ZXh0X2xvZyByZW1vdmU9XCIxXCIvPlxuXG4gICAgPCEtLSBLZXB0IGZvciBkZWJ1Z2dpbmcsIGNhcHBlZCBzbyB0aGV5IGNhbm5vdCBmaWxsIHRoZSB2b2x1bWUuIC0tPlxuICAgIDxhc3luY2hyb25vdXNfaW5zZXJ0X2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAzIERBWSBERUxFVEU8L3R0bD48L2FzeW5jaHJvbm91c19pbnNlcnRfbG9nPlxuICAgIDxxdWVyeV9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9xdWVyeV9sb2c+XG4gICAgPHF1ZXJ5X3ZpZXdzX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3ZpZXdzX2xvZz5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3RocmVhZF9sb2c+XG4gICAgPHBhcnRfbG9nPjx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDcgREFZIERFTEVURTwvdHRsPjwvcGFydF9sb2c+XG4gICAgPGJhY2tncm91bmRfc2NoZWR1bGVfcG9vbF9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9iYWNrZ3JvdW5kX3NjaGVkdWxlX3Bvb2xfbG9nPlxuXG4gICAgPCEtLSBMb25nZXIsIHNvIGl0IHN0aWxsIGNvdmVycyBhIHJlcG9ydCB0aGF0IHJlYWNoZXMgdXMgbGF0ZS4gY3Jhc2hfbG9nIGlzXG4gICAgICAgICBkZWxpYmVyYXRlbHkgbGVmdCBhbG9uZTogaXQgaXMgdGlueSBhbmQgd29ydGgga2VlcGluZy4gLS0+XG4gICAgPGVycm9yX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxNCBEQVkgREVMRVRFPC90dGw+PC9lcnJvcl9sb2c+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICIjIS9iaW4vYmFzaFxuIyBUaGUgQ2xpY2tIb3VzZSBlbnRyeXBvaW50IHNvdXJjZXMgdGhpcyBmaWxlLCBzbyBhIHN1YnNoZWxsIGtlZXBzIHRoZXNlIG9wdGlvbnMgb3V0IG9mIGl0LlxuKFxuICBzZXQgLWV1byBwaXBlZmFpbFxuXG4gIGNsaWVudCgpIHtcbiAgICBjbGlja2hvdXNlLWNsaWVudCAtLWhvc3QgMTI3LjAuMC4xIC0tdXNlciBcIiRDTElDS0hPVVNFX1VTRVJcIiAtLXBhc3N3b3JkIFwiJENMSUNLSE9VU0VfUEFTU1dPUkRcIiBcIiRAXCJcbiAgfVxuXG4gICMgRmx1c2hpbmcgcmVwbGFjZXMgbG9nIHRhYmxlcyB3aG9zZSBkZWZpbml0aW9uIGNoYW5nZWQsIGtlZXBpbmcgZWFjaCBvbGQgdGFibGUgYXMgPGxvZz5fPE4+LlxuICBjbGllbnQgLS1xdWVyeSAnU1lTVEVNIEZMVVNIIExPR1MnXG5cbiAgIyBUYWJsZXMgbGVmdCBiZWhpbmQgbmV2ZXIgZXhwaXJlIG9uIHRoZWlyIG93bjogdGFrZSB0aGUgVFRMIG9mIHRoZSBsb2cgdGhhdFxuICAjIHJlcGxhY2VkIHRoaXMgb25lLCBvciBhIHdlZWsgd2hlbiB0aGUgbG9nIGlzIG5vIGxvbmdlciB3cml0dGVuIGF0IGFsbC5cbiAgIyBUaGUgbmFtZWQgbG9ncyBtdXN0IG1hdGNoIHRoZSBvbmVzIGNsaWNraG91c2UtY29uZmlnLnhtbCByZW1vdmVzOiBhIGxvZyB0aGF0XG4gICMgaXMgc3RpbGwgd3JpdHRlbiBnZXRzIHJlcGxhY2VkIG9uIHRoZSBuZXh0IHJlc3RhcnQgaWYgaXRzIFRUTCBpcyBhbHRlcmVkIGhlcmUuXG4gIGNsaWVudCAtLWZvcm1hdCBUU1ZSYXcgPDwnU1FMJyB8IGNsaWVudCAtLW11bHRpcXVlcnlcblNFTEVDVCBjb25jYXQoJ0FMVEVSIFRBQkxFIHN5c3RlbS4nLCBzdGFsZS5uYW1lLCAnIE1PRElGWSBUVEwgJywgaWYoYWN0aXZlLm5hbWUgPSAnJywgJ2V2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEUnLCBzcGxpdEJ5U3RyaW5nKCcgU0VUVElOR1MgJywgc3BsaXRCeVN0cmluZygnIFRUTCAnLCBhY3RpdmUuZW5naW5lX2Z1bGwpWzJdKVsxXSksICc7JylcbkZST00gKFxuICBTRUxFQ1QgbmFtZSwgc3BsaXRCeUNoYXIoJ18nLCBuYW1lKVstMV0gQVMgc3VmZml4LCBhcnJheVN0cmluZ0NvbmNhdChhcnJheVBvcEJhY2soc3BsaXRCeUNoYXIoJ18nLCBuYW1lKSksICdfJykgQVMgbG9nXG4gIEZST00gc3lzdGVtLnRhYmxlc1xuICBXSEVSRSBkYXRhYmFzZSA9ICdzeXN0ZW0nXG4gICAgQU5EIHBvc2l0aW9uKGVuZ2luZV9mdWxsLCAnIFRUTCAnKSA9IDBcbiAgICBBTkQgZW5kc1dpdGgoZW5naW5lLCAnTWVyZ2VUcmVlJylcbiAgICBBTkQgbmFtZSBJTiAoU0VMRUNUIHRhYmxlIEZST00gc3lzdGVtLmNvbHVtbnMgV0hFUkUgZGF0YWJhc2UgPSAnc3lzdGVtJyBBTkQgbmFtZSA9ICdldmVudF9kYXRlJyBBTkQgdHlwZSA9ICdEYXRlJylcbikgQVMgc3RhbGVcbkxFRlQgSk9JTiBzeXN0ZW0udGFibGVzIEFTIGFjdGl2ZVxuICBPTiBhY3RpdmUuZGF0YWJhc2UgPSAnc3lzdGVtJ1xuICBBTkQgYWN0aXZlLm5hbWUgPSBzdGFsZS5sb2dcbiAgQU5EIHBvc2l0aW9uKGFjdGl2ZS5lbmdpbmVfZnVsbCwgJyBUVEwgJykgPiAwXG5XSEVSRSAoZW5kc1dpdGgoc3RhbGUubG9nLCAnX2xvZycpIEFORCB0b1VJbnQ2NE9yTnVsbChzdGFsZS5zdWZmaXgpIElTIE5PVCBOVUxMKVxuICBPUiBzdGFsZS5uYW1lIElOICgnYXN5bmNocm9ub3VzX21ldHJpY19sb2cnLCAnbWV0cmljX2xvZycsICdoaXN0b2dyYW1fbWV0cmljX2xvZycsICdxdWVyeV9tZXRyaWNfbG9nJywgJ3Byb2Nlc3NvcnNfcHJvZmlsZV9sb2cnLCAndHJhY2VfbG9nJywgJ3RleHRfbG9nJylcblNRTFxuKSIKICAgIHVsaW1pdHM6CiAgICAgIG5vZmlsZToKICAgICAgICBzb2Z0OiAyNjIxNDQKICAgICAgICBoYXJkOiAyNjIxNDQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY2xpY2tob3VzZS1jbGllbnQgLS11c2VyICIkJENMSUNLSE9VU0VfVVNFUiIgLS1wYXNzd29yZCAiJCRDTElDS0hPVVNFX1BBU1NXT1JEIiAtLXF1ZXJ5ICJTRUxFQ1QgMSIgPiAvZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDIwCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCg==",
         "tags": [
             "backend",
             "backend-as-a-service",
@@ -172,7 +172,7 @@
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
         "template_last_updated_at": "2026-09-08T19:41:04+02:00",
-        "port": "3003"
+        "port": "80"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -404,7 +404,7 @@
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
         "slogan": "Low code platform for building business apps and workflows in minutes. Supports PostgreSQL, MySQL, MSSQL, MongoDB, Rest API, Docker, K8s, and more.",
-        "compose": "c2VydmljZXM6CiAgYXBwLXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UuZG9ja2VyLnNjYXJmLnNoL2J1ZGliYXNlL2FwcHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFTEZfSE9TVEVEPTEKICAgICAgLSAnQ09VQ0hfREJfVVJMPWh0dHA6Ly8kU0VSVklDRV9VU0VSX0NPVUNIREI6JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQkBjb3VjaGRiLXNlcnZpY2U6NTk4NCcKICAgICAgLSAnV09SS0VSX1VSTD1odHRwOi8vd29ya2VyLXNlcnZpY2U6NDAwMycKICAgICAgLSAnTUlOSU9fVVJMPWh0dHA6Ly9taW5pby1zZXJ2aWNlOjkwMDAnCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdCVURJQkFTRV9FTlZJUk9OTUVOVD0ke0JVRElCQVNFX0VOVklST05NRU5UOi1QUk9EVUNUSU9OfScKICAgICAgLSBQT1JUPTQwMDIKICAgICAgLSBBUElfRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFQVBJCiAgICAgIC0gRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFCiAgICAgIC0gSldUX1NFQ1JFVD0kU0VSVklDRV9CQVNFNjRfNjRfQlVESUJBU0VKV1QKICAgICAgLSBMT0dfTEVWRUw9aW5mbwogICAgICAtICdFTkFCTEVfQU5BTFlUSUNTPSR7RU5BQkxFX0FOQUxZVElDUzotdHJ1ZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpcy1zZXJ2aWNlOjYzNzknCiAgICAgIC0gUkVESVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMKICAgICAgLSBCQl9BRE1JTl9VU0VSX0VNQUlMPQogICAgICAtIEJCX0FETUlOX1VTRVJfUEFTU1dPUkQ9CiAgICBkZXBlbmRzX29uOgogICAgICAtIHdvcmtlci1zZXJ2aWNlCiAgICAgIC0gcmVkaXMtc2VydmljZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICctcU8tJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6NDAwMi9oZWFsdGgnCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICB3b3JrZXItc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS5kb2NrZXIuc2NhcmYuc2gvYnVkaWJhc2Uvd29ya2VyCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRUxGX0hPU1RFRD0xCiAgICAgIC0gUE9SVD00MDAzCiAgICAgIC0gQ0xVU1RFUl9QT1JUPTEwMDAwCiAgICAgIC0gQVBJX0VOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF82NF9CVURJQkFTRUFQSQogICAgICAtIEpXVF9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFSldUCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtICdNSU5JT19VUkw9aHR0cDovL21pbmlvLXNlcnZpY2U6OTAwMCcKICAgICAgLSAnQVBQU19VUkw9aHR0cDovL2FwcC1zZXJ2aWNlOjQwMDInCiAgICAgIC0gQ09VQ0hfREJfVVNFUk5BTUU9JFNFUlZJQ0VfVVNFUl9DT1VDSERCCiAgICAgIC0gQ09VQ0hfREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQgogICAgICAtICdDT1VDSF9EQl9VUkw9aHR0cDovLyRTRVJWSUNFX1VTRVJfQ09VQ0hEQjokU0VSVklDRV9QQVNTV09SRF9DT1VDSERCQGNvdWNoZGItc2VydmljZTo1OTg0JwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdSRURJU19VUkw9cmVkaXMtc2VydmljZTo2Mzc5JwogICAgICAtIFJFRElTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JFRElTCiAgICBkZXBlbmRzX29uOgogICAgICAtIHJlZGlzLXNlcnZpY2UKICAgICAgLSBtaW5pby1zZXJ2aWNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJy1xTy0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo0MDAzL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG1pbmlvLXNlcnZpY2U6CiAgICBpbWFnZTogJ2doY3IuaW8vY29vbGxhYnNpby9taW5pbzpSRUxFQVNFLjIwMjUtMTAtMTVUMTctMjktNTVaJwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW9fZGF0YTovZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1JPT1RfVVNFUj0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIE1JTklPX0JST1dTRVI9b2ZmCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcHJveHktc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS9wcm94eQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQlVESUJBU0VfMTAwMDAKICAgICAgLSBQUk9YWV9SQVRFX0xJTUlUX1dFQkhPT0tTX1BFUl9TRUNPTkQ9MTAKICAgICAgLSBQUk9YWV9SQVRFX0xJTUlUX0FQSV9QRVJfU0VDT05EPTIwCiAgICAgIC0gJ0FQUFNfVVBTVFJFQU1fVVJMPWh0dHA6Ly9hcHAtc2VydmljZTo0MDAyJwogICAgICAtICdXT1JLRVJfVVBTVFJFQU1fVVJMPWh0dHA6Ly93b3JrZXItc2VydmljZTo0MDAzJwogICAgICAtICdNSU5JT19VUFNUUkVBTV9VUkw9aHR0cDovL21pbmlvLXNlcnZpY2U6OTAwMCcKICAgICAgLSAnQ09VQ0hEQl9VUFNUUkVBTV9VUkw9aHR0cDovL2NvdWNoZGItc2VydmljZTo1OTg0JwogICAgICAtIFJFU09MVkVSPTEyNy4wLjAuMTEKICAgIGRlcGVuZHNfb246CiAgICAgIC0gbWluaW8tc2VydmljZQogICAgICAtIHdvcmtlci1zZXJ2aWNlCiAgICAgIC0gYXBwLXNlcnZpY2UKICAgICAgLSBjb3VjaGRiLXNlcnZpY2UKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDoxMDAwMC8nCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBjb3VjaGRiLXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UvZGF0YWJhc2UKICAgIGVudmlyb25tZW50OgogICAgICAtIENPVUNIREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQgogICAgICAtIENPVUNIREJfVVNFUj0kU0VSVklDRV9VU0VSX0NPVUNIREIKICAgICAgLSBUQVJHRVRCVUlMRD1kb2NrZXItY29tcG9zZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjU5ODQvJwogICAgICBpbnRlcnZhbDogMTVzCiAgICAgIHRpbWVvdXQ6IDE1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgICB2b2x1bWVzOgogICAgICAtICdjb3VjaGRiM19kYXRhOi9kYXRhJwogIHJlZGlzLXNlcnZpY2U6CiAgICBpbWFnZTogcmVkaXMKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1yZXF1aXJlcGFzcyAiJFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMiJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXNfZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtICctYScKICAgICAgICAtICRTRVJWSUNFX1BBU1NXT1JEX1JFRElTCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMK",
+        "compose": "c2VydmljZXM6CiAgYXBwLXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UuZG9ja2VyLnNjYXJmLnNoL2J1ZGliYXNlL2FwcHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFTEZfSE9TVEVEPTEKICAgICAgLSAnQ09VQ0hfREJfVVJMPWh0dHA6Ly8kU0VSVklDRV9VU0VSX0NPVUNIREI6JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQkBjb3VjaGRiLXNlcnZpY2U6NTk4NCcKICAgICAgLSAnV09SS0VSX1VSTD1odHRwOi8vd29ya2VyLXNlcnZpY2U6NDAwMycKICAgICAgLSAnTUlOSU9fVVJMPWh0dHA6Ly9taW5pby1zZXJ2aWNlOjkwMDAnCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdCVURJQkFTRV9FTlZJUk9OTUVOVD0ke0JVRElCQVNFX0VOVklST05NRU5UOi1QUk9EVUNUSU9OfScKICAgICAgLSBQT1JUPTQwMDIKICAgICAgLSBBUElfRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFQVBJCiAgICAgIC0gRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFCiAgICAgIC0gSldUX1NFQ1JFVD0kU0VSVklDRV9CQVNFNjRfNjRfQlVESUJBU0VKV1QKICAgICAgLSBMT0dfTEVWRUw9aW5mbwogICAgICAtICdFTkFCTEVfQU5BTFlUSUNTPSR7RU5BQkxFX0FOQUxZVElDUzotdHJ1ZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpcy1zZXJ2aWNlOjYzNzknCiAgICAgIC0gUkVESVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMKICAgICAgLSBCQl9BRE1JTl9VU0VSX0VNQUlMPQogICAgICAtIEJCX0FETUlOX1VTRVJfUEFTU1dPUkQ9CiAgICBkZXBlbmRzX29uOgogICAgICAtIHdvcmtlci1zZXJ2aWNlCiAgICAgIC0gcmVkaXMtc2VydmljZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICctcU8tJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6NDAwMi9oZWFsdGgnCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICB3b3JrZXItc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS5kb2NrZXIuc2NhcmYuc2gvYnVkaWJhc2Uvd29ya2VyCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRUxGX0hPU1RFRD0xCiAgICAgIC0gUE9SVD00MDAzCiAgICAgIC0gQ0xVU1RFUl9QT1JUPTEwMDAwCiAgICAgIC0gQVBJX0VOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF82NF9CVURJQkFTRUFQSQogICAgICAtIEpXVF9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFSldUCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtICdNSU5JT19VUkw9aHR0cDovL21pbmlvLXNlcnZpY2U6OTAwMCcKICAgICAgLSAnQVBQU19VUkw9aHR0cDovL2FwcC1zZXJ2aWNlOjQwMDInCiAgICAgIC0gQ09VQ0hfREJfVVNFUk5BTUU9JFNFUlZJQ0VfVVNFUl9DT1VDSERCCiAgICAgIC0gQ09VQ0hfREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQgogICAgICAtICdDT1VDSF9EQl9VUkw9aHR0cDovLyRTRVJWSUNFX1VTRVJfQ09VQ0hEQjokU0VSVklDRV9QQVNTV09SRF9DT1VDSERCQGNvdWNoZGItc2VydmljZTo1OTg0JwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdSRURJU19VUkw9cmVkaXMtc2VydmljZTo2Mzc5JwogICAgICAtIFJFRElTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JFRElTCiAgICBkZXBlbmRzX29uOgogICAgICAtIHJlZGlzLXNlcnZpY2UKICAgICAgLSBtaW5pby1zZXJ2aWNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJy1xTy0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo0MDAzL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG1pbmlvLXNlcnZpY2U6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvX2RhdGE6L2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgLSBNSU5JT19CUk9XU0VSPW9mZgogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHByb3h5LXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UvcHJveHkKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0JVRElCQVNFXzEwMDAwCiAgICAgIC0gUFJPWFlfUkFURV9MSU1JVF9XRUJIT09LU19QRVJfU0VDT05EPTEwCiAgICAgIC0gUFJPWFlfUkFURV9MSU1JVF9BUElfUEVSX1NFQ09ORD0yMAogICAgICAtICdBUFBTX1VQU1RSRUFNX1VSTD1odHRwOi8vYXBwLXNlcnZpY2U6NDAwMicKICAgICAgLSAnV09SS0VSX1VQU1RSRUFNX1VSTD1odHRwOi8vd29ya2VyLXNlcnZpY2U6NDAwMycKICAgICAgLSAnTUlOSU9fVVBTVFJFQU1fVVJMPWh0dHA6Ly9taW5pby1zZXJ2aWNlOjkwMDAnCiAgICAgIC0gJ0NPVUNIREJfVVBTVFJFQU1fVVJMPWh0dHA6Ly9jb3VjaGRiLXNlcnZpY2U6NTk4NCcKICAgICAgLSBSRVNPTFZFUj0xMjcuMC4wLjExCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1pbmlvLXNlcnZpY2UKICAgICAgLSB3b3JrZXItc2VydmljZQogICAgICAtIGFwcC1zZXJ2aWNlCiAgICAgIC0gY291Y2hkYi1zZXJ2aWNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6MTAwMDAvJwogICAgICBpbnRlcnZhbDogMTVzCiAgICAgIHRpbWVvdXQ6IDE1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgY291Y2hkYi1zZXJ2aWNlOgogICAgaW1hZ2U6IGJ1ZGliYXNlL2RhdGFiYXNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBDT1VDSERCX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX0NPVUNIREIKICAgICAgLSBDT1VDSERCX1VTRVI9JFNFUlZJQ0VfVVNFUl9DT1VDSERCCiAgICAgIC0gVEFSR0VUQlVJTEQ9ZG9ja2VyLWNvbXBvc2UKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1OTg0LycKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgdm9sdW1lczoKICAgICAgLSAnY291Y2hkYjNfZGF0YTovZGF0YScKICByZWRpcy1zZXJ2aWNlOgogICAgaW1hZ2U6IHJlZGlzCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tcmVxdWlyZXBhc3MgIiRTRVJWSUNFX1BBU1NXT1JEX1JFRElTIicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzX2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAkU0VSVklDRV9QQVNTV09SRF9SRURJUwogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTVzCiAgICAgIHRpbWVvdXQ6IDE1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCg==",
         "tags": [
             "budibase",
             "low-code",
@@ -460,7 +460,7 @@
     "buzz": {
         "documentation": "https://github.com/block/buzz?utm_source=coolify.io",
         "slogan": "Self-hostable workspace where humans and AI agents collaborate on a Nostr relay you own.",
-        "compose": "c2VydmljZXM6CiAgYnV6ejoKICAgIGltYWdlOiAnZ2hjci5pby9ibG9jay9idXp6OiR7QlVaWl9UQUc6LW1haW59JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQlVaWl8zMDAwCiAgICAgIC0gJ0JVWlpfQklORF9BRERSPTAuMC4wLjA6MzAwMCcKICAgICAgLSBCVVpaX0hFQUxUSF9QT1JUPTgwODAKICAgICAgLSBCVVpaX01FVFJJQ1NfUE9SVD05MTAyCiAgICAgIC0gJ1JFTEFZX1VSTD13c3M6Ly8ke1NFUlZJQ0VfRlFETl9CVVpafScKICAgICAgLSAnQlVaWl9NRURJQV9CQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX0JVWlp9L21lZGlhJwogICAgICAtICdCVVpaX01FRElBX1NFUlZFUl9ET01BSU49JHtTRVJWSUNFX0ZRRE5fQlVaWn0nCiAgICAgIC0gJ0JVWlpfQ09SU19PUklHSU5TPSR7U0VSVklDRV9VUkxfQlVaWn0sdGF1cmk6Ly9sb2NhbGhvc3QsaHR0cDovL3RhdXJpLmxvY2FsaG9zdCcKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1idXp6fScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQlVaWl9TM19FTkRQT0lOVD1odHRwOi8vbWluaW86OTAwMCcKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgICAtIEJVWlpfR0lUX1JFUE9fUEFUSD0vZGF0YS9naXQKICAgICAgLSAnQlVaWl9SRUxBWV9QUklWQVRFX0tFWT0ke1NFUlZJQ0VfSEVYXzY0X1JFTEFZS0VZfScKICAgICAgLSAnQlVaWl9HSVRfSE9PS19ITUFDX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X0dJVEhNQUN9JwogICAgICAtICdCVVpaX0FVVE9fTUlHUkFURT0ke0JVWlpfQVVUT19NSUdSQVRFOi10cnVlfScKICAgICAgLSAnQlVaWl9HSVRfQ09ORk9STUFOQ0VfUFJPQkU9JHtCVVpaX0dJVF9DT05GT1JNQU5DRV9QUk9CRTotdHJ1ZX0nCiAgICAgIC0gJ0JVWlpfUkVRVUlSRV9BVVRIX1RPS0VOPSR7QlVaWl9SRVFVSVJFX0FVVEhfVE9LRU46LXRydWV9JwogICAgICAtICdCVVpaX1JFUVVJUkVfUkVMQVlfTUVNQkVSU0hJUD0ke0JVWlpfUkVRVUlSRV9SRUxBWV9NRU1CRVJTSElQOi1mYWxzZX0nCiAgICAgIC0gJ0JVWlpfQUxMT1dfTklQX09BX0FVVEg9JHtCVVpaX0FMTE9XX05JUF9PQV9BVVRIOi10cnVlfScKICAgICAgLSAnUkVMQVlfT1dORVJfUFVCS0VZPSR7UkVMQVlfT1dORVJfUFVCS0VZfScKICAgICAgLSAnUlVTVF9MT0c9JHtSVVNUX0xPRzotYnV6el9yZWxheT1pbmZvLGJ1enpfZGI9aW5mbyxidXp6X2F1dGg9aW5mbyxidXp6X3B1YnN1Yj1pbmZvLHRvd2VyX2h0dHA9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdidXp6LWdpdC1kYXRhOi9kYXRhL2dpdCcKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvLWluaXQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIGh0dHA6Ly8xMjcuMC4wLjE6ODA4MC9fcmVhZGluZXNzID4vZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNDVzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYnV6en0nCiAgICAgIC0gUEdEQVRBPS92YXIvbGliL3Bvc3RncmVzcWwvZGF0YS9wZ2RhdGEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2J1enotcG9zdGdyZXMtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTIKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLWFwcGVuZG9ubHknCiAgICAgIC0gJ3llcycKICAgICAgLSAnLS1yZXF1aXJlcGFzcycKICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLSAnYnV6ei1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgLWEgIiQke1JFRElTX1BBU1NXT1JEfSIgcGluZyB8IGdyZXAgLXEgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBtaW5pbzoKICAgIGltYWdlOiAnbWluaW8vbWluaW86UkVMRUFTRS4yMDI1LTA5LTA3VDE2LTEzLTA5WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICB2b2x1bWVzOgogICAgICAtICdidXp6LW1pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6OTAwMC9taW5pby9oZWFsdGgvbGl2ZScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAnbWluaW8vbWM6UkVMRUFTRS4yMDI1LTA4LTEzVDA4LTM1LTQxWicKICAgIGRlcGVuZHNfb246CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICAgIC0gJy1ldWMnCiAgICAgIC0gIm1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCBcIiQke0JVWlpfUzNfQUNDRVNTX0tFWX1cIiBcIiQke0JVWlpfUzNfU0VDUkVUX0tFWX1cIlxubWMgbWIgLS1pZ25vcmUtZXhpc3RpbmcgXCJsb2NhbC8kJHtCVVpaX1MzX0JVQ0tFVH1cIlxubWMgYW5vbnltb3VzIHNldCBub25lIFwibG9jYWwvJCR7QlVaWl9TM19CVUNLRVR9XCIiCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUK",
+        "compose": "c2VydmljZXM6CiAgYnV6ejoKICAgIGltYWdlOiAnZ2hjci5pby9ibG9jay9idXp6OiR7QlVaWl9UQUc6LW1haW59JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfQlVaWl8zMDAwCiAgICAgIC0gJ0JVWlpfQklORF9BRERSPTAuMC4wLjA6MzAwMCcKICAgICAgLSBCVVpaX0hFQUxUSF9QT1JUPTgwODAKICAgICAgLSBCVVpaX01FVFJJQ1NfUE9SVD05MTAyCiAgICAgIC0gJ1JFTEFZX1VSTD13c3M6Ly8ke1NFUlZJQ0VfRlFETl9CVVpafScKICAgICAgLSAnQlVaWl9NRURJQV9CQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX0JVWlp9L21lZGlhJwogICAgICAtICdCVVpaX01FRElBX1NFUlZFUl9ET01BSU49JHtTRVJWSUNFX0ZRRE5fQlVaWn0nCiAgICAgIC0gJ0JVWlpfQ09SU19PUklHSU5TPSR7U0VSVklDRV9VUkxfQlVaWn0sdGF1cmk6Ly9sb2NhbGhvc3QsaHR0cDovL3RhdXJpLmxvY2FsaG9zdCcKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1idXp6fScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQlVaWl9TM19FTkRQT0lOVD1odHRwOi8vbWluaW86OTAwMCcKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgICAtIEJVWlpfR0lUX1JFUE9fUEFUSD0vZGF0YS9naXQKICAgICAgLSAnQlVaWl9SRUxBWV9QUklWQVRFX0tFWT0ke1NFUlZJQ0VfSEVYXzY0X1JFTEFZS0VZfScKICAgICAgLSAnQlVaWl9HSVRfSE9PS19ITUFDX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X0dJVEhNQUN9JwogICAgICAtICdCVVpaX0FVVE9fTUlHUkFURT0ke0JVWlpfQVVUT19NSUdSQVRFOi10cnVlfScKICAgICAgLSAnQlVaWl9HSVRfQ09ORk9STUFOQ0VfUFJPQkU9JHtCVVpaX0dJVF9DT05GT1JNQU5DRV9QUk9CRTotdHJ1ZX0nCiAgICAgIC0gJ0JVWlpfUkVRVUlSRV9BVVRIX1RPS0VOPSR7QlVaWl9SRVFVSVJFX0FVVEhfVE9LRU46LXRydWV9JwogICAgICAtICdCVVpaX1JFUVVJUkVfUkVMQVlfTUVNQkVSU0hJUD0ke0JVWlpfUkVRVUlSRV9SRUxBWV9NRU1CRVJTSElQOi1mYWxzZX0nCiAgICAgIC0gJ0JVWlpfQUxMT1dfTklQX09BX0FVVEg9JHtCVVpaX0FMTE9XX05JUF9PQV9BVVRIOi10cnVlfScKICAgICAgLSAnUkVMQVlfT1dORVJfUFVCS0VZPSR7UkVMQVlfT1dORVJfUFVCS0VZfScKICAgICAgLSAnUlVTVF9MT0c9JHtSVVNUX0xPRzotYnV6el9yZWxheT1pbmZvLGJ1enpfZGI9aW5mbyxidXp6X2F1dGg9aW5mbyxidXp6X3B1YnN1Yj1pbmZvLHRvd2VyX2h0dHA9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdidXp6LWdpdC1kYXRhOi9kYXRhL2dpdCcKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvLWluaXQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIGh0dHA6Ly8xMjcuMC4wLjE6ODA4MC9fcmVhZGluZXNzID4vZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNDVzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYnV6en0nCiAgICAgIC0gUEdEQVRBPS92YXIvbGliL3Bvc3RncmVzcWwvZGF0YS9wZ2RhdGEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2J1enotcG9zdGdyZXMtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTIKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLWFwcGVuZG9ubHknCiAgICAgIC0gJ3llcycKICAgICAgLSAnLS1yZXF1aXJlcGFzcycKICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLSAnYnV6ei1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgLWEgIiQke1JFRElTX1BBU1NXT1JEfSIgcGluZyB8IGdyZXAgLXEgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBtaW5pbzoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2J1enotbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG1pbmlvLWluaXQ6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGRlcGVuZHNfb246CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICAgIC0gJy1ldWMnCiAgICAgIC0gIm1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCBcIiQke0JVWlpfUzNfQUNDRVNTX0tFWX1cIiBcIiQke0JVWlpfUzNfU0VDUkVUX0tFWX1cIlxubWMgbWIgLS1pZ25vcmUtZXhpc3RpbmcgXCJsb2NhbC8kJHtCVVpaX1MzX0JVQ0tFVH1cIlxubWMgYW5vbnltb3VzIHNldCBub25lIFwibG9jYWwvJCR7QlVaWl9TM19CVUNLRVR9XCIiCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUK",
         "tags": [
             "buzz",
             "chat",
@@ -1376,7 +1376,7 @@
     "ente-photos-with-s3": {
         "documentation": "https://help.ente.io/self-hosting/installation/compose?utm_source=coolify.io",
         "slogan": "Ente Photos is a fully open source, End to End Encrypted alternative to Google Photos and Apple Photos.",
-        "compose": "c2VydmljZXM6CiAgbXVzZXVtOgogICAgaW1hZ2U6ICdnaGNyLmlvL2VudGUtaW8vc2VydmVyOjYxM2M2YTk2MzkwZDdhNjI0Y2YzMGI5NDY5NTU3MDVkNjMyNDIzY2MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9NVVNFVU1fODA4MAogICAgICAtIEVOVEVfREJfSE9TVD1wb3N0Z3JlcwogICAgICAtIEVOVEVfREJfUE9SVD01NDMyCiAgICAgIC0gJ0VOVEVfREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgICAgLSAnRU5URV9EQl9VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnRU5URV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdFTlRFX0hUVFBfVVNFX1RMUz0ke0VOVEVfSFRUUF9VU0VfVExTOi1mYWxzZX0nCiAgICAgIC0gRU5URV9TM19BUkVfTE9DQUxfQlVDS0VUUz1mYWxzZQogICAgICAtIEVOVEVfUzNfVVNFX1BBVEhfU1RZTEVfVVJMUz10cnVlCiAgICAgIC0gJ0VOVEVfUzNfQjJfRVVfQ0VOX0tFWT0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ0VOVEVfUzNfQjJfRVVfQ0VOX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdFTlRFX1MzX0IyX0VVX0NFTl9FTkRQT0lOVD0ke1NFUlZJQ0VfRlFETl9NSU5JT185MDAwfScKICAgICAgLSBFTlRFX1MzX0IyX0VVX0NFTl9SRUdJT049ZXUtY2VudHJhbC0yCiAgICAgIC0gRU5URV9TM19CMl9FVV9DRU5fQlVDS0VUPWIyLWV1LWNlbgogICAgICAtICdFTlRFX0tFWV9FTkNSWVBUSU9OPSR7U0VSVklDRV9SRUFMQkFTRTY0X0VOQ1JZUFRJT059JwogICAgICAtICdFTlRFX0tFWV9IQVNIPSR7U0VSVklDRV9SRUFMQkFTRTY0XzY0X0hBU0h9JwogICAgICAtICdFTlRFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1JFQUxCQVNFNjRfSldUfScKICAgICAgLSAnRU5URV9JTlRFUk5BTF9BRE1JTj0ke0VOVEVfSU5URVJOQUxfQURNSU46LTE1ODA1NTk5NjIzODY0Mzh9JwogICAgICAtICdFTlRFX0lOVEVSTkFMX0RJU0FCTEVfUkVHSVNUUkFUSU9OPSR7RU5URV9JTlRFUk5BTF9ESVNBQkxFX1JFR0lTVFJBVElPTjotZmFsc2V9JwogICAgICAtICdFTlRFX1NNVFBfSE9TVD0ke0VOVEVfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0VOVEVfU01UUF9QT1JUPSR7RU5URV9TTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0VOVEVfU01UUF9VU0VSTkFNRT0ke0VOVEVfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ0VOVEVfU01UUF9QQVNTV09SRD0ke0VOVEVfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ0VOVEVfU01UUF9FTUFJTD0ke0VOVEVfU01UUF9FTUFJTH0nCiAgICAgIC0gJ0VOVEVfU01UUF9TRU5ERVJfTkFNRT0ke0VOVEVfU01UUF9TRU5ERVJfTkFNRX0nCiAgICAgIC0gJ0VOVEVfU01UUF9FTkNSWVBUSU9OPSR7RU5URV9TTVRQX0VOQ1JZUFRJT046LXRsc30nCiAgICB2b2x1bWVzOgogICAgICAtICdtdXNldW0tZGF0YTovZGF0YScKICAgICAgLSAnbXVzZXVtLWNvbmZpZzovY29uZmlnJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwL3BpbmcnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICB3ZWI6CiAgICBpbWFnZTogJ2doY3IuaW8vZW50ZS1pby93ZWI6Y2EwMzE2NWY1ZTdmMmE1MDEwNWU2ZTQwMDE5YzE3YWU2Y2RkOTM0ZicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1dFQl8zMDAwCiAgICAgIC0gJ0VOVEVfQVBJX09SSUdJTj0ke1NFUlZJQ0VfVVJMX01VU0VVTX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy0tZmFpbCcKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjMwMDAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfSAtZCAke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgbWluaW86CiAgICBpbWFnZTogJ2doY3IuaW8vY29vbGxhYnNpby9taW5pbzpSRUxFQVNFLjIwMjUtMTAtMTVUMTctMjktNTVaJwogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTUlOSU9fU0VSVkVSX1VSTD0kTUlOSU9fU0VSVkVSX1VSTAogICAgICAtIE1JTklPX0JST1dTRVJfUkVESVJFQ1RfVVJMPSRNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTAogICAgICAtIE1JTklPX1JPT1RfVVNFUj0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtaW5pby1pbml0OgogICAgaW1hZ2U6ICdtaW5pby9tYzpSRUxFQVNFLjIwMjUtMDgtMTNUMDgtMzUtNDFaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIHJlc3RhcnQ6IG9uLWZhaWx1cmUKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnTUlOSU9fQ09SU19VUkxTPSRTRVJWSUNFX1VSTF9NVVNFVU0sJFNFUlZJQ0VfVVJMX1dFQicKICAgIGVudHJ5cG9pbnQ6ICIvYmluL3NoIC1jIFwiXG4gIGVjaG8gXFxcIk1JTklPX0NPUlNfVVJMUzogXFwkJHtNSU5JT19DT1JTX1VSTFN9XFxcIjtcbiAgc2xlZXAgNTtcbiAgdW50aWwgbWMgYWxpYXMgc2V0IG1pbmlvIGh0dHA6Ly9taW5pbzo5MDAwIFxcJCR7TUlOSU9fUk9PVF9VU0VSfSBcXCQke01JTklPX1JPT1RfUEFTU1dPUkR9OyBkb1xuICAgIGVjaG8gJ1dhaXRpbmcgZm9yIE1pbklPLi4uJztcbiAgICBzbGVlcCAyO1xuICBkb25lO1xuICBtYyBhZG1pbiBjb25maWcgc2V0IG1pbmlvIGFwaSBjb3JzX2FsbG93X29yaWdpbj0nJE1JTklPX0NPUlNfVVJMUycgfHwgdHJ1ZTtcbiAgbWMgbWIgbWluaW8vYjItZXUtY2VuIC0taWdub3JlLWV4aXN0aW5nO1xuICBtYyBtYiBtaW5pby93YXNhYmktZXUtY2VudHJhbC0yLXYzIC0taWdub3JlLWV4aXN0aW5nO1xuICBtYyBtYiBtaW5pby9zY3ctZXUtZnItdjMgLS1pZ25vcmUtZXhpc3Rpbmc7XG4gIGVjaG8gJ01pbklPIGJ1Y2tldHMgYW5kIENPUlMgY29uZmlndXJlZCc7XG5cIiIK",
+        "compose": "c2VydmljZXM6CiAgbXVzZXVtOgogICAgaW1hZ2U6ICdnaGNyLmlvL2VudGUtaW8vc2VydmVyOjYxM2M2YTk2MzkwZDdhNjI0Y2YzMGI5NDY5NTU3MDVkNjMyNDIzY2MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9NVVNFVU1fODA4MAogICAgICAtIEVOVEVfREJfSE9TVD1wb3N0Z3JlcwogICAgICAtIEVOVEVfREJfUE9SVD01NDMyCiAgICAgIC0gJ0VOVEVfREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgICAgLSAnRU5URV9EQl9VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnRU5URV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdFTlRFX0hUVFBfVVNFX1RMUz0ke0VOVEVfSFRUUF9VU0VfVExTOi1mYWxzZX0nCiAgICAgIC0gRU5URV9TM19BUkVfTE9DQUxfQlVDS0VUUz1mYWxzZQogICAgICAtIEVOVEVfUzNfVVNFX1BBVEhfU1RZTEVfVVJMUz10cnVlCiAgICAgIC0gJ0VOVEVfUzNfQjJfRVVfQ0VOX0tFWT0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ0VOVEVfUzNfQjJfRVVfQ0VOX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdFTlRFX1MzX0IyX0VVX0NFTl9FTkRQT0lOVD0ke1NFUlZJQ0VfRlFETl9NSU5JT185MDAwfScKICAgICAgLSBFTlRFX1MzX0IyX0VVX0NFTl9SRUdJT049ZXUtY2VudHJhbC0yCiAgICAgIC0gRU5URV9TM19CMl9FVV9DRU5fQlVDS0VUPWIyLWV1LWNlbgogICAgICAtICdFTlRFX0tFWV9FTkNSWVBUSU9OPSR7U0VSVklDRV9SRUFMQkFTRTY0X0VOQ1JZUFRJT059JwogICAgICAtICdFTlRFX0tFWV9IQVNIPSR7U0VSVklDRV9SRUFMQkFTRTY0XzY0X0hBU0h9JwogICAgICAtICdFTlRFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1JFQUxCQVNFNjRfSldUfScKICAgICAgLSAnRU5URV9JTlRFUk5BTF9BRE1JTj0ke0VOVEVfSU5URVJOQUxfQURNSU46LTE1ODA1NTk5NjIzODY0Mzh9JwogICAgICAtICdFTlRFX0lOVEVSTkFMX0RJU0FCTEVfUkVHSVNUUkFUSU9OPSR7RU5URV9JTlRFUk5BTF9ESVNBQkxFX1JFR0lTVFJBVElPTjotZmFsc2V9JwogICAgICAtICdFTlRFX1NNVFBfSE9TVD0ke0VOVEVfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0VOVEVfU01UUF9QT1JUPSR7RU5URV9TTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0VOVEVfU01UUF9VU0VSTkFNRT0ke0VOVEVfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ0VOVEVfU01UUF9QQVNTV09SRD0ke0VOVEVfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ0VOVEVfU01UUF9FTUFJTD0ke0VOVEVfU01UUF9FTUFJTH0nCiAgICAgIC0gJ0VOVEVfU01UUF9TRU5ERVJfTkFNRT0ke0VOVEVfU01UUF9TRU5ERVJfTkFNRX0nCiAgICAgIC0gJ0VOVEVfU01UUF9FTkNSWVBUSU9OPSR7RU5URV9TTVRQX0VOQ1JZUFRJT046LXRsc30nCiAgICB2b2x1bWVzOgogICAgICAtICdtdXNldW0tZGF0YTovZGF0YScKICAgICAgLSAnbXVzZXVtLWNvbmZpZzovY29uZmlnJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwL3BpbmcnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICB3ZWI6CiAgICBpbWFnZTogJ2doY3IuaW8vZW50ZS1pby93ZWI6Y2EwMzE2NWY1ZTdmMmE1MDEwNWU2ZTQwMDE5YzE3YWU2Y2RkOTM0ZicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1dFQl8zMDAwCiAgICAgIC0gJ0VOVEVfQVBJX09SSUdJTj0ke1NFUlZJQ0VfVVJMX01VU0VVTX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy0tZmFpbCcKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjMwMDAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfSAtZCAke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgbWluaW86CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1NFUlZFUl9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTD0kTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkwKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIHJlc3RhcnQ6IG9uLWZhaWx1cmUKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnTUlOSU9fQ09SU19VUkxTPSRTRVJWSUNFX1VSTF9NVVNFVU0sJFNFUlZJQ0VfVVJMX1dFQicKICAgIGVudHJ5cG9pbnQ6ICIvYmluL3NoIC1jIFwiXG4gIGVjaG8gXFxcIk1JTklPX0NPUlNfVVJMUzogXFwkJHtNSU5JT19DT1JTX1VSTFN9XFxcIjtcbiAgc2xlZXAgNTtcbiAgdW50aWwgbWMgYWxpYXMgc2V0IG1pbmlvIGh0dHA6Ly9taW5pbzo5MDAwIFxcJCR7TUlOSU9fUk9PVF9VU0VSfSBcXCQke01JTklPX1JPT1RfUEFTU1dPUkR9OyBkb1xuICAgIGVjaG8gJ1dhaXRpbmcgZm9yIE1pbklPLi4uJztcbiAgICBzbGVlcCAyO1xuICBkb25lO1xuICBtYyBhZG1pbiBjb25maWcgc2V0IG1pbmlvIGFwaSBjb3JzX2FsbG93X29yaWdpbj0nJE1JTklPX0NPUlNfVVJMUycgfHwgdHJ1ZTtcbiAgbWMgbWIgbWluaW8vYjItZXUtY2VuIC0taWdub3JlLWV4aXN0aW5nO1xuICBtYyBtYiBtaW5pby93YXNhYmktZXUtY2VudHJhbC0yLXYzIC0taWdub3JlLWV4aXN0aW5nO1xuICBtYyBtYiBtaW5pby9zY3ctZXUtZnItdjMgLS1pZ25vcmUtZXhpc3Rpbmc7XG4gIGVjaG8gJ01pbklPIGJ1Y2tldHMgYW5kIENPUlMgY29uZmlndXJlZCc7XG5cIiIK",
         "tags": [
             "photos",
             "gallery",
@@ -1684,7 +1684,7 @@
     "forgejo-with-mariadb": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19EQl9UWVBFPW15c3FsCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0hPU1Q9bWFyaWFkYgogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke01ZU1FMX0RBVEFCQVNFLWZvcmdlam99JwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBwb3J0czoKICAgICAgLSAnMjIyMjI6MjInCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLW1hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRX0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19EQl9UWVBFPW15c3FsCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0hPU1Q9bWFyaWFkYgogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fVVNFUj0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1tYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "version control",
             "collaboration",
@@ -1702,7 +1702,7 @@
     "forgejo-with-mysql": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19EQl9UWVBFPW15c3FsCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0hPU1Q9bXlzcWwKICAgICAgLSAnRk9SR0VKT19fZGF0YWJhc2VfX05BTUU9JHtNWVNRTF9EQVRBQkFTRS1mb3JnZWpvfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fVVNFUj0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJzIyMjIyOjIyJwogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0V9JwogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19EQl9UWVBFPW15c3FsCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0hPU1Q9bXlzcWwKICAgICAgLSAnRk9SR0VKT19fZGF0YWJhc2VfX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1VTRVI9JFNFUlZJQ0VfVVNFUl9NWVNRTAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19QQVNTV0Q9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfToyMicKICAgIGRlcGVuZHNfb246CiAgICAgIG15c3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG15c3FsOgogICAgaW1hZ2U6ICdteXNxbDo4JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "version control",
             "collaboration",
@@ -1720,7 +1720,7 @@
     "forgejo-with-postgresql": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19EQl9UWVBFPXBvc3RncmVzCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0hPU1Q9cG9zdGdyZXNxbAogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke1BPU1RHUkVTUUxfREFUQUJBU0UtZm9yZ2Vqb30nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBwb3J0czoKICAgICAgLSAnMjIyMjI6MjInCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHBvc3RncmVzcWw6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNRTF9EQVRBQkFTRX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19EQl9UWVBFPXBvc3RncmVzCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0hPU1Q9cG9zdGdyZXNxbAogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19QQVNTV0Q9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTAogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "version control",
             "collaboration",
@@ -1735,10 +1735,97 @@
         "template_last_updated_at": "2026-08-10T11:35:20+02:00",
         "port": "3000"
     },
+    "forgejo-with-runner-with-mariadb": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTOi1mYWxzZX0nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX1BPUlQ9JHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn0nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9bXlzcWwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7TVlTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICAgIC0gVVNFUl9VSUQ9MTAwMAogICAgICAtIFVTRVJfR0lEPTEwMDAKICAgICAgLSAnUlVOTkVSX1NIQVJFRF9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SVU5ORVJ9JwogICAgICAtIEZPUkdFSk9fX3NlY3VyaXR5X19JTlNUQUxMX0xPQ0s9dHJ1ZQogICAgICAtICdGT1JHRUpPX0FETUlOX1VTRVI9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdGT1JHRUpPX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fRU1BSUw9JHtGT1JHRUpPX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fRU5BQkxFX1BVU0hfQ1JFQVRFX1VTRVI9dHJ1ZQogICAgICAtIEZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUFVTSF9DUkVBVEVfUFJJVkFURT1mYWxzZQogICAgICAtICdGT1JHRUpPX19yZXBvc2l0b3J5X19ERUZBVUxUX1JFUE9fVU5JVFM9cmVwby5jb2RlLHJlcG8uYWN0aW9ucycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfToyMicKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnMgaHR0cDovLzEyNy4wLjAuMTozMDAwID4gL2Rldi9udWxsICYmIHRlc3QgLWYgL3RtcC9ydW5uZXItcmVnaXN0ZXJlZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzMAogICAgY29tbWFuZDogJ2Jhc2ggLWMgJycgL3Vzci9iaW4vczYtc3ZzY2FuIC9ldGMvczYgJiB1bnRpbCBzdSAtYyAiZm9yZ2VqbyBmb3JnZWpvLWNsaSBhY3Rpb25zIHJlZ2lzdGVyIC0ta2VlcC1sYWJlbHMgLS1zZWNyZXQgJCR7UlVOTkVSX1NIQVJFRF9TRUNSRVQ6MDo0MH0iIGdpdCA7IGRvIHNsZWVwIDUgOyBkb25lIDsgc3UgLWMgImZvcmdlam8gYWRtaW4gdXNlciBjcmVhdGUgLS1hZG1pbiAtLXVzZXJuYW1lIFwiJCRGT1JHRUpPX0FETUlOX1VTRVJcIiAtLXBhc3N3b3JkIFwiJCRGT1JHRUpPX0FETUlOX1BBU1NXT1JEXCIgLS1lbWFpbCBcIiQkRk9SR0VKT19BRE1JTl9FTUFJTFwiIC0tbXVzdC1jaGFuZ2UtcGFzc3dvcmQ9ZmFsc2UiIGdpdCB8fCB0cnVlIDsgdG91Y2ggL3RtcC9ydW5uZXItcmVnaXN0ZXJlZCA7IHdhaXQgJycnCiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIGRvY2tlci1pbi1kb2NrZXI6CiAgICBpbWFnZTogJ2RvY2tlcjpkaW5kJwogICAgaG9zdG5hbWU6IGRvY2tlcgogICAgcHJpdmlsZWdlZDogdHJ1ZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGRvY2tlcgogICAgICAgIC0gJy1IJwogICAgICAgIC0gJ3VuaXg6Ly8vdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgICAtIGluZm8KICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTAKICAgIGVudmlyb25tZW50OgogICAgICAtIERPQ0tFUl9UTFNfQ0VSVERJUj0vY2VydHMKICAgICAgLSBET0NLRVJfSE9TVD1kb2NrZXItaW4tZG9ja2VyCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRpZC1jZXJ0czovY2VydHMnCiAgcnVubmVyLXJlZ2lzdGVyOgogICAgaW1hZ2U6ICdkYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyOjEzLjIuMCcKICAgIHJlc3RhcnQ6ICdubycKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JVTk5FUl9TSEFSRURfU0VDUkVUPSR7U0VSVklDRV9IRVhfNjRfUlVOTkVSfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcnVubmVyLWRhdGE6L2RhdGEnCiAgICB1c2VyOiAnMDowJwogICAgY29tbWFuZDogJ2Jhc2ggLWVjICcnIHNlY3JldD0kJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSA7IHV1aWQ9JCQocHJpbnRmICVzICIkJHtzZWNyZXQ6MDoxNn0iIHwgb2QgLUFuIC10eDEgfCB0ciAtZCAiIFxuIiB8IHNlZCAtRSAicy8oLns4fSkoLns0fSkoLns0fSkoLns0fSkoLnsxMn0pL1wxLVwyLVwzLVw0LVw1LyIpIDsgZm9yZ2Vqby1ydW5uZXIgZ2VuZXJhdGUtY29uZmlnID4gY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIGxhYmVsczogXFtcXXwgIGxhYmVsczogW1wiZG9ja2VyOmRvY2tlcjovL25vZGU6MjItYm9va3dvcm1cIiwgXCJ1YnVudHUtbGF0ZXN0OmRvY2tlcjovL2NhdHRoZWhhY2tlci91YnVudHU6YWN0LTIyLjA0XCIsIFwidWJ1bnR1LTIyLjA0OmRvY2tlcjovL2NhdHRoZWhhY2tlci91YnVudHU6YWN0LTIyLjA0XCJdfCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xuZXR3b3JrOiAuKnxuZXR3b3JrOiBob3N0fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xeICBlbnZzOiQkfCAgZW52czpcbiAgICBET0NLRVJfSE9TVDogdGNwOi8vZG9ja2VyOjIzNzZcbiAgICBET0NLRVJfVExTX1ZFUklGWTogMVxuICAgIERPQ0tFUl9DRVJUX1BBVEg6IC9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfF4gIG9wdGlvbnM6fCAgb3B0aW9uczogLXYgL2NlcnRzL2NsaWVudDovY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIHZhbGlkX3ZvbHVtZXM6IFxbXF0kJHwgIHZhbGlkX3ZvbHVtZXM6XG4gICAgLSAvY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIGNvbm5lY3Rpb25zOnwgIGNvbm5lY3Rpb25zOlxuICAgIGRlZmF1bHQ6XG4gICAgICB1cmw6IGh0dHA6Ly9mb3JnZWpvOjMwMDBcbiAgICAgIHV1aWQ6ICQkdXVpZFxuICAgICAgdG9rZW46ICQkc2VjcmV0fCIgY29uZmlnLnltbCA7IGNob3duIC1SIDEwMDA6MTAwMCAvZGF0YSAnJycKICBydW5uZXI6CiAgICBpbWFnZTogJ2RhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXI6MTMuMi4wJwogICAgZGVwZW5kc19vbjoKICAgICAgZm9yZ2VqbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBkb2NrZXItaW4tZG9ja2VyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJ1bm5lci1yZWdpc3RlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RPQ0tFUl9IT1NUPXRjcDovL2RvY2tlcjoyMzc2JwogICAgICAtIERPQ0tFUl9DRVJUX1BBVEg9L2NlcnRzL2NsaWVudAogICAgICAtIERPQ0tFUl9UTFNfVkVSSUZZPTEKICAgIHVzZXI6ICcxMDAwOjEwMDAnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXJ1bm5lci1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLWRpZC1jZXJ0czovY2VydHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdyZXAKICAgICAgICAtIGZvcmdlam8tcnVubmVyCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBjb21tYW5kOiAnZm9yZ2Vqby1ydW5uZXIgLS1jb25maWcgY29uZmlnLnltbCBkYWVtb24nCg==",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "mariadb",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
+    "forgejo-with-runner-with-mysql": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTOi1mYWxzZX0nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX1BPUlQ9JHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn0nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9bXlzcWwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1teXNxbAogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fVVNFUj0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gJ1JVTk5FUl9TSEFSRURfU0VDUkVUPSR7U0VSVklDRV9IRVhfNjRfUlVOTkVSfScKICAgICAgLSBGT1JHRUpPX19zZWN1cml0eV9fSU5TVEFMTF9MT0NLPXRydWUKICAgICAgLSAnRk9SR0VKT19BRE1JTl9VU0VSPSR7U0VSVklDRV9VU0VSX0FETUlOfScKICAgICAgLSAnRk9SR0VKT19BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtICdGT1JHRUpPX0FETUlOX0VNQUlMPSR7Rk9SR0VKT19BRE1JTl9FTUFJTDotYWRtaW5AZXhhbXBsZS5jb219JwogICAgICAtIEZPUkdFSk9fX3JlcG9zaXRvcnlfX0VOQUJMRV9QVVNIX0NSRUFURV9VU0VSPXRydWUKICAgICAgLSBGT1JHRUpPX19yZXBvc2l0b3J5X19ERUZBVUxUX1BVU0hfQ1JFQVRFX1BSSVZBVEU9ZmFsc2UKICAgICAgLSAnRk9SR0VKT19fcmVwb3NpdG9yeV9fREVGQVVMVF9SRVBPX1VOSVRTPXJlcG8uY29kZSxyZXBvLmFjdGlvbnMnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBwb3J0czoKICAgICAgLSAnJHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn06MjInCiAgICBkZXBlbmRzX29uOgogICAgICBteXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mcyBodHRwOi8vMTI3LjAuMC4xOjMwMDAgPiAvZGV2L251bGwgJiYgdGVzdCAtZiAvdG1wL3J1bm5lci1yZWdpc3RlcmVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMwCiAgICBjb21tYW5kOiAnYmFzaCAtYyAnJyAvdXNyL2Jpbi9zNi1zdnNjYW4gL2V0Yy9zNiAmIHVudGlsIHN1IC1jICJmb3JnZWpvIGZvcmdlam8tY2xpIGFjdGlvbnMgcmVnaXN0ZXIgLS1rZWVwLWxhYmVscyAtLXNlY3JldCAkJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSIgZ2l0IDsgZG8gc2xlZXAgNSA7IGRvbmUgOyBzdSAtYyAiZm9yZ2VqbyBhZG1pbiB1c2VyIGNyZWF0ZSAtLWFkbWluIC0tdXNlcm5hbWUgXCIkJEZPUkdFSk9fQURNSU5fVVNFUlwiIC0tcGFzc3dvcmQgXCIkJEZPUkdFSk9fQURNSU5fUEFTU1dPUkRcIiAtLWVtYWlsIFwiJCRGT1JHRUpPX0FETUlOX0VNQUlMXCIgLS1tdXN0LWNoYW5nZS1wYXNzd29yZD1mYWxzZSIgZ2l0IHx8IHRydWUgOyB0b3VjaCAvdG1wL3J1bm5lci1yZWdpc3RlcmVkIDsgd2FpdCAnJycKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWw6OCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBkb2NrZXItaW4tZG9ja2VyOgogICAgaW1hZ2U6ICdkb2NrZXI6ZGluZCcKICAgIGhvc3RuYW1lOiBkb2NrZXIKICAgIHByaXZpbGVnZWQ6IHRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBkb2NrZXIKICAgICAgICAtICctSCcKICAgICAgICAtICd1bml4Oi8vL3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICAgICAgLSBpbmZvCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBET0NLRVJfVExTX0NFUlRESVI9L2NlcnRzCiAgICAgIC0gRE9DS0VSX0hPU1Q9ZG9ja2VyLWluLWRvY2tlcgogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kaWQtY2VydHM6L2NlcnRzJwogIHJ1bm5lci1yZWdpc3RlcjoKICAgIGltYWdlOiAnZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL3J1bm5lcjoxMy4yLjAnCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGVudmlyb25tZW50OgogICAgICAtICdSVU5ORVJfU0hBUkVEX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1JVTk5FUn0nCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXJ1bm5lci1kYXRhOi9kYXRhJwogICAgdXNlcjogJzA6MCcKICAgIGNvbW1hbmQ6ICdiYXNoIC1lYyAnJyBzZWNyZXQ9JCR7UlVOTkVSX1NIQVJFRF9TRUNSRVQ6MDo0MH0gOyB1dWlkPSQkKHByaW50ZiAlcyAiJCR7c2VjcmV0OjA6MTZ9IiB8IG9kIC1BbiAtdHgxIHwgdHIgLWQgIiBcbiIgfCBzZWQgLUUgInMvKC57OH0pKC57NH0pKC57NH0pKC57NH0pKC57MTJ9KS9cMS1cMi1cMy1cNC1cNS8iKSA7IGZvcmdlam8tcnVubmVyIGdlbmVyYXRlLWNvbmZpZyA+IGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICBsYWJlbHM6IFxbXF18ICBsYWJlbHM6IFtcImRvY2tlcjpkb2NrZXI6Ly9ub2RlOjIyLWJvb2t3b3JtXCIsIFwidWJ1bnR1LWxhdGVzdDpkb2NrZXI6Ly9jYXR0aGVoYWNrZXIvdWJ1bnR1OmFjdC0yMi4wNFwiLCBcInVidW50dS0yMi4wNDpkb2NrZXI6Ly9jYXR0aGVoYWNrZXIvdWJ1bnR1OmFjdC0yMi4wNFwiXXwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8bmV0d29yazogLip8bmV0d29yazogaG9zdHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8XiAgZW52czokJHwgIGVudnM6XG4gICAgRE9DS0VSX0hPU1Q6IHRjcDovL2RvY2tlcjoyMzc2XG4gICAgRE9DS0VSX1RMU19WRVJJRlk6IDFcbiAgICBET0NLRVJfQ0VSVF9QQVRIOiAvY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xeICBvcHRpb25zOnwgIG9wdGlvbnM6IC12IC9jZXJ0cy9jbGllbnQ6L2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICB2YWxpZF92b2x1bWVzOiBcW1xdJCR8ICB2YWxpZF92b2x1bWVzOlxuICAgIC0gL2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICBjb25uZWN0aW9uczp8ICBjb25uZWN0aW9uczpcbiAgICBkZWZhdWx0OlxuICAgICAgdXJsOiBodHRwOi8vZm9yZ2VqbzozMDAwXG4gICAgICB1dWlkOiAkJHV1aWRcbiAgICAgIHRva2VuOiAkJHNlY3JldHwiIGNvbmZpZy55bWwgOyBjaG93biAtUiAxMDAwOjEwMDAgL2RhdGEgJycnCiAgcnVubmVyOgogICAgaW1hZ2U6ICdkYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyOjEzLjIuMCcKICAgIGRlcGVuZHNfb246CiAgICAgIGZvcmdlam86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgZG9ja2VyLWluLWRvY2tlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBydW5uZXItcmVnaXN0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdET0NLRVJfSE9TVD10Y3A6Ly9kb2NrZXI6MjM3NicKICAgICAgLSBET0NLRVJfQ0VSVF9QQVRIPS9jZXJ0cy9jbGllbnQKICAgICAgLSBET0NLRVJfVExTX1ZFUklGWT0xCiAgICB1c2VyOiAnMTAwMDoxMDAwJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1ydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby1kaWQtY2VydHM6L2NlcnRzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBncmVwCiAgICAgICAgLSBmb3JnZWpvLXJ1bm5lcgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgY29tbWFuZDogJ2Zvcmdlam8tcnVubmVyIC0tY29uZmlnIGNvbmZpZy55bWwgZGFlbW9uJwo=",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "mysql",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
+    "forgejo-with-runner-with-postgresql": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTOi1mYWxzZX0nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX1BPUlQ9JHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn0nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9cG9zdGdyZXMKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1wb3N0Z3Jlc3FsCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7UE9TVEdSRVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMCiAgICAgIC0gVVNFUl9VSUQ9MTAwMAogICAgICAtIFVTRVJfR0lEPTEwMDAKICAgICAgLSAnUlVOTkVSX1NIQVJFRF9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SVU5ORVJ9JwogICAgICAtIEZPUkdFSk9fX3NlY3VyaXR5X19JTlNUQUxMX0xPQ0s9dHJ1ZQogICAgICAtICdGT1JHRUpPX0FETUlOX1VTRVI9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdGT1JHRUpPX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fRU1BSUw9JHtGT1JHRUpPX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fRU5BQkxFX1BVU0hfQ1JFQVRFX1VTRVI9dHJ1ZQogICAgICAtIEZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUFVTSF9DUkVBVEVfUFJJVkFURT1mYWxzZQogICAgICAtICdGT1JHRUpPX19yZXBvc2l0b3J5X19ERUZBVUxUX1JFUE9fVU5JVFM9cmVwby5jb2RlLHJlcG8uYWN0aW9ucycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfToyMicKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnMgaHR0cDovLzEyNy4wLjAuMTozMDAwID4gL2Rldi9udWxsICYmIHRlc3QgLWYgL3RtcC9ydW5uZXItcmVnaXN0ZXJlZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzMAogICAgY29tbWFuZDogJ2Jhc2ggLWMgJycgL3Vzci9iaW4vczYtc3ZzY2FuIC9ldGMvczYgJiB1bnRpbCBzdSAtYyAiZm9yZ2VqbyBmb3JnZWpvLWNsaSBhY3Rpb25zIHJlZ2lzdGVyIC0ta2VlcC1sYWJlbHMgLS1zZWNyZXQgJCR7UlVOTkVSX1NIQVJFRF9TRUNSRVQ6MDo0MH0iIGdpdCA7IGRvIHNsZWVwIDUgOyBkb25lIDsgc3UgLWMgImZvcmdlam8gYWRtaW4gdXNlciBjcmVhdGUgLS1hZG1pbiAtLXVzZXJuYW1lIFwiJCRGT1JHRUpPX0FETUlOX1VTRVJcIiAtLXBhc3N3b3JkIFwiJCRGT1JHRUpPX0FETUlOX1BBU1NXT1JEXCIgLS1lbWFpbCBcIiQkRk9SR0VKT19BRE1JTl9FTUFJTFwiIC0tbXVzdC1jaGFuZ2UtcGFzc3dvcmQ9ZmFsc2UiIGdpdCB8fCB0cnVlIDsgdG91Y2ggL3RtcC9ydW5uZXItcmVnaXN0ZXJlZCA7IHdhaXQgJycnCiAgcG9zdGdyZXNxbDoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBkb2NrZXItaW4tZG9ja2VyOgogICAgaW1hZ2U6ICdkb2NrZXI6ZGluZCcKICAgIGhvc3RuYW1lOiBkb2NrZXIKICAgIHByaXZpbGVnZWQ6IHRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBkb2NrZXIKICAgICAgICAtICctSCcKICAgICAgICAtICd1bml4Oi8vL3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICAgICAgLSBpbmZvCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBET0NLRVJfVExTX0NFUlRESVI9L2NlcnRzCiAgICAgIC0gRE9DS0VSX0hPU1Q9ZG9ja2VyLWluLWRvY2tlcgogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kaWQtY2VydHM6L2NlcnRzJwogIHJ1bm5lci1yZWdpc3RlcjoKICAgIGltYWdlOiAnZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL3J1bm5lcjoxMy4yLjAnCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGVudmlyb25tZW50OgogICAgICAtICdSVU5ORVJfU0hBUkVEX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1JVTk5FUn0nCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXJ1bm5lci1kYXRhOi9kYXRhJwogICAgdXNlcjogJzA6MCcKICAgIGNvbW1hbmQ6ICdiYXNoIC1lYyAnJyBzZWNyZXQ9JCR7UlVOTkVSX1NIQVJFRF9TRUNSRVQ6MDo0MH0gOyB1dWlkPSQkKHByaW50ZiAlcyAiJCR7c2VjcmV0OjA6MTZ9IiB8IG9kIC1BbiAtdHgxIHwgdHIgLWQgIiBcbiIgfCBzZWQgLUUgInMvKC57OH0pKC57NH0pKC57NH0pKC57NH0pKC57MTJ9KS9cMS1cMi1cMy1cNC1cNS8iKSA7IGZvcmdlam8tcnVubmVyIGdlbmVyYXRlLWNvbmZpZyA+IGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICBsYWJlbHM6IFxbXF18ICBsYWJlbHM6IFtcImRvY2tlcjpkb2NrZXI6Ly9ub2RlOjIyLWJvb2t3b3JtXCIsIFwidWJ1bnR1LWxhdGVzdDpkb2NrZXI6Ly9jYXR0aGVoYWNrZXIvdWJ1bnR1OmFjdC0yMi4wNFwiLCBcInVidW50dS0yMi4wNDpkb2NrZXI6Ly9jYXR0aGVoYWNrZXIvdWJ1bnR1OmFjdC0yMi4wNFwiXXwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8bmV0d29yazogLip8bmV0d29yazogaG9zdHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8XiAgZW52czokJHwgIGVudnM6XG4gICAgRE9DS0VSX0hPU1Q6IHRjcDovL2RvY2tlcjoyMzc2XG4gICAgRE9DS0VSX1RMU19WRVJJRlk6IDFcbiAgICBET0NLRVJfQ0VSVF9QQVRIOiAvY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xeICBvcHRpb25zOnwgIG9wdGlvbnM6IC12IC9jZXJ0cy9jbGllbnQ6L2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICB2YWxpZF92b2x1bWVzOiBcW1xdJCR8ICB2YWxpZF92b2x1bWVzOlxuICAgIC0gL2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICBjb25uZWN0aW9uczp8ICBjb25uZWN0aW9uczpcbiAgICBkZWZhdWx0OlxuICAgICAgdXJsOiBodHRwOi8vZm9yZ2VqbzozMDAwXG4gICAgICB1dWlkOiAkJHV1aWRcbiAgICAgIHRva2VuOiAkJHNlY3JldHwiIGNvbmZpZy55bWwgOyBjaG93biAtUiAxMDAwOjEwMDAgL2RhdGEgJycnCiAgcnVubmVyOgogICAgaW1hZ2U6ICdkYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyOjEzLjIuMCcKICAgIGRlcGVuZHNfb246CiAgICAgIGZvcmdlam86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgZG9ja2VyLWluLWRvY2tlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBydW5uZXItcmVnaXN0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdET0NLRVJfSE9TVD10Y3A6Ly9kb2NrZXI6MjM3NicKICAgICAgLSBET0NLRVJfQ0VSVF9QQVRIPS9jZXJ0cy9jbGllbnQKICAgICAgLSBET0NLRVJfVExTX1ZFUklGWT0xCiAgICB1c2VyOiAnMTAwMDoxMDAwJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1ydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby1kaWQtY2VydHM6L2NlcnRzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBncmVwCiAgICAgICAgLSBmb3JnZWpvLXJ1bm5lcgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgY29tbWFuZDogJ2Zvcmdlam8tcnVubmVyIC0tY29uZmlnIGNvbmZpZy55bWwgZGFlbW9uJwo=",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "postgresql",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
+    "forgejo-with-runner": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTOi1mYWxzZX0nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX1BPUlQ9JHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn0nCiAgICAgIC0gVVNFUl9VSUQ9MTAwMAogICAgICAtIFVTRVJfR0lEPTEwMDAKICAgICAgLSAnUlVOTkVSX1NIQVJFRF9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SVU5ORVJ9JwogICAgICAtIEZPUkdFSk9fX3NlY3VyaXR5X19JTlNUQUxMX0xPQ0s9dHJ1ZQogICAgICAtICdGT1JHRUpPX0FETUlOX1VTRVI9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdGT1JHRUpPX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fRU1BSUw9JHtGT1JHRUpPX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fRU5BQkxFX1BVU0hfQ1JFQVRFX1VTRVI9dHJ1ZQogICAgICAtIEZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUFVTSF9DUkVBVEVfUFJJVkFURT1mYWxzZQogICAgICAtICdGT1JHRUpPX19yZXBvc2l0b3J5X19ERUZBVUxUX1JFUE9fVU5JVFM9cmVwby5jb2RlLHJlcG8uYWN0aW9ucycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfToyMicKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnMgaHR0cDovLzEyNy4wLjAuMTozMDAwID4gL2Rldi9udWxsICYmIHRlc3QgLWYgL3RtcC9ydW5uZXItcmVnaXN0ZXJlZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzMAogICAgY29tbWFuZDogJ2Jhc2ggLWMgJycgL3Vzci9iaW4vczYtc3ZzY2FuIC9ldGMvczYgJiB1bnRpbCBzdSAtYyAiZm9yZ2VqbyBmb3JnZWpvLWNsaSBhY3Rpb25zIHJlZ2lzdGVyIC0ta2VlcC1sYWJlbHMgLS1zZWNyZXQgJCR7UlVOTkVSX1NIQVJFRF9TRUNSRVQ6MDo0MH0iIGdpdCA7IGRvIHNsZWVwIDUgOyBkb25lIDsgc3UgLWMgImZvcmdlam8gYWRtaW4gdXNlciBjcmVhdGUgLS1hZG1pbiAtLXVzZXJuYW1lIFwiJCRGT1JHRUpPX0FETUlOX1VTRVJcIiAtLXBhc3N3b3JkIFwiJCRGT1JHRUpPX0FETUlOX1BBU1NXT1JEXCIgLS1lbWFpbCBcIiQkRk9SR0VKT19BRE1JTl9FTUFJTFwiIC0tbXVzdC1jaGFuZ2UtcGFzc3dvcmQ9ZmFsc2UiIGdpdCB8fCB0cnVlIDsgdG91Y2ggL3RtcC9ydW5uZXItcmVnaXN0ZXJlZCA7IHdhaXQgJycnCiAgZG9ja2VyLWluLWRvY2tlcjoKICAgIGltYWdlOiAnZG9ja2VyOmRpbmQnCiAgICBob3N0bmFtZTogZG9ja2VyCiAgICBwcml2aWxlZ2VkOiB0cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZG9ja2VyCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAndW5peDovLy92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAgIC0gaW5mbwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gRE9DS0VSX1RMU19DRVJURElSPS9jZXJ0cwogICAgICAtIERPQ0tFUl9IT1NUPWRvY2tlci1pbi1kb2NrZXIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGlkLWNlcnRzOi9jZXJ0cycKICBydW5uZXItcmVnaXN0ZXI6CiAgICBpbWFnZTogJ2RhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXI6MTMuMi4wJwogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUlVOTkVSX1NIQVJFRF9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SVU5ORVJ9JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1ydW5uZXItZGF0YTovZGF0YScKICAgIHVzZXI6ICcwOjAnCiAgICBjb21tYW5kOiAnYmFzaCAtZWMgJycgc2VjcmV0PSQke1JVTk5FUl9TSEFSRURfU0VDUkVUOjA6NDB9IDsgdXVpZD0kJChwcmludGYgJXMgIiQke3NlY3JldDowOjE2fSIgfCBvZCAtQW4gLXR4MSB8IHRyIC1kICIgXG4iIHwgc2VkIC1FICJzLyguezh9KSguezR9KSguezR9KSguezR9KSguezEyfSkvXDEtXDItXDMtXDQtXDUvIikgOyBmb3JnZWpvLXJ1bm5lciBnZW5lcmF0ZS1jb25maWcgPiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfCAgbGFiZWxzOiBcW1xdfCAgbGFiZWxzOiBbXCJkb2NrZXI6ZG9ja2VyOi8vbm9kZToyMi1ib29rd29ybVwiLCBcInVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vY2F0dGhlaGFja2VyL3VidW50dTphY3QtMjIuMDRcIiwgXCJ1YnVudHUtMjIuMDQ6ZG9ja2VyOi8vY2F0dGhlaGFja2VyL3VidW50dTphY3QtMjIuMDRcIl18IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfG5ldHdvcms6IC4qfG5ldHdvcms6IGhvc3R8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfF4gIGVudnM6JCR8ICBlbnZzOlxuICAgIERPQ0tFUl9IT1NUOiB0Y3A6Ly9kb2NrZXI6MjM3NlxuICAgIERPQ0tFUl9UTFNfVkVSSUZZOiAxXG4gICAgRE9DS0VSX0NFUlRfUEFUSDogL2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8XiAgb3B0aW9uczp8ICBvcHRpb25zOiAtdiAvY2VydHMvY2xpZW50Oi9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfCAgdmFsaWRfdm9sdW1lczogXFtcXSQkfCAgdmFsaWRfdm9sdW1lczpcbiAgICAtIC9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfCAgY29ubmVjdGlvbnM6fCAgY29ubmVjdGlvbnM6XG4gICAgZGVmYXVsdDpcbiAgICAgIHVybDogaHR0cDovL2Zvcmdlam86MzAwMFxuICAgICAgdXVpZDogJCR1dWlkXG4gICAgICB0b2tlbjogJCRzZWNyZXR8IiBjb25maWcueW1sIDsgY2hvd24gLVIgMTAwMDoxMDAwIC9kYXRhICcnJwogIHJ1bm5lcjoKICAgIGltYWdlOiAnZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL3J1bm5lcjoxMy4yLjAnCiAgICBkZXBlbmRzX29uOgogICAgICBmb3JnZWpvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGRvY2tlci1pbi1kb2NrZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcnVubmVyLXJlZ2lzdGVyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnRE9DS0VSX0hPU1Q9dGNwOi8vZG9ja2VyOjIzNzYnCiAgICAgIC0gRE9DS0VSX0NFUlRfUEFUSD0vY2VydHMvY2xpZW50CiAgICAgIC0gRE9DS0VSX1RMU19WRVJJRlk9MQogICAgdXNlcjogJzEwMDA6MTAwMCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcnVubmVyLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tZGlkLWNlcnRzOi9jZXJ0cycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwZ3JlcAogICAgICAgIC0gZm9yZ2Vqby1ydW5uZXIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTAKICAgIGNvbW1hbmQ6ICdmb3JnZWpvLXJ1bm5lciAtLWNvbmZpZyBjb25maWcueW1sIGRhZW1vbicK",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
     "forgejo": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgcG9ydHM6CiAgICAgIC0gJzIyMjIyOjIyJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZPUkdFSk9fMzAwMAogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1JPT1RfVVJMPSR7U0VSVklDRV9VUkxfRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XRURfRE9NQUlOU30nCiAgICAgIC0gJ0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M9JHtGT1JHRUpPX19taWdyYXRpb25zX19BTExPV19MT0NBTE5FVFdPUktTLWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "version control",
             "collaboration",
@@ -1755,7 +1842,7 @@
     "formbricks": {
         "documentation": "https://formbricks.com/docs/self-hosting/setup/docker?utm_source=coolify.io",
         "slogan": "Open Source Survey Platform",
-        "compose": "c2VydmljZXM6CiAgZm9ybWJyaWNrczoKICAgIGltYWdlOiAnZ2hjci5pby9mb3JtYnJpY2tzL2Zvcm1icmlja3M6NC41LjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9GT1JNQlJJQ0tTXzMwMDAKICAgICAgLSBXRUJBUFBfVVJMPSRTRVJWSUNFX1VSTF9GT1JNQlJJQ0tTCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTDokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMQHBvc3RncmVzcWw6NTQzMi8ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZvcm1icmlja3N9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgICAgIC0gTkVYVEFVVEhfU0VDUkVUPSRTRVJWSUNFX0JBU0U2NF9ORVhUQVVUSAogICAgICAtIE5FWFRBVVRIX1VSTD0kU0VSVklDRV9VUkxfRk9STUJSSUNLUwogICAgICAtIEVOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OCiAgICAgIC0gQ1JPTl9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0X0NST04KICAgICAgLSAnRU5URVJQUklTRV9MSUNFTlNFX0tFWT0ke0VOVEVSUFJJU0VfTElDRU5TRV9LRVl9JwogICAgICAtICdNQUlMX0ZST009JHtNQUlMX0ZST006LXRlc3RAZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1Q6LXRlc3QuZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ1NNVFBfVVNFUj0ke1NNVFBfVVNFUjotdGVzdH0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEOi10ZXN0fScKICAgICAgLSAnU01UUF9TRUNVUkVfRU5BQkxFRD0ke1NNVFBfU0VDVVJFX0VOQUJMRUQ6LTB9JwogICAgICAtICdTTVRQX1JFSkVDVF9VTkFVVEhPUklaRURfVExTPSR7U01UUF9SRUpFQ1RfVU5BVVRIT1JJWkVEX1RMUzotMX0nCiAgICAgIC0gJ1NIT1JUX1VSTF9CQVNFPSR7U0hPUlRfVVJMX0JBU0V9JwogICAgICAtICdFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ9JHtFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ6LTF9JwogICAgICAtICdQQVNTV09SRF9SRVNFVF9ESVNBQkxFRD0ke1BBU1NXT1JEX1JFU0VUX0RJU0FCTEVEOi0xfScKICAgICAgLSAnRU1BSUxfQVVUSF9ESVNBQkxFRD0ke0VNQUlMX0FVVEhfRElTQUJMRUQ6LTB9JwogICAgICAtICdJTlZJVEVfRElTQUJMRUQ9JHtJTlZJVEVfRElTQUJMRUQ6LTB9JwogICAgICAtICdBU1NFVF9QUkVGSVhfVVJMPSR7QVNTRVRfUFJFRklYX1VSTH0nCiAgICAgIC0gJ1VOU1BMQVNIX0FDQ0VTU19LRVk9JHtVTlNQTEFTSF9BQ0NFU1NfS0VZfScKICAgICAgLSAnR0lUSFVCX0lEPSR7R0lUSFVCX0lEfScKICAgICAgLSAnR0lUSFVCX1NFQ1JFVD0ke0dJVEhVQl9TRUNSRVR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX0lEPSR7R09PR0xFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfU0VDUkVUPSR7R09PR0xFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRUFEX0NMSUVOVF9JRD0ke0FaVVJFQURfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVBRF9DTElFTlRfU0VDUkVUPSR7QVpVUkVBRF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVBRF9URU5BTlRfSUQ9JHtBWlVSRUFEX1RFTkFOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX0lEPSR7T0lEQ19DTElFTlRfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9TRUNSRVQ9JHtPSURDX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdPSURDX0lTU1VFUj0ke09JRENfSVNTVUVSfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0lHTklOR19BTEdPUklUSE09JHtPSURDX1NJR05JTkdfQUxHT1JJVEhNfScKICAgICAgLSAnTk9USU9OX09BVVRIX0NMSUVOVF9JRD0ke05PVElPTl9PQVVUSF9DTElFTlRfSUR9JwogICAgICAtICdOT1RJT05fT0FVVEhfQ0xJRU5UX1NFQ1JFVD0ke05PVElPTl9PQVVUSF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX1NIRUVUU19DTElFTlRfSUQ9JHtHT09HTEVfU0hFRVRTX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfUkVESVJFQ1RfVVJMPSR7R09PR0xFX1NIRUVUU19SRURJUkVDVF9VUkx9JwogICAgICAtICdBSVJUQUJMRV9DTElFTlRfSUQ9JHtBSVJUQUJMRV9DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ1BSSVZBQ1lfVVJMPSR7UFJJVkFDWV9VUkx9JwogICAgICAtICdURVJNU19VUkw9JHtURVJNU19VUkx9JwogICAgICAtICdJTVBSSU5UX1VSTD0ke0lNUFJJTlRfVVJMfScKICAgICAgLSAnUkFURV9MSU1JVElOR19ESVNBQkxFRD0ke1JBVEVfTElNSVRJTkdfRElTQUJMRUQ6LTB9JwogICAgICAtICdPUEVOVEVMRU1FVFJZX0xJU1RFTkVSX1VSTD0ke09QRU5URUxFTUVUUllfTElTVEVORVJfVVJMfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vdmFsa2V5OjYzNzknCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX0lEPSR7REVGQVVMVF9PUkdBTklaQVRJT05fSUR9JwogICAgICAtICdERUZBVUxUX09SR0FOSVpBVElPTl9ST0xFPSR7REVGQVVMVF9PUkdBTklaQVRJT05fUk9MRTotb3duZXJ9JwogICAgICAtIFMzX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtICdTM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gUzNfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFMzX0JVQ0tFVF9OQU1FPWZvcm1icmlja3MKICAgICAgLSBTM19FTkRQT0lOVF9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBTM19GT1JDRV9QQVRIX1NUWUxFPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcm1icmlja3MtdXBsb2FkczovYXBwcy93ZWIvdXBsb2Fkcy8nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHZhbGtleToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwZ3ZlY3Rvci9wZ3ZlY3RvcjpwZzE2JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mb3JtYnJpY2tzfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2YWxrZXk6CiAgICBpbWFnZTogJ3ZhbGtleS92YWxrZXk6OC1hbHBpbmUnCiAgICBjb21tYW5kOiAndmFsa2V5LXNlcnZlciAtLWFwcGVuZG9ubHkgeWVzJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy12YWxrZXk6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3ZhbGtleS1jbGkgcGluZyB8IGdyZXAgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAzcwogIG1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1NFUlZFUl9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTD0kTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkwKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcm1icmlja3MtbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtaW5pby1pbml0OgogICAgaW1hZ2U6ICdtaW5pby9tYzpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDogInNoIC1jIFwiXG4gIG1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCAke1NFUlZJQ0VfVVNFUl9NSU5JT30gJHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfSAmJlxuICBtYyBtYiAtcCBsb2NhbC9mb3JtYnJpY2tzIHx8IHRydWUgJiZcbiAgbWMgYW5vbnltb3VzIHNldCBwcml2YXRlIGxvY2FsL2Zvcm1icmlja3NcblwiXG4iCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUK",
+        "compose": "c2VydmljZXM6CiAgZm9ybWJyaWNrczoKICAgIGltYWdlOiAnZ2hjci5pby9mb3JtYnJpY2tzL2Zvcm1icmlja3M6NC41LjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9GT1JNQlJJQ0tTXzMwMDAKICAgICAgLSBXRUJBUFBfVVJMPSRTRVJWSUNFX1VSTF9GT1JNQlJJQ0tTCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTDokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMQHBvc3RncmVzcWw6NTQzMi8ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZvcm1icmlja3N9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgICAgIC0gTkVYVEFVVEhfU0VDUkVUPSRTRVJWSUNFX0JBU0U2NF9ORVhUQVVUSAogICAgICAtIE5FWFRBVVRIX1VSTD0kU0VSVklDRV9VUkxfRk9STUJSSUNLUwogICAgICAtIEVOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OCiAgICAgIC0gQ1JPTl9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0X0NST04KICAgICAgLSAnRU5URVJQUklTRV9MSUNFTlNFX0tFWT0ke0VOVEVSUFJJU0VfTElDRU5TRV9LRVl9JwogICAgICAtICdNQUlMX0ZST009JHtNQUlMX0ZST006LXRlc3RAZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1Q6LXRlc3QuZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ1NNVFBfVVNFUj0ke1NNVFBfVVNFUjotdGVzdH0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEOi10ZXN0fScKICAgICAgLSAnU01UUF9TRUNVUkVfRU5BQkxFRD0ke1NNVFBfU0VDVVJFX0VOQUJMRUQ6LTB9JwogICAgICAtICdTTVRQX1JFSkVDVF9VTkFVVEhPUklaRURfVExTPSR7U01UUF9SRUpFQ1RfVU5BVVRIT1JJWkVEX1RMUzotMX0nCiAgICAgIC0gJ1NIT1JUX1VSTF9CQVNFPSR7U0hPUlRfVVJMX0JBU0V9JwogICAgICAtICdFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ9JHtFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ6LTF9JwogICAgICAtICdQQVNTV09SRF9SRVNFVF9ESVNBQkxFRD0ke1BBU1NXT1JEX1JFU0VUX0RJU0FCTEVEOi0xfScKICAgICAgLSAnRU1BSUxfQVVUSF9ESVNBQkxFRD0ke0VNQUlMX0FVVEhfRElTQUJMRUQ6LTB9JwogICAgICAtICdJTlZJVEVfRElTQUJMRUQ9JHtJTlZJVEVfRElTQUJMRUQ6LTB9JwogICAgICAtICdBU1NFVF9QUkVGSVhfVVJMPSR7QVNTRVRfUFJFRklYX1VSTH0nCiAgICAgIC0gJ1VOU1BMQVNIX0FDQ0VTU19LRVk9JHtVTlNQTEFTSF9BQ0NFU1NfS0VZfScKICAgICAgLSAnR0lUSFVCX0lEPSR7R0lUSFVCX0lEfScKICAgICAgLSAnR0lUSFVCX1NFQ1JFVD0ke0dJVEhVQl9TRUNSRVR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX0lEPSR7R09PR0xFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfU0VDUkVUPSR7R09PR0xFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRUFEX0NMSUVOVF9JRD0ke0FaVVJFQURfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVBRF9DTElFTlRfU0VDUkVUPSR7QVpVUkVBRF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVBRF9URU5BTlRfSUQ9JHtBWlVSRUFEX1RFTkFOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX0lEPSR7T0lEQ19DTElFTlRfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9TRUNSRVQ9JHtPSURDX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdPSURDX0lTU1VFUj0ke09JRENfSVNTVUVSfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0lHTklOR19BTEdPUklUSE09JHtPSURDX1NJR05JTkdfQUxHT1JJVEhNfScKICAgICAgLSAnTk9USU9OX09BVVRIX0NMSUVOVF9JRD0ke05PVElPTl9PQVVUSF9DTElFTlRfSUR9JwogICAgICAtICdOT1RJT05fT0FVVEhfQ0xJRU5UX1NFQ1JFVD0ke05PVElPTl9PQVVUSF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX1NIRUVUU19DTElFTlRfSUQ9JHtHT09HTEVfU0hFRVRTX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfUkVESVJFQ1RfVVJMPSR7R09PR0xFX1NIRUVUU19SRURJUkVDVF9VUkx9JwogICAgICAtICdBSVJUQUJMRV9DTElFTlRfSUQ9JHtBSVJUQUJMRV9DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ1BSSVZBQ1lfVVJMPSR7UFJJVkFDWV9VUkx9JwogICAgICAtICdURVJNU19VUkw9JHtURVJNU19VUkx9JwogICAgICAtICdJTVBSSU5UX1VSTD0ke0lNUFJJTlRfVVJMfScKICAgICAgLSAnUkFURV9MSU1JVElOR19ESVNBQkxFRD0ke1JBVEVfTElNSVRJTkdfRElTQUJMRUQ6LTB9JwogICAgICAtICdPUEVOVEVMRU1FVFJZX0xJU1RFTkVSX1VSTD0ke09QRU5URUxFTUVUUllfTElTVEVORVJfVVJMfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vdmFsa2V5OjYzNzknCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX0lEPSR7REVGQVVMVF9PUkdBTklaQVRJT05fSUR9JwogICAgICAtICdERUZBVUxUX09SR0FOSVpBVElPTl9ST0xFPSR7REVGQVVMVF9PUkdBTklaQVRJT05fUk9MRTotb3duZXJ9JwogICAgICAtIFMzX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtICdTM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gUzNfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFMzX0JVQ0tFVF9OQU1FPWZvcm1icmlja3MKICAgICAgLSBTM19FTkRQT0lOVF9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBTM19GT1JDRV9QQVRIX1NUWUxFPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcm1icmlja3MtdXBsb2FkczovYXBwcy93ZWIvdXBsb2Fkcy8nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHZhbGtleToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwZ3ZlY3Rvci9wZ3ZlY3RvcjpwZzE2JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mb3JtYnJpY2tzfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2YWxrZXk6CiAgICBpbWFnZTogJ3ZhbGtleS92YWxrZXk6OC1hbHBpbmUnCiAgICBjb21tYW5kOiAndmFsa2V5LXNlcnZlciAtLWFwcGVuZG9ubHkgeWVzJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy12YWxrZXk6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3ZhbGtleS1jbGkgcGluZyB8IGdyZXAgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAzcwogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNSU5JT19TRVJWRVJfVVJMPSRNSU5JT19TRVJWRVJfVVJMCiAgICAgIC0gTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkw9JE1JTklPX0JST1dTRVJfUkVESVJFQ1RfVVJMCiAgICAgIC0gTUlOSU9fUk9PVF9VU0VSPSRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgLSBNSU5JT19ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JtYnJpY2tzLW1pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6ICJzaCAtYyBcIlxuICBtYyBhbGlhcyBzZXQgbG9jYWwgaHR0cDovL21pbmlvOjkwMDAgJHtTRVJWSUNFX1VTRVJfTUlOSU99ICR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30gJiZcbiAgbWMgbWIgLXAgbG9jYWwvZm9ybWJyaWNrcyB8fCB0cnVlICYmXG4gIG1jIGFub255bW91cyBzZXQgcHJpdmF0ZSBsb2NhbC9mb3JtYnJpY2tzXG5cIlxuIgogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCg==",
         "tags": [
             "form",
             "builder",
@@ -2260,7 +2347,7 @@
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
         "slogan": "Hatchet allows you to run background tasks at scale with a high-throughput, low-latency computing service built on an open-source, fault-tolerant queue.",
-        "compose": "c2VydmljZXM6CiAgaGF0Y2hldC1kYXNoYm9hcmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LWRhc2hib2FyZDpsYXRlc3QnCiAgICBjb21tYW5kOiAnc2ggLi9lbnRyeXBvaW50LnNoIC0tY29uZmlnIC9oYXRjaGV0L2NvbmZpZycKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJFBPU1RHUkVTX0RCJwogICAgICAtIFNFUlZJQ0VfVVJMX0hBVENIRVRfODAKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJhYmJpdG1xOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHNldHVwLWNvbmZpZzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgICBtaWdyYXRpb246CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hhdGNoZXQtY2VydHM6L2hhdGNoZXQvY2VydHMnCiAgICAgIC0gJ2hhdGNoZXQtY29uZmlnOi9oYXRjaGV0L2NvbmZpZycKICBoYXRjaGV0LWVuZ2luZToKICAgIGltYWdlOiAnZ2hjci5pby9oYXRjaGV0LWRldi9oYXRjaGV0L2hhdGNoZXQtZW5naW5lOmxhdGVzdCcKICAgIGNvbW1hbmQ6ICcvaGF0Y2hldC9oYXRjaGV0LWVuZ2luZSAtLWNvbmZpZyAvaGF0Y2hldC9jb25maWcnCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByYWJiaXRtcToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzZXR1cC1jb25maWc6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgbWlncmF0aW9uOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0Bwb3N0Z3Jlczo1NDMyLyRQT1NUR1JFU19EQicKICAgICAgLSAnU0VSVkVSX0dSUENfQklORF9BRERSRVNTPSR7U0VSVkVSX0dSUENfQklORF9BRERSRVNTOi0wLjAuMC4wfScKICAgICAgLSAnU0VSVkVSX0dSUENfSU5TRUNVUkU9JHtTRVJWRVJfR1JQQ19JTlNFQ1VSRTotdH0nCiAgICB2b2x1bWVzOgogICAgICAtICdoYXRjaGV0LWNlcnRzOi9oYXRjaGV0L2NlcnRzJwogICAgICAtICdoYXRjaGV0LWNvbmZpZzovaGF0Y2hldC9jb25maWcnCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQT1NUR1JFU19VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBQT1NUR1JFU19QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1oYXRjaGV0fScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByYWJiaXRtcToKICAgIGltYWdlOiAncmFiYml0bXE6My1tYW5hZ2VtZW50JwogICAgaG9zdG5hbWU6IHJhYmJpdG1xCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9SQUJCSVRNUV8xNTY3MgogICAgICAtIFJBQkJJVE1RX0RFRkFVTFRfVVNFUj0kU0VSVklDRV9VU0VSX1JBQkJJVE1RCiAgICAgIC0gUkFCQklUTVFfREVGQVVMVF9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RCiAgICAgIC0gJ1BPUlQ9JHtSQUJCSVRNUV9QT1JUOi01NjcyfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncmFiYml0bXEtZGlhZ25vc3RpY3MgLXEgcGluZycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAncmFiYml0bXEtZGF0YTovdmFyL2xpYi9yYWJiaXRtcS8nCiAgbWlncmF0aW9uOgogICAgaW1hZ2U6ICdnaGNyLmlvL2hhdGNoZXQtZGV2L2hhdGNoZXQvaGF0Y2hldC1taWdyYXRlOmxhdGVzdCcKICAgIGNvbW1hbmQ6IC9oYXRjaGV0L2hhdGNoZXQtbWlncmF0ZQogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0Bwb3N0Z3Jlczo1NDMyLyRQT1NUR1JFU19EQicKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgc2V0dXAtY29uZmlnOgogICAgaW1hZ2U6ICdnaGNyLmlvL2hhdGNoZXQtZGV2L2hhdGNoZXQvaGF0Y2hldC1hZG1pbjpsYXRlc3QnCiAgICBjb21tYW5kOiAnL2hhdGNoZXQvaGF0Y2hldC1hZG1pbiBxdWlja3N0YXJ0IC0tc2tpcCBjZXJ0cyAtLWdlbmVyYXRlZC1jb25maWctZGlyIC9oYXRjaGV0L2NvbmZpZyAtLW92ZXJ3cml0ZT1mYWxzZScKICAgIHJlc3RhcnQ6ICdubycKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJFBPU1RHUkVTX0RCJwogICAgICAtICdTRVJWRVJfVEFTS1FVRVVFX1JBQkJJVE1RX1VSTD1hbXFwOi8vJFNFUlZJQ0VfVVNFUl9SQUJCSVRNUTokU0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUUByYWJiaXRtcTo1NjcyLycKICAgICAgLSAnU0VSVkVSX0FVVEhfQ09PS0lFX0RPTUFJTj0ke1NFUlZFUl9BVVRIX0NPT0tJRV9ET01BSU46LWxvY2FsaG9zdDo4MDgwfScKICAgICAgLSAnU0VSVkVSX0FVVEhfQ09PS0lFX0lOU0VDVVJFPSR7U0VSVkVSX0FVVEhfQ09PS0lFX0lOU0VDVVJFOi10fScKICAgICAgLSAnU0VSVkVSX0dSUENfQklORF9BRERSRVNTPSR7U0VSVkVSX0dSUENfQklORF9BRERSRVNTOi0wLjAuMC4wfScKICAgICAgLSAnU0VSVkVSX0dSUENfSU5TRUNVUkU9JHtTRVJWRVJfR1JQQ19JTlNFQ1VSRTotdH0nCiAgICAgIC0gJ1NFUlZFUl9HUlBDX0JST0FEQ0FTVF9BRERSRVNTPSR7U0VSVkVSX0dSUENfQlJPQURDQVNUX0FERFJFU1M6LWxvY2FsaG9zdDo3MDc3fScKICAgICAgLSBTRVJWRVJfREVGQVVMVF9FTkdJTkVfVkVSU0lPTj1WMQogICAgICAtICdTRVJWRVJfSU5URVJOQUxfQ0xJRU5UX0lOVEVSTkFMX0dSUENfQlJPQURDQVNUX0FERFJFU1M9JHtTRVJWRVJfSU5URVJOQUxfQ0xJRU5UX0lOVEVSTkFMX0dSUENfQlJPQURDQVNUX0FERFJFU1M6LWhhdGNoZXQtZW5naW5lOjcwNzd9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGF0Y2hldF9jZXJ0czovaGF0Y2hldC9jZXJ0cycKICAgICAgLSAnaGF0Y2hldF9jb25maWc6L2hhdGNoZXQvY29uZmlnJwogICAgZGVwZW5kc19vbjoKICAgICAgbWlncmF0aW9uOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICAgIHJhYmJpdG1xOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
+        "compose": "c2VydmljZXM6CiAgaGF0Y2hldC1kYXNoYm9hcmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LWRhc2hib2FyZDpsYXRlc3QnCiAgICBjb21tYW5kOiAnc2ggLi9lbnRyeXBvaW50LnNoIC0tY29uZmlnIC9oYXRjaGV0L2NvbmZpZycKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICAgIC0gU0VSVklDRV9VUkxfSEFUQ0hFVF84MAogICAgICAtICdTRVJWRVJfQVVUSF9TRVRfRU1BSUxfVkVSSUZJRUQ9JHtTRVJWRVJfQVVUSF9TRVRfRU1BSUxfVkVSSUZJRUQ6LXRydWV9JwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmFiYml0bXE6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc2V0dXAtY29uZmlnOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICAgIG1pZ3JhdGlvbjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgdm9sdW1lczoKICAgICAgLSAnaGF0Y2hldC1jZXJ0czovaGF0Y2hldC9jZXJ0cycKICAgICAgLSAnaGF0Y2hldC1jb25maWc6L2hhdGNoZXQvY29uZmlnJwogIGhhdGNoZXQtZW5naW5lOgogICAgaW1hZ2U6ICdnaGNyLmlvL2hhdGNoZXQtZGV2L2hhdGNoZXQvaGF0Y2hldC1lbmdpbmU6bGF0ZXN0JwogICAgY29tbWFuZDogJy9oYXRjaGV0L2hhdGNoZXQtZW5naW5lIC0tY29uZmlnIC9oYXRjaGV0L2NvbmZpZycKICAgIHJlc3RhcnQ6IG9uLWZhaWx1cmUKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJhYmJpdG1xOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHNldHVwLWNvbmZpZzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgICBtaWdyYXRpb246CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICAgIC0gJ1NFUlZFUl9HUlBDX0JJTkRfQUREUkVTUz0ke1NFUlZFUl9HUlBDX0JJTkRfQUREUkVTUzotMC4wLjAuMH0nCiAgICAgIC0gJ1NFUlZFUl9HUlBDX0lOU0VDVVJFPSR7U0VSVkVSX0dSUENfSU5TRUNVUkU6LXR9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGF0Y2hldC1jZXJ0czovaGF0Y2hldC9jZXJ0cycKICAgICAgLSAnaGF0Y2hldC1jb25maWc6L2hhdGNoZXQvY29uZmlnJwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdwb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmFiYml0bXE6CiAgICBpbWFnZTogJ3JhYmJpdG1xOjMtbWFuYWdlbWVudCcKICAgIGhvc3RuYW1lOiByYWJiaXRtcQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUkFCQklUTVFfMTU2NzIKICAgICAgLSBSQUJCSVRNUV9ERUZBVUxUX1VTRVI9JFNFUlZJQ0VfVVNFUl9SQUJCSVRNUQogICAgICAtIFJBQkJJVE1RX0RFRkFVTFRfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUQogICAgICAtICdQT1JUPSR7UkFCQklUTVFfUE9SVDotNTY3Mn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ3JhYmJpdG1xLWRpYWdub3N0aWNzIC1xIGNoZWNrX3BvcnRfY29ubmVjdGl2aXR5JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDIwCiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcS1kYXRhOi92YXIvbGliL3JhYmJpdG1xLycKICBtaWdyYXRpb246CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LW1pZ3JhdGU6bGF0ZXN0JwogICAgY29tbWFuZDogL2hhdGNoZXQvaGF0Y2hldC1taWdyYXRlCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIHNldHVwLWNvbmZpZzoKICAgIGltYWdlOiAnZ2hjci5pby9oYXRjaGV0LWRldi9oYXRjaGV0L2hhdGNoZXQtYWRtaW46bGF0ZXN0JwogICAgY29tbWFuZDogJy9oYXRjaGV0L2hhdGNoZXQtYWRtaW4gcXVpY2tzdGFydCAtLXNraXAgY2VydHMgLS1nZW5lcmF0ZWQtY29uZmlnLWRpciAvaGF0Y2hldC9jb25maWcgLS1vdmVyd3JpdGU9ZmFsc2UnCiAgICByZXN0YXJ0OiAnbm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0Bwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWhhdGNoZXR9JwogICAgICAtICdTRVJWRVJfVEFTS1FVRVVFX1JBQkJJVE1RX1VSTD1hbXFwOi8vJFNFUlZJQ0VfVVNFUl9SQUJCSVRNUTokU0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUUByYWJiaXRtcTo1NjcyLycKICAgICAgLSAnU0VSVkVSX0FVVEhfQ09PS0lFX0RPTUFJTj0ke1NFUlZFUl9BVVRIX0NPT0tJRV9ET01BSU46LWxvY2FsaG9zdDo4MDgwfScKICAgICAgLSAnU0VSVkVSX0FVVEhfQ09PS0lFX0lOU0VDVVJFPSR7U0VSVkVSX0FVVEhfQ09PS0lFX0lOU0VDVVJFOi10fScKICAgICAgLSAnU0VSVkVSX0dSUENfQklORF9BRERSRVNTPSR7U0VSVkVSX0dSUENfQklORF9BRERSRVNTOi0wLjAuMC4wfScKICAgICAgLSAnU0VSVkVSX0dSUENfSU5TRUNVUkU9JHtTRVJWRVJfR1JQQ19JTlNFQ1VSRTotdH0nCiAgICAgIC0gJ1NFUlZFUl9HUlBDX0JST0FEQ0FTVF9BRERSRVNTPSR7U0VSVkVSX0dSUENfQlJPQURDQVNUX0FERFJFU1M6LWxvY2FsaG9zdDo3MDc3fScKICAgICAgLSBTRVJWRVJfREVGQVVMVF9FTkdJTkVfVkVSU0lPTj1WMQogICAgICAtICdTRVJWRVJfSU5URVJOQUxfQ0xJRU5UX0lOVEVSTkFMX0dSUENfQlJPQURDQVNUX0FERFJFU1M9JHtTRVJWRVJfSU5URVJOQUxfQ0xJRU5UX0lOVEVSTkFMX0dSUENfQlJPQURDQVNUX0FERFJFU1M6LWhhdGNoZXQtZW5naW5lOjcwNzd9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGF0Y2hldC1jZXJ0czovaGF0Y2hldC9jZXJ0cycKICAgICAgLSAnaGF0Y2hldC1jb25maWc6L2hhdGNoZXQvY29uZmlnJwogICAgZGVwZW5kc19vbjoKICAgICAgbWlncmF0aW9uOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICAgIHJhYmJpdG1xOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "ai-agents",
             "background-tasks",
@@ -2270,7 +2357,7 @@
         "category": "automation",
         "logo": "svgs/hatchet.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
         "port": "80"
     },
     "healthchecks": {
@@ -4280,7 +4367,7 @@
     "penpot-with-s3": {
         "documentation": "https://help.penpot.app/technical-guide/getting-started/#install-with-docker?utm_source=coolify.io",
         "slogan": "Penpot is the first Open Source design and prototyping platform for product teams.",
-        "compose": "c2VydmljZXM6CiAgZnJvbnRlbmQ6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9mcm9udGVuZDoyLjExLjEnCiAgICBkZXBlbmRzX29uOgogICAgICBwZW5wb3QtYmFja2VuZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwZW5wb3QtZXhwb3J0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZST05URU5EXzgwODAKICAgICAgLSAnUEVOUE9UX0ZMQUdTPSR7UEVOUE9UX0JBQ0tFTkRfRkxBR1M6LWVuYWJsZS1sb2dpbi13aXRoLXBhc3N3b3JkfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgcGVucG90LWJhY2tlbmQ6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9iYWNrZW5kOjIuMTEuMScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBlbnBvdC12YWxrZXk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgbWluaW8taW5pdDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BFTlBPVF9GTEFHUz0ke1BFTlBPVF9CQUNLRU5EX0ZMQUdTOi1lbmFibGUtbG9naW4td2l0aC1wYXNzd29yZH0nCiAgICAgIC0gUEVOUE9UX0hUVFBfU0VSVkVSX1BPUlQ9NjA2MAogICAgICAtICdQRU5QT1RfU0VDUkVUX0tFWT0ke1NFUlZJQ0VfUkVBTEJBU0U2NF82NF9QRU5QT1R9JwogICAgICAtICdQRU5QT1RfUFVCTElDX1VSST0ke1NFUlZJQ0VfVVJMX0ZST05URU5EXzgwODB9JwogICAgICAtICdQRU5QT1RfQkFDS0VORF9VUkk9aHR0cDovL3BlbnBvdC1iYWNrZW5kJwogICAgICAtICdQRU5QT1RfRVhQT1JURVJfVVJJPWh0dHA6Ly9wZW5wb3QtZXhwb3J0ZXInCiAgICAgIC0gJ1BFTlBPVF9EQVRBQkFTRV9VUkk9cG9zdGdyZXNxbDovL3Bvc3RncmVzLyR7UE9TVEdSRVNfREI6LXBlbnBvdH0nCiAgICAgIC0gJ1BFTlBPVF9EQVRBQkFTRV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BFTlBPVF9EQVRBQkFTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQRU5QT1RfUkVESVNfVVJJPXJlZGlzOi8vcGVucG90LXZhbGtleS8wJwogICAgICAtICdQRU5QT1RfVEVMRU1FVFJZX0VOQUJMRUQ9JHtQRU5QT1RfVEVMRU1FVFJZX0VOQUJMRUQ6LWZhbHNlfScKICAgICAgLSBQRU5QT1RfT0JKRUNUU19TVE9SQUdFX0JBQ0tFTkQ9czMKICAgICAgLSBQRU5QT1RfT0JKRUNUU19TVE9SQUdFX1MzX1JFR0lPTj11cy1lYXN0LTEKICAgICAgLSBQRU5QT1RfT0JKRUNUU19TVE9SQUdFX1MzX0JVQ0tFVD1wZW5wb3QKICAgICAgLSAnUEVOUE9UX09CSkVDVFNfU1RPUkFHRV9TM19FTkRQT0lOVD1odHRwOi8vbWluaW86OTAwMCcKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnUEVOUE9UX1NNVFBfREVGQVVMVF9GUk9NPSR7UEVOUE9UX1NNVFBfREVGQVVMVF9GUk9NOi1uby1yZXBseUBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX0RFRkFVTFRfUkVQTFlfVE89JHtQRU5QT1RfU01UUF9ERUZBVUxUX1JFUExZX1RPOi1uby1yZXBseUBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX0hPU1Q9JHtQRU5QT1RfU01UUF9IT1NUOi1tYWlscGl0fScKICAgICAgLSAnUEVOUE9UX1NNVFBfUE9SVD0ke1BFTlBPVF9TTVRQX1BPUlQ6LTEwMjV9JwogICAgICAtICdQRU5QT1RfU01UUF9VU0VSTkFNRT0ke1BFTlBPVF9TTVRQX1VTRVJOQU1FOi1wZW5wb3R9JwogICAgICAtICdQRU5QT1RfU01UUF9QQVNTV09SRD0ke1BFTlBPVF9TTVRQX1BBU1NXT1JEOi1wZW5wb3R9JwogICAgICAtICdQRU5QT1RfU01UUF9UTFM9JHtQRU5QT1RfU01UUF9UTFM6LWZhbHNlfScKICAgICAgLSAnUEVOUE9UX1NNVFBfU1NMPSR7UEVOUE9UX1NNVFBfU1NMOi1mYWxzZX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbm9kZQogICAgICAgIC0gJy1lJwogICAgICAgIC0gInJlcXVpcmUoJ2h0dHAnKS5nZXQoe2hvc3Q6JzEyNy4wLjAuMScsIHBvcnQ6NjA2MCwgcGF0aDonL3JlYWR5eid9LCByZXMgPT4gcHJvY2Vzcy5leGl0KHJlcy5zdGF0dXNDb2RlPT09MjAwID8gMCA6IDEpKS5vbignZXJyb3InLCAoKSA9PiBwcm9jZXNzLmV4aXQoMSkpOyIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTUKICBwZW5wb3QtZXhwb3J0ZXI6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9leHBvcnRlcjoyLjExLjEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUEVOUE9UX1BVQkxJQ19VUkk9JHtTRVJWSUNFX1VSTF9GUk9OVEVORF84MDgwfScKICAgICAgLSAnUEVOUE9UX1JFRElTX1VSST1yZWRpczovL3BlbnBvdC12YWxrZXkvMCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo2MDYxL3JlYWR5eicKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtaW5pby1pbml0OgogICAgaW1hZ2U6ICdtaW5pby9tYzpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDogInNoIC1jIFwiXG4gIG1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCAke1NFUlZJQ0VfVVNFUl9NSU5JT30gJHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfSAmJlxuICBtYyBtYiAtcCBsb2NhbC9wZW5wb3QgfHwgdHJ1ZSAmJlxuICBtYyBhbm9ueW1vdXMgc2V0IHByaXZhdGUgbG9jYWwvcGVucG90XG5cIlxuIgogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE1JwogICAgdm9sdW1lczoKICAgICAgLSAncGVucG90LXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQT1NUR1JFU19JTklUREJfQVJHUz0tLWRhdGEtY2hlY2tzdW1zCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wZW5wb3R9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBlbnBvdC12YWxrZXk6CiAgICBpbWFnZTogJ3ZhbGtleS92YWxrZXk6OC4xJwogICAgdm9sdW1lczoKICAgICAgLSAncGVucG90LXZhbGtleS1kYXRhOi9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1ZBTEtFWV9FWFRSQV9GTEFHUz0tLW1heG1lbW9yeSAxMjhtYiAtLW1heG1lbW9yeS1wb2xpY3kgdm9sYXRpbGUtbGZ1JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd2YWxrZXktY2xpIHBpbmcgfCBncmVwIFBPTkcnCiAgICAgIGludGVydmFsOiAxcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogM3MKICBtYWlscGl0OgogICAgaW1hZ2U6ICdheGxsZW50L21haWxwaXQ6djEuMjgnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9NQUlMUElUXzgwMjUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSAvbWFpbHBpdAogICAgICAgIC0gcmVhZHl6CiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
+        "compose": "c2VydmljZXM6CiAgZnJvbnRlbmQ6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9mcm9udGVuZDoyLjExLjEnCiAgICBkZXBlbmRzX29uOgogICAgICBwZW5wb3QtYmFja2VuZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwZW5wb3QtZXhwb3J0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0ZST05URU5EXzgwODAKICAgICAgLSAnUEVOUE9UX0ZMQUdTPSR7UEVOUE9UX0JBQ0tFTkRfRkxBR1M6LWVuYWJsZS1sb2dpbi13aXRoLXBhc3N3b3JkfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgcGVucG90LWJhY2tlbmQ6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9iYWNrZW5kOjIuMTEuMScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBlbnBvdC12YWxrZXk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgbWluaW8taW5pdDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BFTlBPVF9GTEFHUz0ke1BFTlBPVF9CQUNLRU5EX0ZMQUdTOi1lbmFibGUtbG9naW4td2l0aC1wYXNzd29yZH0nCiAgICAgIC0gUEVOUE9UX0hUVFBfU0VSVkVSX1BPUlQ9NjA2MAogICAgICAtICdQRU5QT1RfU0VDUkVUX0tFWT0ke1NFUlZJQ0VfUkVBTEJBU0U2NF82NF9QRU5QT1R9JwogICAgICAtICdQRU5QT1RfUFVCTElDX1VSST0ke1NFUlZJQ0VfVVJMX0ZST05URU5EXzgwODB9JwogICAgICAtICdQRU5QT1RfQkFDS0VORF9VUkk9aHR0cDovL3BlbnBvdC1iYWNrZW5kJwogICAgICAtICdQRU5QT1RfRVhQT1JURVJfVVJJPWh0dHA6Ly9wZW5wb3QtZXhwb3J0ZXInCiAgICAgIC0gJ1BFTlBPVF9EQVRBQkFTRV9VUkk9cG9zdGdyZXNxbDovL3Bvc3RncmVzLyR7UE9TVEdSRVNfREI6LXBlbnBvdH0nCiAgICAgIC0gJ1BFTlBPVF9EQVRBQkFTRV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BFTlBPVF9EQVRBQkFTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQRU5QT1RfUkVESVNfVVJJPXJlZGlzOi8vcGVucG90LXZhbGtleS8wJwogICAgICAtICdQRU5QT1RfVEVMRU1FVFJZX0VOQUJMRUQ9JHtQRU5QT1RfVEVMRU1FVFJZX0VOQUJMRUQ6LWZhbHNlfScKICAgICAgLSBQRU5QT1RfT0JKRUNUU19TVE9SQUdFX0JBQ0tFTkQ9czMKICAgICAgLSBQRU5QT1RfT0JKRUNUU19TVE9SQUdFX1MzX1JFR0lPTj11cy1lYXN0LTEKICAgICAgLSBQRU5QT1RfT0JKRUNUU19TVE9SQUdFX1MzX0JVQ0tFVD1wZW5wb3QKICAgICAgLSAnUEVOUE9UX09CSkVDVFNfU1RPUkFHRV9TM19FTkRQT0lOVD1odHRwOi8vbWluaW86OTAwMCcKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnUEVOUE9UX1NNVFBfREVGQVVMVF9GUk9NPSR7UEVOUE9UX1NNVFBfREVGQVVMVF9GUk9NOi1uby1yZXBseUBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX0RFRkFVTFRfUkVQTFlfVE89JHtQRU5QT1RfU01UUF9ERUZBVUxUX1JFUExZX1RPOi1uby1yZXBseUBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX0hPU1Q9JHtQRU5QT1RfU01UUF9IT1NUOi1tYWlscGl0fScKICAgICAgLSAnUEVOUE9UX1NNVFBfUE9SVD0ke1BFTlBPVF9TTVRQX1BPUlQ6LTEwMjV9JwogICAgICAtICdQRU5QT1RfU01UUF9VU0VSTkFNRT0ke1BFTlBPVF9TTVRQX1VTRVJOQU1FOi1wZW5wb3R9JwogICAgICAtICdQRU5QT1RfU01UUF9QQVNTV09SRD0ke1BFTlBPVF9TTVRQX1BBU1NXT1JEOi1wZW5wb3R9JwogICAgICAtICdQRU5QT1RfU01UUF9UTFM9JHtQRU5QT1RfU01UUF9UTFM6LWZhbHNlfScKICAgICAgLSAnUEVOUE9UX1NNVFBfU1NMPSR7UEVOUE9UX1NNVFBfU1NMOi1mYWxzZX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbm9kZQogICAgICAgIC0gJy1lJwogICAgICAgIC0gInJlcXVpcmUoJ2h0dHAnKS5nZXQoe2hvc3Q6JzEyNy4wLjAuMScsIHBvcnQ6NjA2MCwgcGF0aDonL3JlYWR5eid9LCByZXMgPT4gcHJvY2Vzcy5leGl0KHJlcy5zdGF0dXNDb2RlPT09MjAwID8gMCA6IDEpKS5vbignZXJyb3InLCAoKSA9PiBwcm9jZXNzLmV4aXQoMSkpOyIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTUKICBwZW5wb3QtZXhwb3J0ZXI6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9leHBvcnRlcjoyLjExLjEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUEVOUE9UX1BVQkxJQ19VUkk9JHtTRVJWSUNFX1VSTF9GUk9OVEVORF84MDgwfScKICAgICAgLSAnUEVOUE9UX1JFRElTX1VSST1yZWRpczovL3BlbnBvdC12YWxrZXkvMCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo2MDYxL3JlYWR5eicKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6ICJzaCAtYyBcIlxuICBtYyBhbGlhcyBzZXQgbG9jYWwgaHR0cDovL21pbmlvOjkwMDAgJHtTRVJWSUNFX1VTRVJfTUlOSU99ICR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30gJiZcbiAgbWMgbWIgLXAgbG9jYWwvcGVucG90IHx8IHRydWUgJiZcbiAgbWMgYW5vbnltb3VzIHNldCBwcml2YXRlIGxvY2FsL3BlbnBvdFxuXCJcbiIKICAgIHJlc3RhcnQ6ICdubycKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BlbnBvdC1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSU5JVERCX0FSR1M9LS1kYXRhLWNoZWNrc3VtcwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcGVucG90fScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwZW5wb3QtdmFsa2V5OgogICAgaW1hZ2U6ICd2YWxrZXkvdmFsa2V5OjguMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BlbnBvdC12YWxrZXktZGF0YTovZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdWQUxLRVlfRVhUUkFfRkxBR1M9LS1tYXhtZW1vcnkgMTI4bWIgLS1tYXhtZW1vcnktcG9saWN5IHZvbGF0aWxlLWxmdScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAndmFsa2V5LWNsaSBwaW5nIHwgZ3JlcCBQT05HJwogICAgICBpbnRlcnZhbDogMXMKICAgICAgdGltZW91dDogM3MKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDNzCiAgbWFpbHBpdDoKICAgIGltYWdlOiAnYXhsbGVudC9tYWlscGl0OnYxLjI4JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTUFJTFBJVF84MDI1CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL21haWxwaXQKICAgICAgICAtIHJlYWR5egogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "penpot",
             "design",
@@ -4374,7 +4461,7 @@
     "plane": {
         "documentation": "https://docs.plane.so/self-hosting/methods/docker-compose?utm_source=coolify.io",
         "slogan": "The open source project management tool",
-        "compose": "eC1kYi1lbnY6CiAgUEdIT1NUOiBwbGFuZS1kYgogIFBHREFUQUJBU0U6IHBsYW5lCiAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogIFBPU1RHUkVTX0RCOiBwbGFuZQogIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQp4LXJlZGlzLWVudjoKICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99Jwp4LW1pbmlvLWVudjoKICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwp4LWF3cy1zMy1lbnY6CiAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9Jwp4LXByb3h5LWVudjoKICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogIEJVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9Jwp4LW1xLWVudjoKICBSQUJCSVRNUV9IT1NUOiBwbGFuZS1tcQogIFJBQkJJVE1RX1BPUlQ6ICcke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogIFJBQkJJVE1RX0RFRkFVTFRfVVNFUjogJyR7U0VSVklDRV9VU0VSX1JBQkJJVE1ROi1wbGFuZX0nCiAgUkFCQklUTVFfREVGQVVMVF9QQVNTOiAnJHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1ROi1wbGFuZX0nCiAgUkFCQklUTVFfREVGQVVMVF9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKICBSQUJCSVRNUV9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKeC1saXZlLWVudjoKICBBUElfQkFTRV9VUkw6ICcke0FQSV9CQVNFX1VSTDotaHR0cDovL2FwaTo4MDAwfScKICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCngtYXBwLWVudjoKICBBUFBfUkVMRUFTRTogJyR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgV0VCX1VSTDogJyR7U0VSVklDRV9VUkxfUExBTkV9JwogIERFQlVHOiAnJHtERUJVRzotMH0nCiAgQ09SU19BTExPV0VEX09SSUdJTlM6ICcke0NPUlNfQUxMT1dFRF9PUklHSU5TOi1odHRwOi8vbG9jYWxob3N0fScKICBHVU5JQ09STl9XT1JLRVJTOiAnJHtHVU5JQ09STl9XT1JLRVJTOi0xfScKICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgREFUQUJBU0VfVVJMOiAncG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcGxhbmUtZGIvcGxhbmUnCiAgU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfU0VDUkVUS0VZCiAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICBBUElfS0VZX1JBVEVfTElNSVQ6ICcke0FQSV9LRVlfUkFURV9MSU1JVDotNjAvbWludXRlfScKICBNSU5JT19FTkRQT0lOVF9TU0w6ICcke01JTklPX0VORFBPSU5UX1NTTDotMH0nCiAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVApzZXJ2aWNlczoKICBwcm94eToKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLXByb3h5OiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9QTEFORQogICAgICAtICdBUFBfRE9NQUlOPSR7U0VSVklDRV9VUkxfUExBTkV9JwogICAgICAtICdTSVRFX0FERFJFU1M9OjgwJwogICAgICAtICdGSUxFX1NJWkVfTElNSVQ9JHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICAtICdCVUNLRVRfTkFNRT0ke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICB2b2x1bWVzOgogICAgICAtICdwcm94eV9jb25maWc6L2NvbmZpZycKICAgICAgLSAncHJveHlfZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gd2ViCiAgICAgIC0gYXBpCiAgICAgIC0gc3BhY2UKICAgICAgLSBhZG1pbgogICAgICAtIGxpdmUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHdlYjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWZyb250ZW5kOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHdvcmtlcgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICd3Z2V0IC1xTy0gaHR0cDovL2Bob3N0bmFtZWA6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHNwYWNlOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtc3BhY2U6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBpCiAgICAgIC0gd29ya2VyCiAgICAgIC0gd2ViCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZWNobwogICAgICAgIC0gJ2hleSB3aGF0cyB1cCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGFkbWluOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYWRtaW46JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBpCiAgICAgIC0gd2ViCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZWNobwogICAgICAgIC0gJ2hleSB3aGF0cyB1cCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGxpdmU6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1saXZlOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBJX0JBU0VfVVJMOiAnJHtBUElfQkFTRV9VUkw6LWh0dHA6Ly9hcGk6ODAwMH0nCiAgICAgIExJVkVfU0VSVkVSX1NFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X0xJVkVTRUNSRVQKICAgICAgUkVESVNfSE9TVDogJyR7UkVESVNfSE9TVDotcGxhbmUtcmVkaXN9JwogICAgICBSRURJU19QT1JUOiAnJHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSB3ZWIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgYXBpOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYmFja2VuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgY29tbWFuZDogLi9iaW4vZG9ja2VyLWVudHJ5cG9pbnQtYXBpLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX2FwaTovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9VUkxfUExBTkV9JwogICAgICBERUJVRzogJyR7REVCVUc6LTB9JwogICAgICBDT1JTX0FMTE9XRURfT1JJR0lOUzogJyR7Q09SU19BTExPV0VEX09SSUdJTlM6LWh0dHA6Ly9sb2NhbGhvc3R9JwogICAgICBHVU5JQ09STl9XT1JLRVJTOiAnJHtHVU5JQ09STl9XT1JLRVJTOi0xfScKICAgICAgVVNFX01JTklPOiAnJHtVU0VfTUlOSU86LTF9JwogICAgICBEQVRBQkFTRV9VUkw6ICdwb3N0Z3Jlc3FsOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0BwbGFuZS1kYi9wbGFuZScKICAgICAgU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfU0VDUkVUS0VZCiAgICAgIEFNUVBfVVJMOiAnYW1xcDovLyR7U0VSVklDRV9VU0VSX1JBQkJJVE1RfToke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVF9QHBsYW5lLW1xOiR7UkFCQklUTVFfUE9SVDotNTY3Mn0vcGxhbmUnCiAgICAgIEFQSV9LRVlfUkFURV9MSU1JVDogJyR7QVBJX0tFWV9SQVRFX0xJTUlUOi02MC9taW51dGV9JwogICAgICBNSU5JT19FTkRQT0lOVF9TU0w6ICcke01JTklPX0VORFBPSU5UX1NTTDotMH0nCiAgICAgIExJVkVfU0VSVkVSX1NFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X0xJVkVTRUNSRVQKICAgICAgUEdIT1NUOiBwbGFuZS1kYgogICAgICBQR0RBVEFCQVNFOiBwbGFuZQogICAgICBQT1NUR1JFU19VU0VSOiAkU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICBQT1NUR1JFU19EQjogcGxhbmUKICAgICAgUE9TVEdSRVNfUE9SVDogNTQzMgogICAgICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQogICAgICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgICAgIFJFRElTX1BPUlQ6ICcke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICBSRURJU19VUkw6ICcke1JFRElTX1VSTDotcmVkaXM6Ly9wbGFuZS1yZWRpczo2Mzc5L30nCiAgICAgIE1JTklPX1JPT1RfVVNFUjogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUkVHSU9OOiAnJHtBV1NfUkVHSU9OOi19JwogICAgICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBBV1NfU0VDUkVUX0FDQ0VTU19LRVk6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19TM19FTkRQT0lOVF9VUkw6ICcke0FXU19TM19FTkRQT0lOVF9VUkw6LWh0dHA6Ly9wbGFuZS1taW5pbzo5MDAwfScKICAgICAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogICAgICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgd29ya2VyOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYmFja2VuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgY29tbWFuZDogLi9iaW4vZG9ja2VyLWVudHJ5cG9pbnQtd29ya2VyLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX3dvcmtlcjovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9VUkxfUExBTkV9JwogICAgICBERUJVRzogJyR7REVCVUc6LTB9JwogICAgICBDT1JTX0FMTE9XRURfT1JJR0lOUzogJyR7Q09SU19BTExPV0VEX09SSUdJTlM6LWh0dHA6Ly9sb2NhbGhvc3R9JwogICAgICBHVU5JQ09STl9XT1JLRVJTOiAnJHtHVU5JQ09STl9XT1JLRVJTOi0xfScKICAgICAgVVNFX01JTklPOiAnJHtVU0VfTUlOSU86LTF9JwogICAgICBEQVRBQkFTRV9VUkw6ICdwb3N0Z3Jlc3FsOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0BwbGFuZS1kYi9wbGFuZScKICAgICAgU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfU0VDUkVUS0VZCiAgICAgIEFNUVBfVVJMOiAnYW1xcDovLyR7U0VSVklDRV9VU0VSX1JBQkJJVE1RfToke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVF9QHBsYW5lLW1xOiR7UkFCQklUTVFfUE9SVDotNTY3Mn0vcGxhbmUnCiAgICAgIEFQSV9LRVlfUkFURV9MSU1JVDogJyR7QVBJX0tFWV9SQVRFX0xJTUlUOi02MC9taW51dGV9JwogICAgICBNSU5JT19FTkRQT0lOVF9TU0w6ICcke01JTklPX0VORFBPSU5UX1NTTDotMH0nCiAgICAgIExJVkVfU0VSVkVSX1NFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X0xJVkVTRUNSRVQKICAgICAgUEdIT1NUOiBwbGFuZS1kYgogICAgICBQR0RBVEFCQVNFOiBwbGFuZQogICAgICBQT1NUR1JFU19VU0VSOiAkU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICBQT1NUR1JFU19EQjogcGxhbmUKICAgICAgUE9TVEdSRVNfUE9SVDogNTQzMgogICAgICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQogICAgICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgICAgIFJFRElTX1BPUlQ6ICcke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICBSRURJU19VUkw6ICcke1JFRElTX1VSTDotcmVkaXM6Ly9wbGFuZS1yZWRpczo2Mzc5L30nCiAgICAgIE1JTklPX1JPT1RfVVNFUjogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUkVHSU9OOiAnJHtBV1NfUkVHSU9OOi19JwogICAgICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBBV1NfU0VDUkVUX0FDQ0VTU19LRVk6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19TM19FTkRQT0lOVF9VUkw6ICcke0FXU19TM19FTkRQT0lOVF9VUkw6LWh0dHA6Ly9wbGFuZS1taW5pbzo5MDAwfScKICAgICAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogICAgICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgYmVhdC13b3JrZXI6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1iYWNrZW5kOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBjb21tYW5kOiAuL2Jpbi9kb2NrZXItZW50cnlwb2ludC1iZWF0LnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX2JlYXQtd29ya2VyOi9jb2RlL3BsYW5lL2xvZ3MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBQX1JFTEVBU0U6ICcke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgICBXRUJfVVJMOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfVVJMX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICAgICAgLSBwbGFuZS1tcQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBtaWdyYXRvcjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWJhY2tlbmQ6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIHJlc3RhcnQ6ICdubycKICAgIGNvbW1hbmQ6IC4vYmluL2RvY2tlci1lbnRyeXBvaW50LW1pZ3JhdG9yLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX21pZ3JhdG9yOi9jb2RlL3BsYW5lL2xvZ3MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBQX1JFTEVBU0U6ICcke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgICBXRUJfVVJMOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfVVJMX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICBwbGFuZS1kYjoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUuNy1hbHBpbmUnCiAgICBjb21tYW5kOiAicG9zdGdyZXMgLWMgJ21heF9jb25uZWN0aW9ucz0xMDAwJyIKICAgIGVudmlyb25tZW50OgogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdwZ2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBsYW5lLXJlZGlzOgogICAgaW1hZ2U6ICd2YWxrZXkvdmFsa2V5OjcuMi4xMS1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwbGFuZS1tcToKICAgIGltYWdlOiAncmFiYml0bXE6My4xMy42LW1hbmFnZW1lbnQtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIFJBQkJJVE1RX0hPU1Q6IHBsYW5lLW1xCiAgICAgIFJBQkJJVE1RX1BPUlQ6ICcke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1VTRVI6ICcke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUTotcGxhbmV9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1BBU1M6ICcke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVE6LXBsYW5lfScKICAgICAgUkFCQklUTVFfREVGQVVMVF9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKICAgICAgUkFCQklUTVFfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcV9kYXRhOi92YXIvbGliL3JhYmJpdG1xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBwaW5nJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAzCiAgcGxhbmUtbWluaW86CiAgICBpbWFnZTogJ2doY3IuaW8vY29vbGxhYnNpby9taW5pbzpSRUxFQVNFLjIwMjUtMTAtMTVUMTctMjktNTVaJwogICAgY29tbWFuZDogJ3NlcnZlciAvZXhwb3J0IC0tY29uc29sZS1hZGRyZXNzICI6OTA5MCInCiAgICBlbnZpcm9ubWVudDoKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICB2b2x1bWVzOgogICAgICAtICd1cGxvYWRzOi9leHBvcnQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "eC1kYi1lbnY6CiAgUEdIT1NUOiBwbGFuZS1kYgogIFBHREFUQUJBU0U6IHBsYW5lCiAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogIFBPU1RHUkVTX0RCOiBwbGFuZQogIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQp4LXJlZGlzLWVudjoKICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99Jwp4LW1pbmlvLWVudjoKICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwp4LWF3cy1zMy1lbnY6CiAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9Jwp4LXByb3h5LWVudjoKICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogIEJVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9Jwp4LW1xLWVudjoKICBSQUJCSVRNUV9IT1NUOiBwbGFuZS1tcQogIFJBQkJJVE1RX1BPUlQ6ICcke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogIFJBQkJJVE1RX0RFRkFVTFRfVVNFUjogJyR7U0VSVklDRV9VU0VSX1JBQkJJVE1ROi1wbGFuZX0nCiAgUkFCQklUTVFfREVGQVVMVF9QQVNTOiAnJHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1ROi1wbGFuZX0nCiAgUkFCQklUTVFfREVGQVVMVF9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKICBSQUJCSVRNUV9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKeC1saXZlLWVudjoKICBBUElfQkFTRV9VUkw6ICcke0FQSV9CQVNFX1VSTDotaHR0cDovL2FwaTo4MDAwfScKICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCngtYXBwLWVudjoKICBBUFBfUkVMRUFTRTogJyR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgV0VCX1VSTDogJyR7U0VSVklDRV9VUkxfUExBTkV9JwogIERFQlVHOiAnJHtERUJVRzotMH0nCiAgQ09SU19BTExPV0VEX09SSUdJTlM6ICcke0NPUlNfQUxMT1dFRF9PUklHSU5TOi1odHRwOi8vbG9jYWxob3N0fScKICBHVU5JQ09STl9XT1JLRVJTOiAnJHtHVU5JQ09STl9XT1JLRVJTOi0xfScKICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgREFUQUJBU0VfVVJMOiAncG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcGxhbmUtZGIvcGxhbmUnCiAgU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfU0VDUkVUS0VZCiAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICBBUElfS0VZX1JBVEVfTElNSVQ6ICcke0FQSV9LRVlfUkFURV9MSU1JVDotNjAvbWludXRlfScKICBNSU5JT19FTkRQT0lOVF9TU0w6ICcke01JTklPX0VORFBPSU5UX1NTTDotMH0nCiAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVApzZXJ2aWNlczoKICBwcm94eToKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLXByb3h5OiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9QTEFORQogICAgICAtICdBUFBfRE9NQUlOPSR7U0VSVklDRV9VUkxfUExBTkV9JwogICAgICAtICdTSVRFX0FERFJFU1M9OjgwJwogICAgICAtICdGSUxFX1NJWkVfTElNSVQ9JHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICAtICdCVUNLRVRfTkFNRT0ke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICB2b2x1bWVzOgogICAgICAtICdwcm94eV9jb25maWc6L2NvbmZpZycKICAgICAgLSAncHJveHlfZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gd2ViCiAgICAgIC0gYXBpCiAgICAgIC0gc3BhY2UKICAgICAgLSBhZG1pbgogICAgICAtIGxpdmUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHdlYjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWZyb250ZW5kOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHdvcmtlcgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICd3Z2V0IC1xTy0gaHR0cDovL2Bob3N0bmFtZWA6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHNwYWNlOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtc3BhY2U6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBpCiAgICAgIC0gd29ya2VyCiAgICAgIC0gd2ViCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZWNobwogICAgICAgIC0gJ2hleSB3aGF0cyB1cCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGFkbWluOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYWRtaW46JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBpCiAgICAgIC0gd2ViCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZWNobwogICAgICAgIC0gJ2hleSB3aGF0cyB1cCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGxpdmU6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1saXZlOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBJX0JBU0VfVVJMOiAnJHtBUElfQkFTRV9VUkw6LWh0dHA6Ly9hcGk6ODAwMH0nCiAgICAgIExJVkVfU0VSVkVSX1NFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X0xJVkVTRUNSRVQKICAgICAgUkVESVNfSE9TVDogJyR7UkVESVNfSE9TVDotcGxhbmUtcmVkaXN9JwogICAgICBSRURJU19QT1JUOiAnJHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSB3ZWIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgYXBpOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYmFja2VuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgY29tbWFuZDogLi9iaW4vZG9ja2VyLWVudHJ5cG9pbnQtYXBpLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX2FwaTovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9VUkxfUExBTkV9JwogICAgICBERUJVRzogJyR7REVCVUc6LTB9JwogICAgICBDT1JTX0FMTE9XRURfT1JJR0lOUzogJyR7Q09SU19BTExPV0VEX09SSUdJTlM6LWh0dHA6Ly9sb2NhbGhvc3R9JwogICAgICBHVU5JQ09STl9XT1JLRVJTOiAnJHtHVU5JQ09STl9XT1JLRVJTOi0xfScKICAgICAgVVNFX01JTklPOiAnJHtVU0VfTUlOSU86LTF9JwogICAgICBEQVRBQkFTRV9VUkw6ICdwb3N0Z3Jlc3FsOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0BwbGFuZS1kYi9wbGFuZScKICAgICAgU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfU0VDUkVUS0VZCiAgICAgIEFNUVBfVVJMOiAnYW1xcDovLyR7U0VSVklDRV9VU0VSX1JBQkJJVE1RfToke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVF9QHBsYW5lLW1xOiR7UkFCQklUTVFfUE9SVDotNTY3Mn0vcGxhbmUnCiAgICAgIEFQSV9LRVlfUkFURV9MSU1JVDogJyR7QVBJX0tFWV9SQVRFX0xJTUlUOi02MC9taW51dGV9JwogICAgICBNSU5JT19FTkRQT0lOVF9TU0w6ICcke01JTklPX0VORFBPSU5UX1NTTDotMH0nCiAgICAgIExJVkVfU0VSVkVSX1NFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X0xJVkVTRUNSRVQKICAgICAgUEdIT1NUOiBwbGFuZS1kYgogICAgICBQR0RBVEFCQVNFOiBwbGFuZQogICAgICBQT1NUR1JFU19VU0VSOiAkU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICBQT1NUR1JFU19EQjogcGxhbmUKICAgICAgUE9TVEdSRVNfUE9SVDogNTQzMgogICAgICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQogICAgICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgICAgIFJFRElTX1BPUlQ6ICcke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICBSRURJU19VUkw6ICcke1JFRElTX1VSTDotcmVkaXM6Ly9wbGFuZS1yZWRpczo2Mzc5L30nCiAgICAgIE1JTklPX1JPT1RfVVNFUjogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUkVHSU9OOiAnJHtBV1NfUkVHSU9OOi19JwogICAgICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBBV1NfU0VDUkVUX0FDQ0VTU19LRVk6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19TM19FTkRQT0lOVF9VUkw6ICcke0FXU19TM19FTkRQT0lOVF9VUkw6LWh0dHA6Ly9wbGFuZS1taW5pbzo5MDAwfScKICAgICAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogICAgICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgd29ya2VyOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYmFja2VuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgY29tbWFuZDogLi9iaW4vZG9ja2VyLWVudHJ5cG9pbnQtd29ya2VyLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX3dvcmtlcjovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9VUkxfUExBTkV9JwogICAgICBERUJVRzogJyR7REVCVUc6LTB9JwogICAgICBDT1JTX0FMTE9XRURfT1JJR0lOUzogJyR7Q09SU19BTExPV0VEX09SSUdJTlM6LWh0dHA6Ly9sb2NhbGhvc3R9JwogICAgICBHVU5JQ09STl9XT1JLRVJTOiAnJHtHVU5JQ09STl9XT1JLRVJTOi0xfScKICAgICAgVVNFX01JTklPOiAnJHtVU0VfTUlOSU86LTF9JwogICAgICBEQVRBQkFTRV9VUkw6ICdwb3N0Z3Jlc3FsOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0BwbGFuZS1kYi9wbGFuZScKICAgICAgU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfU0VDUkVUS0VZCiAgICAgIEFNUVBfVVJMOiAnYW1xcDovLyR7U0VSVklDRV9VU0VSX1JBQkJJVE1RfToke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVF9QHBsYW5lLW1xOiR7UkFCQklUTVFfUE9SVDotNTY3Mn0vcGxhbmUnCiAgICAgIEFQSV9LRVlfUkFURV9MSU1JVDogJyR7QVBJX0tFWV9SQVRFX0xJTUlUOi02MC9taW51dGV9JwogICAgICBNSU5JT19FTkRQT0lOVF9TU0w6ICcke01JTklPX0VORFBPSU5UX1NTTDotMH0nCiAgICAgIExJVkVfU0VSVkVSX1NFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X0xJVkVTRUNSRVQKICAgICAgUEdIT1NUOiBwbGFuZS1kYgogICAgICBQR0RBVEFCQVNFOiBwbGFuZQogICAgICBQT1NUR1JFU19VU0VSOiAkU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICBQT1NUR1JFU19EQjogcGxhbmUKICAgICAgUE9TVEdSRVNfUE9SVDogNTQzMgogICAgICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQogICAgICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgICAgIFJFRElTX1BPUlQ6ICcke1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICBSRURJU19VUkw6ICcke1JFRElTX1VSTDotcmVkaXM6Ly9wbGFuZS1yZWRpczo2Mzc5L30nCiAgICAgIE1JTklPX1JPT1RfVVNFUjogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUkVHSU9OOiAnJHtBV1NfUkVHSU9OOi19JwogICAgICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICBBV1NfU0VDUkVUX0FDQ0VTU19LRVk6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19TM19FTkRQT0lOVF9VUkw6ICcke0FXU19TM19FTkRQT0lOVF9VUkw6LWh0dHA6Ly9wbGFuZS1taW5pbzo5MDAwfScKICAgICAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogICAgICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgYmVhdC13b3JrZXI6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1iYWNrZW5kOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBjb21tYW5kOiAuL2Jpbi9kb2NrZXItZW50cnlwb2ludC1iZWF0LnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX2JlYXQtd29ya2VyOi9jb2RlL3BsYW5lL2xvZ3MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBQX1JFTEVBU0U6ICcke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgICBXRUJfVVJMOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfVVJMX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICAgICAgLSBwbGFuZS1tcQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBtaWdyYXRvcjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWJhY2tlbmQ6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIHJlc3RhcnQ6ICdubycKICAgIGNvbW1hbmQ6IC4vYmluL2RvY2tlci1lbnRyeXBvaW50LW1pZ3JhdG9yLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX21pZ3JhdG9yOi9jb2RlL3BsYW5lL2xvZ3MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgQVBQX1JFTEVBU0U6ICcke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgICBXRUJfVVJMOiAnJHtTRVJWSUNFX1VSTF9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfVVJMX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICBwbGFuZS1kYjoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUuNy1hbHBpbmUnCiAgICBjb21tYW5kOiAicG9zdGdyZXMgLWMgJ21heF9jb25uZWN0aW9ucz0xMDAwJyIKICAgIGVudmlyb25tZW50OgogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdwZ2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBsYW5lLXJlZGlzOgogICAgaW1hZ2U6ICd2YWxrZXkvdmFsa2V5OjcuMi4xMS1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwbGFuZS1tcToKICAgIGltYWdlOiAncmFiYml0bXE6My4xMy42LW1hbmFnZW1lbnQtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIFJBQkJJVE1RX0hPU1Q6IHBsYW5lLW1xCiAgICAgIFJBQkJJVE1RX1BPUlQ6ICcke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1VTRVI6ICcke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUTotcGxhbmV9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1BBU1M6ICcke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVE6LXBsYW5lfScKICAgICAgUkFCQklUTVFfREVGQVVMVF9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKICAgICAgUkFCQklUTVFfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcV9kYXRhOi92YXIvbGliL3JhYmJpdG1xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBjaGVja19wb3J0X2Nvbm5lY3Rpdml0eScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDYwcwogIHBsYW5lLW1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9leHBvcnQgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDkwIicKICAgIGVudmlyb25tZW50OgogICAgICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgTUlOSU9fUk9PVF9QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ3VwbG9hZHM6L2V4cG9ydCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
         "tags": [
             "plane",
             "project-management",
@@ -4391,7 +4478,7 @@
         "category": "productivity",
         "logo": "svgs/plane.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-24T00:12:17+05:30",
+        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
         "port": "80"
     },
     "plex": {
@@ -4671,7 +4758,7 @@
     "rabbitmq": {
         "documentation": "https://www.rabbitmq.com/documentation.html?utm_source=coolify.io",
         "slogan": "With tens of thousands of users, RabbitMQ is one of the most popular open source message brokers.",
-        "compose": "c2VydmljZXM6CiAgcmFiYml0bXE6CiAgICBpbWFnZTogJ3JhYmJpdG1xOjMtbWFuYWdlbWVudCcKICAgIGhvc3RuYW1lOiByYWJiaXRtcQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUkFCQklUTVFfMTU2NzIKICAgICAgLSBSQUJCSVRNUV9ERUZBVUxUX1VTRVI9JFNFUlZJQ0VfVVNFUl9SQUJCSVRNUQogICAgICAtIFJBQkJJVE1RX0RFRkFVTFRfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUQogICAgICAtICdQT1JUPSR7UE9SVDotNTY3Mn0nCiAgICBwb3J0czoKICAgICAgLSAnJHtQT1JUfTo1NjcyJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBwaW5nJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcS1kYXRhOi92YXIvbGliL3JhYmJpdG1xLycK",
+        "compose": "c2VydmljZXM6CiAgcmFiYml0bXE6CiAgICBpbWFnZTogJ3JhYmJpdG1xOjMtbWFuYWdlbWVudCcKICAgIGhvc3RuYW1lOiByYWJiaXRtcQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUkFCQklUTVFfMTU2NzIKICAgICAgLSBSQUJCSVRNUV9ERUZBVUxUX1VTRVI9JFNFUlZJQ0VfVVNFUl9SQUJCSVRNUQogICAgICAtIFJBQkJJVE1RX0RFRkFVTFRfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUQogICAgICAtICdQT1JUPSR7UE9SVDotNTY3Mn0nCiAgICBwb3J0czoKICAgICAgLSAnJHtQT1JUfTo1NjcyJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBjaGVja19wb3J0X2Nvbm5lY3Rpdml0eScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAyMAogICAgICBzdGFydF9wZXJpb2Q6IDYwcwogICAgdm9sdW1lczoKICAgICAgLSAncmFiYml0bXEtZGF0YTovdmFyL2xpYi9yYWJiaXRtcS8nCg==",
         "tags": [
             "message broker",
             "message queue",
@@ -4723,7 +4810,7 @@
     "reactive-resume": {
         "documentation": "https://rxresu.me/?utm_source=coolify.io",
         "slogan": "A one-of-a-kind resume builder that keeps your privacy in mind.",
-        "compose": "c2VydmljZXM6CiAgcmVhY3RpdmUtcmVzdW1lOgogICAgaW1hZ2U6ICdhbXJ1dGhwaWxsYWkvcmVhY3RpdmUtcmVzdW1lOnY0LjMuNycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1JFQUNUSVZFUkVTVU1FXzMwMDAKICAgICAgLSBQVUJMSUNfVVJMPSRTRVJWSUNFX1VSTF9SRUFDVElWRVJFU1VNRQogICAgICAtICdTVE9SQUdFX1VSTD0ke1NFUlZJQ0VfVVJMX01JTklPfS9kZWZhdWx0JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gQUNDRVNTX1RPS0VOX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF9BQ0NFU1NUT0tFTgogICAgICAtIFJFRlJFU0hfVE9LRU5fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEX1JFRlJFU0hUT0tFTgogICAgICAtIENIUk9NRV9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9DSFJPTUVUT0tFTgogICAgICAtICdDSFJPTUVfVVJMPXdzOi8vY2hyb21lOjMwMDAvY2hyb21lJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9yZWRpczo2Mzc5JwogICAgICAtIFNUT1JBR0VfRU5EUE9JTlQ9bWluaW8KICAgICAgLSBTVE9SQUdFX1BPUlQ9OTAwMAogICAgICAtIFNUT1JBR0VfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFNUT1JBR0VfQlVDS0VUPWRlZmF1bHQKICAgICAgLSBTVE9SQUdFX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIFNUT1JBR0VfU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIFNUT1JBR0VfVVNFX1NTTD1mYWxzZQogICAgICAtICdESVNBQkxFX1NJR05VUFM9JHtTRVJWSUNFX0RJU0FCTEVfU0lHTlVQUzotZmFsc2V9JwogICAgICAtICdESVNBQkxFX0VNQUlMX0FVVEg9JHtTRVJWSUNFX0RJU0FCTEVfRU1BSUxfQVVUSDotZmFsc2V9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwb3N0Z3JlcwogICAgICAtIG1pbmlvCiAgICAgIC0gY2hyb21lCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbm9kZQogICAgICAgIC0gJy1lJwogICAgICAgIC0gInJlcXVpcmUoJ2h0dHAnKS5nZXQoJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcsIHJlcyA9PiBwcm9jZXNzLmV4aXQocmVzLnN0YXR1c0NvZGUgPT09IDIwMCA/IDAgOiAxKSkub24oJ2Vycm9yJywgKCkgPT4gcHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIG1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1NFUlZFUl9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTD0kTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkwKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgY2hyb21lOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Jyb3dzZXJsZXNzL2Nocm9tZTpsYXRlc3QnCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIEhFQUxUSD10cnVlCiAgICAgIC0gVElNRU9VVD0xMDAwMAogICAgICAtIENPTkNVUlJFTlQ9MTAKICAgICAgLSBUT0tFTj0kU0VSVklDRV9QQVNTV09SRF9DSFJPTUVUT0tFTgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAvJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDUKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOiByZWRpcy1zZXJ2ZXIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzX2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
+        "compose": "c2VydmljZXM6CiAgcmVhY3RpdmUtcmVzdW1lOgogICAgaW1hZ2U6ICdhbXJ1dGhwaWxsYWkvcmVhY3RpdmUtcmVzdW1lOnY0LjMuNycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1JFQUNUSVZFUkVTVU1FXzMwMDAKICAgICAgLSBQVUJMSUNfVVJMPSRTRVJWSUNFX1VSTF9SRUFDVElWRVJFU1VNRQogICAgICAtICdTVE9SQUdFX1VSTD0ke1NFUlZJQ0VfVVJMX01JTklPfS9kZWZhdWx0JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gQUNDRVNTX1RPS0VOX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF9BQ0NFU1NUT0tFTgogICAgICAtIFJFRlJFU0hfVE9LRU5fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEX1JFRlJFU0hUT0tFTgogICAgICAtIENIUk9NRV9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9DSFJPTUVUT0tFTgogICAgICAtICdDSFJPTUVfVVJMPXdzOi8vY2hyb21lOjMwMDAvY2hyb21lJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9yZWRpczo2Mzc5JwogICAgICAtIFNUT1JBR0VfRU5EUE9JTlQ9bWluaW8KICAgICAgLSBTVE9SQUdFX1BPUlQ9OTAwMAogICAgICAtIFNUT1JBR0VfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFNUT1JBR0VfQlVDS0VUPWRlZmF1bHQKICAgICAgLSBTVE9SQUdFX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIFNUT1JBR0VfU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIFNUT1JBR0VfVVNFX1NTTD1mYWxzZQogICAgICAtICdESVNBQkxFX1NJR05VUFM9JHtTRVJWSUNFX0RJU0FCTEVfU0lHTlVQUzotZmFsc2V9JwogICAgICAtICdESVNBQkxFX0VNQUlMX0FVVEg9JHtTRVJWSUNFX0RJU0FCTEVfRU1BSUxfQVVUSDotZmFsc2V9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwb3N0Z3JlcwogICAgICAtIG1pbmlvCiAgICAgIC0gY2hyb21lCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbm9kZQogICAgICAgIC0gJy1lJwogICAgICAgIC0gInJlcXVpcmUoJ2h0dHAnKS5nZXQoJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcsIHJlcyA9PiBwcm9jZXNzLmV4aXQocmVzLnN0YXR1c0NvZGUgPT09IDIwMCA/IDAgOiAxKSkub24oJ2Vycm9yJywgKCkgPT4gcHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNSU5JT19TRVJWRVJfVVJMPSRNSU5JT19TRVJWRVJfVVJMCiAgICAgIC0gTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkw9JE1JTklPX0JST1dTRVJfUkVESVJFQ1RfVVJMCiAgICAgIC0gTUlOSU9fUk9PVF9VU0VSPSRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgLSBNSU5JT19ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICB2b2x1bWVzOgogICAgICAtICdtaW5pby1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIGNocm9tZToKICAgIGltYWdlOiAnZ2hjci5pby9icm93c2VybGVzcy9jaHJvbWU6bGF0ZXN0JwogICAgcGxhdGZvcm06IGxpbnV4L2FtZDY0CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIRUFMVEg9dHJ1ZQogICAgICAtIFRJTUVPVVQ9MTAwMDAKICAgICAgLSBDT05DVVJSRU5UPTEwCiAgICAgIC0gVE9LRU49JFNFUlZJQ0VfUEFTU1dPUkRfQ0hST01FVE9LRU4KICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgY29tbWFuZDogcmVkaXMtc2VydmVyCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc19kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "reactive-resume",
             "resume-builder",
@@ -4891,7 +4978,7 @@
     "seafile": {
         "documentation": "https://manual.seafile.com?utm_source=coolify.io",
         "slogan": "Open source cloud storage system for file sync, share and document collaboration",
-        "compose": "c2VydmljZXM6CiAgc2VhZmlsZToKICAgIGltYWdlOiAnc2VhZmlsZWx0ZC9zZWFmaWxlLW1jOjEyLjAtbGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZmlsZS1kYXRhOi9zaGFyZWQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TRUFGSUxFXzgwCiAgICAgIC0gJ1NFQUZJTEVfU0VSVkVSX0hPU1ROQU1FPSR7U0VSVklDRV9GUUROX1NFQUZJTEV9JwogICAgICAtIERCX0hPU1Q9bWFyaWFkYgogICAgICAtIERCX1BPUlQ9MzMwNgogICAgICAtICdEQl9ST09UX1BBU1NXRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgLSAnREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ1NFQUZJTEVfTVlTUUxfREJfQ0NORVRfREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfQ0NORVRfREJfTkFNRTotY2NuZXRfZGJ9JwogICAgICAtICdTRUFGSUxFX01ZU1FMX0RCX1NFQUZJTEVfREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfU0VBRklMRV9EQl9OQU1FOi1zZWFmaWxlX2RifScKICAgICAgLSAnU0VBRklMRV9NWVNRTF9EQl9TRUFIVUJfREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfU0VBSFVCX0RCX05BTUU6LXNlYWh1Yl9kYn0nCiAgICAgIC0gJ1RJTUVfWk9ORT0ke1RJTUVfWk9ORTotVVRDfScKICAgICAgLSAnSU5JVF9TRUFGSUxFX0FETUlOX0VNQUlMPSR7SU5JVF9TRUFGSUxFX0FETUlOX0VNQUlMOi10ZXN0QGV4YW1wbGUuY29tfScKICAgICAgLSAnSU5JVF9TRUFGSUxFX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gU0VBRklMRV9TRVJWRVJfUFJPVE9DT0w9aHR0cHMKICAgICAgLSAnU0lURV9ST09UPSR7U0lURV9ST09UOi0vfScKICAgICAgLSAnTk9OX1JPT1Q9JHtOT05fUk9PVDotZmFsc2V9JwogICAgICAtICdKV1RfUFJJVkFURV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0pXVH0nCiAgICAgIC0gJ1NFQUZJTEVfTE9HX1RPX1NURE9VVD0ke1NFQUZJTEVfTE9HX1RPX1NURE9VVDotdHJ1ZX0nCiAgICAgIC0gJ0ZJTEVfU0VSVkVSX1JPT1Q9JHtTRVJWSUNFX1VSTF9TRUFGSUxFfS9zZWFmaHR0cCcKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgbWVtY2FjaGVkOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvYXBpMi9waW5nJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiA1CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NlYWZpbGVfbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1zZWFmaWxlLWRifScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogNQogIG1lbWNhY2hlZDoKICAgIGltYWdlOiAnbWVtY2FjaGVkOmxhdGVzdCcKICAgIGVudHJ5cG9pbnQ6ICdtZW1jYWNoZWQgLW0gMjU2JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdiYXNoIC1jICJlY2hvIHZlcnNpb24gfCAoZXhlYyAzPD4vZGV2L3RjcC9sb2NhbGhvc3QvMTEyMTE7IGNhdCA+JjM7IHRpbWVvdXQgMC41IGNhdCA8JjM7IGV4ZWMgMzwmLSkiJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiA1Cg==",
+        "compose": "c2VydmljZXM6CiAgc2VhZmlsZToKICAgIGltYWdlOiAnc2VhZmlsZWx0ZC9zZWFmaWxlLW1jOjEyLjAtbGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZmlsZS1kYXRhOi9zaGFyZWQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TRUFGSUxFXzgwCiAgICAgIC0gJ1NFQUZJTEVfU0VSVkVSX0hPU1ROQU1FPSR7U0VSVklDRV9GUUROX1NFQUZJTEV9JwogICAgICAtIERCX0hPU1Q9bWFyaWFkYgogICAgICAtIERCX1BPUlQ9MzMwNgogICAgICAtICdEQl9ST09UX1BBU1NXRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgLSAnREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ1NFQUZJTEVfTVlTUUxfREJfQ0NORVRfREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfQ0NORVRfREJfTkFNRTotY2NuZXRfZGJ9JwogICAgICAtICdTRUFGSUxFX01ZU1FMX0RCX1NFQUZJTEVfREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfU0VBRklMRV9EQl9OQU1FOi1zZWFmaWxlX2RifScKICAgICAgLSAnU0VBRklMRV9NWVNRTF9EQl9TRUFIVUJfREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfU0VBSFVCX0RCX05BTUU6LXNlYWh1Yl9kYn0nCiAgICAgIC0gJ1RJTUVfWk9ORT0ke1RJTUVfWk9ORTotVVRDfScKICAgICAgLSAnSU5JVF9TRUFGSUxFX0FETUlOX0VNQUlMPSR7SU5JVF9TRUFGSUxFX0FETUlOX0VNQUlMOi10ZXN0QGV4YW1wbGUuY29tfScKICAgICAgLSAnSU5JVF9TRUFGSUxFX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gU0VBRklMRV9TRVJWRVJfUFJPVE9DT0w9aHR0cHMKICAgICAgLSAnU0lURV9ST09UPSR7U0lURV9ST09UOi0vfScKICAgICAgLSAnTk9OX1JPT1Q9JHtOT05fUk9PVDotZmFsc2V9JwogICAgICAtICdKV1RfUFJJVkFURV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X0pXVH0nCiAgICAgIC0gJ1NFQUZJTEVfTE9HX1RPX1NURE9VVD0ke1NFQUZJTEVfTE9HX1RPX1NURE9VVDotdHJ1ZX0nCiAgICAgIC0gJ0ZJTEVfU0VSVkVSX1JPT1Q9JHtTRVJWSUNFX1VSTF9TRUFGSUxFfS9zZWFmaHR0cCcKICAgICAgLSAnRU5BQkxFX1NFQURPQz0ke0VOQUJMRV9TRUFET0M6LXRydWV9JwogICAgICAtICdTRUFET0NfU0VSVkVSX1VSTD0ke1NFUlZJQ0VfVVJMX1NFQURPQ30nCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1lbWNhY2hlZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL2FwaTIvcGluZycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogNQogIHNlYWRvYzoKICAgIGltYWdlOiAnc2VhZmlsZWx0ZC9zZG9jLXNlcnZlcjoxLjAtbGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZG9jLWRhdGE6L3NoYXJlZCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1NFQURPQ184MAogICAgICAtIERCX0hPU1Q9bWFyaWFkYgogICAgICAtIERCX1BPUlQ9MzMwNgogICAgICAtICdEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnREJfTkFNRT0ke1NFQUZJTEVfTVlTUUxfREJfU0VBSFVCX0RCX05BTUU6LXNlYWh1Yl9kYn0nCiAgICAgIC0gJ1RJTUVfWk9ORT0ke1RJTUVfWk9ORTotVVRDfScKICAgICAgLSAnSldUX1BSSVZBVEVfS0VZPSR7U0VSVklDRV9QQVNTV09SRF82NF9KV1R9JwogICAgICAtICdOT05fUk9PVD0ke05PTl9ST09UOi1mYWxzZX0nCiAgICAgIC0gJ1NFQUhVQl9TRVJWSUNFX1VSTD1odHRwOi8vc2VhZmlsZScKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MC9waW5nJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiA1CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NlYWZpbGVfbWFyaWFkYl9kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1zZWFmaWxlLWRifScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogNQogIG1lbWNhY2hlZDoKICAgIGltYWdlOiAnbWVtY2FjaGVkOmxhdGVzdCcKICAgIGVudHJ5cG9pbnQ6ICdtZW1jYWNoZWQgLW0gMjU2JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdiYXNoIC1jICJlY2hvIHZlcnNpb24gfCAoZXhlYyAzPD4vZGV2L3RjcC9sb2NhbGhvc3QvMTEyMTE7IGNhdCA+JjM7IHRpbWVvdXQgMC41IGNhdCA8JjM7IGV4ZWMgMzwmLSkiJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiA1Cg==",
         "tags": [
             "file-manager",
             "file-sharing",
@@ -5290,7 +5377,7 @@
     "supabase": {
         "documentation": "https://supabase.io?utm_source=coolify.io",
         "slogan": "The open source Firebase alternative.",
-        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU1VQQUJBU0VLT05HXzgwMDAKICAgICAgLSAnS09OR19QT1JUX01BUFM9NDQzOjgwMDAnCiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gS09OR19EQVRBQkFTRT1vZmYKICAgICAgLSBLT05HX0RFQ0xBUkFUSVZFX0NPTkZJRz0vdXNyL2xvY2FsL2tvbmcva29uZy55bWwKICAgICAgLSAnS09OR19ETlNfT1JERVI9TEFTVCxBLENOQU1FJwogICAgICAtIEtPTkdfRE5TX05PVF9GT1VORF9UVEw9MQogICAgICAtICdLT05HX1BMVUdJTlM9cmVxdWVzdC10cmFuc2Zvcm1lcixjb3JzLGtleS1hdXRoLGFjbCxiYXNpYy1hdXRoLHJlcXVlc3QtdGVybWluYXRpb24saXAtcmVzdHJpY3Rpb24scG9zdC1mdW5jdGlvbicKICAgICAgLSBLT05HX05HSU5YX1BST1hZX1BST1hZX0JVRkZFUl9TSVpFPTE2MGsKICAgICAgLSAnS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJTPTY0IDE2MGsnCiAgICAgIC0gJ0tPTkdfUFJPWFlfQUNDRVNTX0xPRz0vZGV2L3N0ZG91dCBjb21iaW5lZCcKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWT0ke1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWTotfScKICAgICAgLSAnU1VQQUJBU0VfU0VDUkVUX0tFWT0ke1NVUEFCQVNFX1NFQ1JFVF9LRVk6LX0nCiAgICAgIC0gJ0FOT05fS0VZX0FTWU1NRVRSSUM9JHtBTk9OX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM9JHtTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM6LX0nCiAgICAgIC0gJ0RBU0hCT0FSRF9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0RBU0hCT0FSRF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtICdLT05HX1NUT1JBR0VfQ09OTkVDVF9USU1FT1VUPSR7S09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVDotNjB9JwogICAgICAtICdLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9XUklURV9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFQURfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ6LTM2MDB9JwogICAgICAtICdLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc6LWZhbHNlfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFU1BPTlNFX0JVRkZFUklORz0ke0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc6LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmctZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL2Jhc2hcbiMgQ3VzdG9tIGVudHJ5cG9pbnQgZm9yIEtvbmcgdGhhdCBidWlsZHMgTHVhIGV4cHJlc3Npb25zIGZvciByZXF1ZXN0LXRyYW5zZm9ybWVyXG4jIGFuZCBwZXJmb3JtcyBlbnZpcm9ubWVudCB2YXJpYWJsZSBzdWJzdGl0dXRpb24gaW4gdGhlIGRlY2xhcmF0aXZlIGNvbmZpZy5cblxuaWYgWyAtbiBcIiRTVVBBQkFTRV9TRUNSRVRfS0VZXCIgXSAmJiBbIC1uIFwiJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVwiIF07IHRoZW5cbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIChoZWFkZXJzLmFwaWtleSA9PSAnJFNVUEFCQVNFX1NFQ1JFVF9LRVknIGFuZCAnQmVhcmVyICRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnQmVhcmVyICRBTk9OX0tFWV9BU1lNTUVUUklDJykgb3IgaGVhZGVycy5hcGlrZXkpXCJcbiAgICBleHBvcnQgTFVBX1JUX1dTX0VYUFI9XCJcXCQoKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJyRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAocXVlcnlfcGFyYW1zLmFwaWtleSA9PSAnJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWScgYW5kICckQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmVsc2VcbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmZpXG5cbmF3ayAne1xuICByZXN1bHQgPSBcIlwiXG4gIHJlc3QgPSAkMFxuICB3aGlsZSAobWF0Y2gocmVzdCwgL1xcJFtBLVphLXpfXVtBLVphLXpfMC05XSovKSkge1xuICAgIHZhcm5hbWUgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgMSwgUkxFTkdUSCAtIDEpXG4gICAgaWYgKHZhcm5hbWUgaW4gRU5WSVJPTikge1xuICAgICAgcmVzdWx0ID0gcmVzdWx0IHN1YnN0cihyZXN0LCAxLCBSU1RBUlQgLSAxKSBFTlZJUk9OW3Zhcm5hbWVdXG4gICAgfSBlbHNlIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUICsgUkxFTkdUSCAtIDEpXG4gICAgfVxuICAgIHJlc3QgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgUkxFTkdUSClcbiAgfVxuICBwcmludCByZXN1bHQgcmVzdFxufScgL2hvbWUva29uZy90ZW1wLnltbCA+IFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuc2VkIC1pICcvXltbOnNwYWNlOl1dKi0ga2V5OltbOnNwYWNlOl1dKiQvZCcgXCIkS09OR19ERUNMQVJBVElWRV9DT05GSUdcIlxuXG5leGVjIC9lbnRyeXBvaW50LnNoIGtvbmcgZG9ja2VyLXN0YXJ0XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmcueW1sCiAgICAgICAgdGFyZ2V0OiAvaG9tZS9rb25nL3RlbXAueW1sCiAgICAgICAgY29udGVudDogIl9mb3JtYXRfdmVyc2lvbjogJzIuMSdcbl90cmFuc2Zvcm06IHRydWVcblxuIyMjXG4jIyMgQ29uc3VtZXJzIC8gVXNlcnNcbiMjI1xuY29uc3VtZXJzOlxuICAtIHVzZXJuYW1lOiBEQVNIQk9BUkRcbiAgLSB1c2VybmFtZTogYW5vblxuICAgIGtleWF1dGhfY3JlZGVudGlhbHM6XG4gICAgICAtIGtleTogJFNVUEFCQVNFX0FOT05fS0VZXG4gICAgICAtIGtleTogJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVxuICAtIHVzZXJuYW1lOiBzZXJ2aWNlX3JvbGVcbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRVJWSUNFX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRUNSRVRfS0VZXG5cbiMjI1xuIyMjIEFjY2VzcyBDb250cm9sIExpc3RcbiMjI1xuYWNsczpcbiAgLSBjb25zdW1lcjogYW5vblxuICAgIGdyb3VwOiBhbm9uXG4gIC0gY29uc3VtZXI6IHNlcnZpY2Vfcm9sZVxuICAgIGdyb3VwOiBhZG1pblxuXG4jIyNcbiMjIyBEYXNoYm9hcmQgY3JlZGVudGlhbHNcbiMjI1xuYmFzaWNhdXRoX2NyZWRlbnRpYWxzOlxuLSBjb25zdW1lcjogREFTSEJPQVJEXG4gIHVzZXJuYW1lOiAnJERBU0hCT0FSRF9VU0VSTkFNRSdcbiAgcGFzc3dvcmQ6ICckREFTSEJPQVJEX1BBU1NXT1JEJ1xuXG5cbiMjI1xuIyMjIEFQSSBSb3V0ZXNcbiMjI1xuc2VydmljZXM6XG5cbiAgIyMgT3BlbiBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS92ZXJpZnlcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvdmVyaWZ5XG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9jYWxsYmFja1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWNhbGxiYWNrXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9jYWxsYmFja1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tYXV0aG9yaXplXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L2F1dGhvcml6ZVxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvYXV0aG9yaXplXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb24gLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb24nXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWp3a3NcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvYWNzXCJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL2Fjc1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tbWV0YWRhdGFcbiAgICB1cmw6IFwiaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9zc28vc2FtbC9tZXRhZGF0YVwiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL21ldGFkYXRhXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIFNlY3VyZSBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjFcbiAgICBfY29tbWVudDogJ0dvVHJ1ZTogL2F1dGgvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5LyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUkVTVCByb3V0ZXNcbiAgLSBuYW1lOiByZXN0LXYxXG4gICAgX2NvbW1lbnQ6ICdQb3N0Z1JFU1Q6IC9yZXN0L3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlc3QtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVzdC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIEdyYXBoUUwgcm91dGVzXG4gIC0gbmFtZTogZ3JhcGhxbC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvZ3JhcGhxbC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvcnBjL2dyYXBocWwnXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBncmFwaHFsLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2dyYXBocWwvdjFcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJDb250ZW50LVByb2ZpbGU6IGdyYXBocWxfcHVibGljXCJcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBSZWFsdGltZSByb3V0ZXNcbiAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS8qIC0+IHdzOi8vcmVhbHRpbWU6NDAwMC9zb2NrZXQvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9zb2NrZXRcbiAgICBwcm90b2NvbDogd3NcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXdzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVhbHRpbWUvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgcXVlcnlzdHJpbmc6XG4gICAgICAgICAgICAgIC0gXCJhcGlrZXk6ICRMVUFfUlRfV1NfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS9hcGkvKiAtPiBodHRwOi8vcmVhbHRpbWU6NDAwMC9hcGkvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9hcGlcbiAgICBwcm90b2NvbDogaHR0cFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL2FwaVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTdG9yYWdlIEFQSSBlbmRwb2ludFxuICAjIyBObyBrZXktYXV0aCAtIFMzIHByb3RvY29sIHJlcXVlc3RzIGRvbid0IGNhcnJ5IGFuIGFwaWtleSBoZWFkZXIuXG4gIC0gbmFtZTogc3RvcmFnZS12MVxuICAgIF9jb21tZW50OiAnU3RvcmFnZTogL3N0b3JhZ2UvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwLyonXG4gICAgY29ubmVjdF90aW1lb3V0OiAkS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVFxuICAgIHdyaXRlX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVFxuICAgIHJlYWRfdGltZW91dDogJEtPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVRcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdG9yYWdlOjUwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBzdG9yYWdlLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3N0b3JhZ2UvdjEvXG4gICAgICAgIHJlcXVlc3RfYnVmZmVyaW5nOiAkS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HXG4gICAgICAgIHJlc3BvbnNlX2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkdcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IHBvc3QtZnVuY3Rpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFjY2VzczpcbiAgICAgICAgICAgIC0gfFxuICAgICAgICAgICAgICBsb2NhbCBhdXRoID0ga29uZy5yZXF1ZXN0LmdldF9oZWFkZXIoXCJhdXRob3JpemF0aW9uXCIpXG4gICAgICAgICAgICAgIGlmIGF1dGggPT0gbmlsIG9yIGF1dGggPT0gXCJcIiBvciBhdXRoOmZpbmQoXCJeJXMqJFwiKSB0aGVuXG4gICAgICAgICAgICAgICAga29uZy5zZXJ2aWNlLnJlcXVlc3QuY2xlYXJfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBlbmRcblxuICAjIyBFZGdlIEZ1bmN0aW9ucyByb3V0ZXNcbiAgLSBuYW1lOiBmdW5jdGlvbnMtdjFcbiAgICBfY29tbWVudDogJ0VkZ2UgRnVuY3Rpb25zOiAvZnVuY3Rpb25zL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOjkwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwL1xuICAgIHJlYWRfdGltZW91dDogMTUwMDAwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBmdW5jdGlvbnMtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvZnVuY3Rpb25zL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBPQXV0aCAyLjAgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgTWV0YWRhdGEgKFJGQyA4NDE0KVxuICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICBfY29tbWVudDogJ0F1dGg6IC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlciAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogd2VsbC1rbm93bi1vYXV0aFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gLy53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIEFuYWx5dGljcyByb3V0ZXNcbiAgIyMgTm90IHVzZWQgLSBTdHVkaW8gYW5kIFZlY3RvciB0YWxrIGRpcmVjdGx5IHRvIGFuYWx5dGljcyB2aWEgRG9ja2VyIG5ldHdvcmtpbmcuXG4gICMgLSBuYW1lOiBhbmFseXRpY3MtdjFcbiAgIyAgIF9jb21tZW50OiAnQW5hbHl0aWNzOiAvYW5hbHl0aWNzL3YxLyogLT4gaHR0cDovL2xvZ2ZsYXJlOjQwMDAvKidcbiAgIyAgIHVybDogaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL1xuICAjICAgcm91dGVzOlxuICAjICAgICAtIG5hbWU6IGFuYWx5dGljcy12MS1hbGxcbiAgIyAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICMgICAgICAgcGF0aHM6XG4gICMgICAgICAgICAtIC9hbmFseXRpY3MvdjEvXG5cbiAgIyMgU2VjdXJlIERhdGFiYXNlIHJvdXRlc1xuICAtIG5hbWU6IG1ldGFcbiAgICBfY29tbWVudDogJ3BnLW1ldGE6IC9wZy8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtZXRhLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3BnL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuXG4gICMjIEJsb2NrIGFjY2VzcyB0byAvYXBpL21jcFxuICAtIG5hbWU6IG1jcC1ibG9ja2VyXG4gICAgX2NvbW1lbnQ6ICdCbG9jayBkaXJlY3QgYWNjZXNzIHRvIC9hcGkvbWNwJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3BcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IG1jcC1ibG9ja2VyLXJvdXRlXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXBpL21jcFxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcblxuICAjIyBNQ1AgZW5kcG9pbnQgLSBsb2NhbCBhY2Nlc3NcbiAgLSBuYW1lOiBtY3BcbiAgICBfY29tbWVudDogJ01DUDogL21jcCAtPiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcCAobG9jYWwgYWNjZXNzKSdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3BcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgIyBCbG9jayBhY2Nlc3MgdG8gL21jcCBieSBkZWZhdWx0XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcbiAgICAgICMgRW5hYmxlIGxvY2FsIGFjY2VzcyAoZGFuZ2VyIHpvbmUhKVxuICAgICAgIyAxLiBDb21tZW50IG91dCB0aGUgJ3JlcXVlc3QtdGVybWluYXRpb24nIHNlY3Rpb24gYWJvdmVcbiAgICAgICMgMi4gVW5jb21tZW50IHRoZSBlbnRpcmUgc2VjdGlvbiBiZWxvdywgaW5jbHVkaW5nICdkZW55J1xuICAgICAgIyAzLiBBZGQgeW91ciBsb2NhbCBJUHMgdG8gdGhlICdhbGxvdycgbGlzdFxuICAgICAgIy0gbmFtZTogY29yc1xuICAgICAgIy0gbmFtZTogaXAtcmVzdHJpY3Rpb25cbiAgICAgICMgIGNvbmZpZzpcbiAgICAgICMgICAgYWxsb3c6XG4gICAgICAjICAgICAgLSAxMjcuMC4wLjFcbiAgICAgICMgICAgICAtIDo6MVxuICAgICAgIyAgICBkZW55OiBbXVxuXG4gICMjIFByb3RlY3RlZCBEYXNoYm9hcmQgLSBjYXRjaCBhbGwgcmVtYWluaW5nIHJvdXRlc1xuICAtIG5hbWU6IGRhc2hib2FyZFxuICAgIF9jb21tZW50OiAnU3R1ZGlvOiAvKiAtPiBodHRwOi8vc3R1ZGlvOjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGRhc2hib2FyZC1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGJhc2ljLWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IHRydWVcbiIKICBzdXBhYmFzZS1zdHVkaW86CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0dWRpbzoyMDI2LjAzLjE2LXNoYS01NTI4ODE3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJmZXRjaCgnaHR0cDovLzEyNy4wLjAuMTozMDAwL2FwaS9wbGF0Zm9ybS9wcm9maWxlJykudGhlbigocikgPT4ge2lmIChyLnN0YXR1cyAhPT0gMjAwKSB0aHJvdyBuZXcgRXJyb3Ioci5zdGF0dXMpfSkiCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAzCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIEhPU1ROQU1FPTAuMC4wLjAKICAgICAgLSAnU1RVRElPX1BHX01FVEFfVVJMPWh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAnCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1Q9JHtQT1NUR1JFU19IT1NUOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ1BPU1RHUkVTX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSAnREVGQVVMVF9PUkdBTklaQVRJT05fTkFNRT0ke1NUVURJT19ERUZBVUxUX09SR0FOSVpBVElPTjotRGVmYXVsdCBPcmdhbml6YXRpb259JwogICAgICAtICdERUZBVUxUX1BST0pFQ1RfTkFNRT0ke1NUVURJT19ERUZBVUxUX1BST0pFQ1Q6LURlZmF1bHQgUHJvamVjdH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdfTUVUQV9DUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogICAgICAtICdMT0dGTEFSRV9BUElfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFJJVkFURV9BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFUFJJVkFURX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1VSTD1odHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAnCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZWFsdGltZVwiKSdcbiAgICAgIHN0b3JhZ2U6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1zdG9yYWdlXCIpJ1xuICAgICAgZnVuY3Rpb25zOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtZWRnZS1mdW5jdGlvbnNcIiknXG4gICAgICBkYjogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWRiXCIpJ1xuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcm91dGVyLmtvbmdcbiAgICBzb3VyY2U6IHwtXG4gICAgICByZXEsIGVyciA9IHBhcnNlX25naW54X2xvZyguZXZlbnRfbWVzc2FnZSwgXCJjb21iaW5lZFwiKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC50aW1lc3RhbXAgPSByZXEudGltZXN0YW1wXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5yZWZlcmVyID0gcmVxLnJlZmVyZXJcbiAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5oZWFkZXJzLnVzZXJfYWdlbnQgPSByZXEuYWdlbnRcbiAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5oZWFkZXJzLmNmX2Nvbm5lY3RpbmdfaXAgPSByZXEuY2xpZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlc3BvbnNlLnN0YXR1c19jb2RlID0gcmVxLnN0YXR1c1xuICAgICAgICAgIHVybCwgc3BsaXRfZXJyID0gc3BsaXQocmVxLnJlcXVlc3QsIFwiIFwiKVxuICAgICAgICAgIGlmIHNwbGl0X2VyciA9PSBudWxsIHtcbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QubWV0aG9kID0gdXJsWzBdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnBhdGggPSB1cmxbMV1cbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QucHJvdG9jb2wgPSB1cmxbMl1cbiAgICAgICAgICB9XG4gICAgICB9XG4gICAgICBpZiBlcnIgIT0gbnVsbCB7XG4gICAgICAgIGFib3J0XG4gICAgICB9XG4gICMgSWdub3JlcyBub24gbmdpbnggZXJyb3JzIHNpbmNlIHRoZXkgYXJlIHJlbGF0ZWQgd2l0aCBrb25nIGJvb3RpbmcgdXBcbiAga29uZ19lcnI6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgLm1ldGFkYXRhLnJlcXVlc3QubWV0aG9kID0gXCJHRVRcIlxuICAgICAgLm1ldGFkYXRhLnJlc3BvbnNlLnN0YXR1c19jb2RlID0gMjAwXG4gICAgICBwYXJzZWQsIGVyciA9IHBhcnNlX25naW54X2xvZyguZXZlbnRfbWVzc2FnZSwgXCJlcnJvclwiKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZWQudGltZXN0YW1wXG4gICAgICAgICAgLnNldmVyaXR5ID0gcGFyc2VkLnNldmVyaXR5XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaG9zdCA9IHBhcnNlZC5ob3N0XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcGFyc2VkLmNsaWVudFxuICAgICAgICAgIHVybCwgZXJyID0gc3BsaXQocGFyc2VkLnJlcXVlc3QsIFwiIFwiKVxuICAgICAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QubWV0aG9kID0gdXJsWzBdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnBhdGggPSB1cmxbMV1cbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QucHJvdG9jb2wgPSB1cmxbMl1cbiAgICAgICAgICB9XG4gICAgICB9XG4gICAgICBpZiBlcnIgIT0gbnVsbCB7XG4gICAgICAgIGFib3J0XG4gICAgICB9XG4gICMgR290cnVlIGxvZ3MgYXJlIHN0cnVjdHVyZWQganNvbiBzdHJpbmdzIHdoaWNoIGZyb250ZW5kIHBhcnNlcyBkaXJlY3RseS4gQnV0IHdlIGtlZXAgbWV0YWRhdGEgZm9yIGNvbnNpc3RlbmN5LlxuICBhdXRoX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5hdXRoXG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9qc29uKC5ldmVudF9tZXNzYWdlKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5tZXRhZGF0YS50aW1lc3RhbXAgPSBwYXJzZWQudGltZVxuICAgICAgICAgIC5tZXRhZGF0YSA9IG1lcmdlISgubWV0YWRhdGEsIHBhcnNlZClcbiAgICAgIH1cbiAgIyBQb3N0Z1JFU1QgbG9ncyBhcmUgc3RydWN0dXJlZCBzbyB3ZSBzZXBhcmF0ZSB0aW1lc3RhbXAgZnJvbSBtZXNzYWdlIHVzaW5nIHJlZ2V4XG4gIHJlc3RfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcm91dGVyLnJlc3RcbiAgICBzb3VyY2U6IHwtXG4gICAgICBwYXJzZWQsIGVyciA9IHBhcnNlX3JlZ2V4KC5ldmVudF9tZXNzYWdlLCByJ14oP1A8dGltZT4uKik6ICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLnRpbWVzdGFtcCA9IHBhcnNlX3RpbWVzdGFtcCEodmFsdWU6IHBhcnNlZC50aW1lLCBmb3JtYXQ6IFwiJWQvJWIvJVk6JUg6JU06JVMgJXpcIilcbiAgICAgICAgICAubWV0YWRhdGEuaG9zdCA9IC5wcm9qZWN0XG4gICAgICB9XG4gICMgRmlsdGVyIG91dCBoZWFsdGhjaGVjayBsb2dzIGZyb20gUmVhbHRpbWVcbiAgcmVhbHRpbWVfbG9nc19maWx0ZXJlZDpcbiAgICB0eXBlOiBmaWx0ZXJcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZWFsdGltZVxuICAgIGNvbmRpdGlvbjogJyFjb250YWlucyhzdHJpbmchKC5ldmVudF9tZXNzYWdlKSwgXCIvaGVhbHRoXCIpJ1xuICAjIFJlYWx0aW1lIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2UgcGFyc2UgdGhlIHNldmVyaXR5IGxldmVsIHVzaW5nIHJlZ2V4IChpZ25vcmUgdGltZSBiZWNhdXNlIGl0IGhhcyBubyBkYXRlKVxuICByZWFsdGltZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByZWFsdGltZV9sb2dzX2ZpbHRlcmVkXG4gICAgc291cmNlOiB8LVxuICAgICAgLm1ldGFkYXRhLnByb2plY3QgPSBkZWwoLnByb2plY3QpXG4gICAgICAubWV0YWRhdGEuZXh0ZXJuYWxfaWQgPSAubWV0YWRhdGEucHJvamVjdFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+XFxkKzpcXGQrOlxcZCtcXC5cXGQrKSBcXFsoP1A8bGV2ZWw+XFx3KylcXF0gKD9QPG1zZz4uKikkJylcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgIH1cbiAgIyBTdG9yYWdlIGxvZ3MgbWF5IGNvbnRhaW4ganNvbiBvYmplY3RzIHNvIHdlIHBhcnNlIHRoZW0gZm9yIGNvbXBsZXRlbmVzc1xuICBzdG9yYWdlX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5zdG9yYWdlXG4gICAgc291cmNlOiB8LVxuICAgICAgLm1ldGFkYXRhLnByb2plY3QgPSBkZWwoLnByb2plY3QpXG4gICAgICAubWV0YWRhdGEudGVuYW50SWQgPSAubWV0YWRhdGEucHJvamVjdFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9qc29uKC5ldmVudF9tZXNzYWdlKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC5tZXRhZGF0YS5sZXZlbCA9IHBhcnNlZC5sZXZlbFxuICAgICAgICAgIC5tZXRhZGF0YS50aW1lc3RhbXAgPSBwYXJzZWQudGltZVxuICAgICAgICAgIC5tZXRhZGF0YS5jb250ZXh0WzBdLmhvc3QgPSBwYXJzZWQuaG9zdG5hbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5waWQgPSBwYXJzZWQucGlkXG4gICAgICB9XG4gICMgRnVuY3Rpb24gbG9ncyBhcmUgdW5zdHJ1Y3R1cmVkIG1lc3NhZ2VzIG9uIHN0ZGVyclxuICBmdW5jdGlvbnNfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcm91dGVyLmZ1bmN0aW9uc1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0X3JlZiA9IGRlbCgucHJvamVjdClcbiAgIyBQb3N0Z3JlcyBsb2dzIHNvbWUgbWVzc2FnZXMgdG8gc3RkZXJyIHdoaWNoIHdlIG1hcCB0byB3YXJuaW5nIHNldmVyaXR5IGxldmVsXG4gIGRiX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5kYlxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5ob3N0ID0gXCJkYi1kZWZhdWx0XCJcbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQudGltZXN0YW1wID0gLnRpbWVzdGFtcFxuXG4gICAgICBwYXJzZWQsIGVyciA9IHBhcnNlX3JlZ2V4KC5ldmVudF9tZXNzYWdlLCByJy4qKD9QPGxldmVsPklORk98Tk9USUNFfFdBUk5JTkd8RVJST1J8TE9HfEZBVEFMfFBBTklDPyk6LionLCBudW1lcmljX2dyb3VwczogdHJ1ZSlcblxuICAgICAgaWYgZXJyICE9IG51bGwgfHwgcGFyc2VkID09IG51bGwge1xuICAgICAgICAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID0gXCJpbmZvXCJcbiAgICAgIH1cbiAgICAgIGlmIHBhcnNlZC5sZXZlbCAhPSBudWxsIHtcbiAgICAgICAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICAgICBpZiAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID09IFwiaW5mb1wiIHtcbiAgICAgICAgICAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID0gXCJsb2dcIlxuICAgICAgfVxuICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHVwY2FzZSEoLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSlcblxuc2lua3M6XG4gIGxvZ2ZsYXJlX2F1dGg6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBhdXRoX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPWdvdHJ1ZS5sb2dzLnByb2QnXG4gIGxvZ2ZsYXJlX3JlYWx0aW1lOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cmVhbHRpbWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZXN0OlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gcmVzdF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z1JFU1QubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9kYjpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIGRiX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXBvc3RncmVzLmxvZ3MnXG4gIGxvZ2ZsYXJlX2Z1bmN0aW9uczpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIGZ1bmN0aW9uc19sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1kZW5vLXJlbGF5LWxvZ3MnXG4gIGxvZ2ZsYXJlX3N0b3JhZ2U6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBzdG9yYWdlX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXN0b3JhZ2UubG9ncy5wcm9kLjInXG4gIGxvZ2ZsYXJlX2tvbmc6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBrb25nX2xvZ3NcbiAgICAgIC0ga29uZ19lcnJcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPWNsb3VkZmxhcmUubG9ncy5wcm9kJ1xuIgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jazpybycKICAgIGVudmlyb25tZW50OgogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICBjb21tYW5kOgogICAgICAtICctLWNvbmZpZycKICAgICAgLSAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgc3VwYWJhc2UtcmVzdDoKICAgIGltYWdlOiAncG9zdGdyZXN0L3Bvc3RncmVzdDp2MTQuNicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BHUlNUX0RCX1VSST1wb3N0Z3JlczovL2F1dGhlbnRpY2F0b3I6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BHUlNUX0RCX1NDSEVNQVM9JHtQR1JTVF9EQl9TQ0hFTUFTOi1wdWJsaWMsc3RvcmFnZSxncmFwaHFsX3B1YmxpY30nCiAgICAgIC0gJ1BHUlNUX0RCX01BWF9ST1dTPSR7UEdSU1RfREJfTUFYX1JPV1M6LTEwMDB9JwogICAgICAtICdQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSD0ke1BHUlNUX0RCX0VYVFJBX1NFQVJDSF9QQVRIOi1wdWJsaWN9JwogICAgICAtIFBHUlNUX0RCX0FOT05fUk9MRT1hbm9uCiAgICAgIC0gJ1BHUlNUX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gUEdSU1RfREJfVVNFX0xFR0FDWV9HVUNTPWZhbHNlCiAgICAgIC0gJ1BHUlNUX0FQUF9TRVRUSU5HU19KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgY29tbWFuZDogcG9zdGdyZXN0CiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICBzdXBhYmFzZS1hdXRoOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9nb3RydWU6djIuMTg2LjAnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjk5OTkvaGVhbHRoJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR09UUlVFX0FQSV9IT1NUPTAuMC4wLjAKICAgICAgLSBHT1RSVUVfQVBJX1BPUlQ9OTk5OQogICAgICAtICdBUElfRVhURVJOQUxfVVJMPSR7QVBJX0VYVEVSTkFMX1VSTDotaHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMH0nCiAgICAgIC0gR09UUlVFX0RCX0RSSVZFUj1wb3N0Z3JlcwogICAgICAtICdHT1RSVUVfREJfREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vc3VwYWJhc2VfYXV0aF9hZG1pbjoke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QCR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifToke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9LyR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnR09UUlVFX1NJVEVfVVJMPSR7R09UUlVFX1NJVEVfVVJMOi0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR319JwogICAgICAtICdHT1RSVUVfVVJJX0FMTE9XX0xJU1Q9JHtBRERJVElPTkFMX1JFRElSRUNUX1VSTFN9JwogICAgICAtICdHT1RSVUVfRElTQUJMRV9TSUdOVVA9JHtESVNBQkxFX1NJR05VUDotZmFsc2V9JwogICAgICAtIEdPVFJVRV9KV1RfQURNSU5fUk9MRVM9c2VydmljZV9yb2xlCiAgICAgIC0gR09UUlVFX0pXVF9BVUQ9YXV0aGVudGljYXRlZAogICAgICAtIEdPVFJVRV9KV1RfREVGQVVMVF9HUk9VUF9OQU1FPWF1dGhlbnRpY2F0ZWQKICAgICAgLSAnR09UUlVFX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgICAgLSAnR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0dPVFJVRV9FWFRFUk5BTF9FTUFJTF9FTkFCTEVEPSR7RU5BQkxFX0VNQUlMX1NJR05VUDotdHJ1ZX0nCiAgICAgIC0gJ0dPVFJVRV9FWFRFUk5BTF9BTk9OWU1PVVNfVVNFUlNfRU5BQkxFRD0ke0VOQUJMRV9BTk9OWU1PVVNfVVNFUlM6LWZhbHNlfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9BVVRPQ09ORklSTT0ke0VOQUJMRV9FTUFJTF9BVVRPQ09ORklSTTotZmFsc2V9JwogICAgICAtICdHT1RSVUVfU01UUF9BRE1JTl9FTUFJTD0ke1NNVFBfQURNSU5fRU1BSUx9JwogICAgICAtICdHT1RSVUVfU01UUF9IT1NUPSR7U01UUF9IT1NUfScKICAgICAgLSAnR09UUlVFX1NNVFBfUE9SVD0ke1NNVFBfUE9SVDotNTg3fScKICAgICAgLSAnR09UUlVFX1NNVFBfVVNFUj0ke1NNVFBfVVNFUn0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BBU1M9JHtTTVRQX1BBU1N9JwogICAgICAtICdHT1RSVUVfU01UUF9TRU5ERVJfTkFNRT0ke1NNVFBfU0VOREVSX05BTUV9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0lOVklURT0ke01BSUxFUl9VUkxQQVRIU19JTlZJVEU6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTjotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19SRUNPVkVSWT0ke01BSUxFUl9VUkxQQVRIU19SRUNPVkVSWTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19FTUFJTF9DSEFOR0U9JHtNQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19JTlZJVEU9JHtNQUlMRVJfVEVNUExBVEVTX0lOVklURX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9URU1QTEFURVNfQ09ORklSTUFUSU9OfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfUkVDT1ZFUlk9JHtNQUlMRVJfVEVNUExBVEVTX1JFQ09WRVJZfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfTUFHSUNfTElOSz0ke01BSUxFUl9URU1QTEFURVNfTUFHSUNfTElOS30nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9URU1QTEFURVNfRU1BSUxfQ0hBTkdFfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19DT05GSVJNQVRJT049JHtNQUlMRVJfU1VCSkVDVFNfQ09ORklSTUFUSU9OfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19SRUNPVkVSWT0ke01BSUxFUl9TVUJKRUNUU19SRUNPVkVSWX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfTUFHSUNfTElOSz0ke01BSUxFUl9TVUJKRUNUU19NQUdJQ19MSU5LfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19FTUFJTF9DSEFOR0U9JHtNQUlMRVJfU1VCSkVDVFNfRU1BSUxfQ0hBTkdFfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19JTlZJVEU9JHtNQUlMRVJfU1VCSkVDVFNfSU5WSVRFfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX1BIT05FX0VOQUJMRUQ9JHtFTkFCTEVfUEhPTkVfU0lHTlVQOi10cnVlfScKICAgICAgLSAnR09UUlVFX1NNU19BVVRPQ09ORklSTT0ke0VOQUJMRV9QSE9ORV9BVVRPQ09ORklSTTotdHJ1ZX0nCiAgcmVhbHRpbWUtZGV2OgogICAgaW1hZ2U6ICdzdXBhYmFzZS9yZWFsdGltZTp2Mi43Ni41JwogICAgY29udGFpbmVyX25hbWU6IHJlYWx0aW1lLWRldi5zdXBhYmFzZS1yZWFsdGltZQogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy0taGVhZCcKICAgICAgICAtICctbycKICAgICAgICAtIC9kZXYvbnVsbAogICAgICAgIC0gJy1IJwogICAgICAgIC0gJ0F1dGhvcml6YXRpb246IEJlYXJlciAke1NFUlZJQ0VfU1VQQUJBU0VBTk9OX0tFWX0nCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS90ZW5hbnRzL3JlYWx0aW1lLWRldi9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQT1JUPTQwMDAKICAgICAgLSAnREJfSE9TVD0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSBEQl9VU0VSPXN1cGFiYXNlX2FkbWluCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ0RCX05BTUU9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdEQl9BRlRFUl9DT05ORUNUX1FVRVJZPVNFVCBzZWFyY2hfcGF0aCBUTyBfcmVhbHRpbWUnCiAgICAgIC0gREJfRU5DX0tFWT1zdXBhYmFzZXJlYWx0aW1lCiAgICAgIC0gJ0FQSV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRUNSRVRfUEFTU1dPUkRfUkVBTFRJTUV9JwogICAgICAtICdNRVRSSUNTX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0VSTF9BRkxBR1M9LXByb3RvX2Rpc3QgaW5ldF90Y3AnCiAgICAgIC0gIkROU19OT0RFUz0nJyIKICAgICAgLSBSTElNSVRfTk9GSUxFPTEwMDAwCiAgICAgIC0gQVBQX05BTUU9cmVhbHRpbWUKICAgICAgLSBTRUVEX1NFTEZfSE9TVD10cnVlCiAgICAgIC0gTE9HX0xFVkVMPWVycm9yCiAgICAgIC0gUlVOX0pBTklUT1I9dHJ1ZQogICAgICAtIEpBTklUT1JfSU5URVJWQUw9NjAwMDAKICAgICAgLSBESVNBQkxFX0hFQUxUSENIRUNLX0xPR0dJTkc9dHJ1ZQogICAgY29tbWFuZDogInNoIC1jIFwiL2FwcC9iaW4vbWlncmF0ZSAmJiAvYXBwL2Jpbi9yZWFsdGltZSBldmFsICdSZWFsdGltZS5SZWxlYXNlLnNlZWRzKFJlYWx0aW1lLlJlcG8pJyAmJiAvYXBwL2Jpbi9zZXJ2ZXJcIlxuIgogIHN1cGFiYXNlLW1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBjb21tYW5kOiAnc2VydmVyIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSIgL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovZGF0YScKICBtaW5pby1jcmVhdGVidWNrZXQ6CiAgICBpbWFnZTogbWluaW8vbWMKICAgIHJlc3RhcnQ6ICdubycKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1taW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDoKICAgICAgLSAvZW50cnlwb2ludC5zaAogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2VudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG4vdXNyL2Jpbi9tYyBhbGlhcyBzZXQgc3VwYWJhc2UtbWluaW8gaHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAgJHtNSU5JT19ST09UX1VTRVJ9ICR7TUlOSU9fUk9PVF9QQVNTV09SRH07XG4vdXNyL2Jpbi9tYyBtYiAtLWlnbm9yZS1leGlzdGluZyBzdXBhYmFzZS1taW5pby9zdHViO1xuZXhpdCAwXG4iCiAgc3VwYWJhc2Utc3RvcmFnZToKICAgIGltYWdlOiAnc3VwYWJhc2Uvc3RvcmFnZS1hcGk6djEuNDQuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLXJlc3Q6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgICAgaW1ncHJveHk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjUwMDAvc3RhdHVzJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVkVSX1BPUlQ9NTAwMAogICAgICAtIFNFUlZFUl9SRUdJT049bG9jYWwKICAgICAgLSBNVUxUSV9URU5BTlQ9ZmFsc2UKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly9zdXBhYmFzZV9zdG9yYWdlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtIERCX0lOU1RBTExfUk9MRVM9ZmFsc2UKICAgICAgLSBTVE9SQUdFX0JBQ0tFTkQ9czMKICAgICAgLSBTVE9SQUdFX1MzX0JVQ0tFVD1zdHViCiAgICAgIC0gJ1NUT1JBR0VfUzNfRU5EUE9JTlQ9aHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAnCiAgICAgIC0gU1RPUkFHRV9TM19GT1JDRV9QQVRIX1NUWUxFPXRydWUKICAgICAgLSBTVE9SQUdFX1MzX1JFR0lPTj11cy1lYXN0LTEKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9GSUxFX1NJWkVfTElNSVRfU1RBTkRBUkQ9NTI0Mjg4MDAwCiAgICAgIC0gVVBMT0FEX1NJR05FRF9VUkxfRVhQSVJBVElPTl9USU1FPTEyMAogICAgICAtIFRVU19VUkxfUEFUSD0vdXBsb2FkL3Jlc3VtYWJsZQogICAgICAtIFRVU19NQVhfU0laRT0zNjAwMDAwCiAgICAgIC0gRU5BQkxFX0lNQUdFX1RSQU5TRk9STUFUSU9OPXRydWUKICAgICAgLSAnSU1HUFJPWFlfVVJMPWh0dHA6Ly9pbWdwcm94eTo4MDgwJwogICAgICAtIElNR1BST1hZX1JFUVVFU1RfVElNRU9VVD0xNQogICAgICAtIERBVEFCQVNFX1NFQVJDSF9QQVRIPXN0b3JhZ2UKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gUkVRVUVTVF9BTExPV19YX0ZPUldBUkRFRF9QQVRIPXRydWUKICAgICAgLSAnQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1BPU1RHUkVTVF9VUkw9aHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMCcKICAgICAgLSAnUEdSU1RfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU1RPUkFHRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnVEVOQU5UX0lEPSR7U1RPUkFHRV9URU5BTlRfSUQ6LXN0b3JhZ2Utc2luZ2xlLXRlbmFudH0nCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIGltZ3Byb3h5OgogICAgaW1hZ2U6ICdkYXJ0aHNpbS9pbWdwcm94eTp2My4zMC4xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGltZ3Byb3h5CiAgICAgICAgLSBoZWFsdGgKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdJTUdQUk9YWV9CSU5EPTo4MDgwJwogICAgICAtIElNR1BST1hZX0xPQ0FMX0ZJTEVTWVNURU1fUk9PVD0vCiAgICAgIC0gSU1HUFJPWFlfVVNFX0VUQUc9dHJ1ZQogICAgICAtICdJTUdQUk9YWV9BVVRPX1dFQlA9JHtJTUdQUk9YWV9BVVRPX1dFQlA6LXRydWV9JwogICAgICAtIElNR1BST1hZX01BWF9TUkNfUkVTT0xVVElPTj0xNi44CiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIHN1cGFiYXNlLW1ldGE6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3Bvc3RncmVzLW1ldGE6djAuOTUuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUEdfTUVUQV9QT1JUPTgwODAKICAgICAgLSAnUEdfTUVUQV9EQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUEdfTUVUQV9EQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHX01FVEFfREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUEdfTUVUQV9EQl9VU0VSPXN1cGFiYXNlX2FkbWluCiAgICAgIC0gJ1BHX01FVEFfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQ1JZUFRPX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfUEdNRVRBQ1JZUFRPfScKICBzdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczoKICAgIGltYWdlOiAnc3VwYWJhc2UvZWRnZS1ydW50aW1lOnYxLjcxLjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnRWRnZSBGdW5jdGlvbnMgaXMgaGVhbHRoeScKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvaGVsbG8vaW5kZXgudHMKICAgICAgICBjb250ZW50OiAiLy8gRm9sbG93IHRoaXMgc2V0dXAgZ3VpZGUgdG8gaW50ZWdyYXRlIHRoZSBEZW5vIGxhbmd1YWdlIHNlcnZlciB3aXRoIHlvdXIgZWRpdG9yOlxuLy8gaHR0cHM6Ly9kZW5vLmxhbmQvbWFudWFsL2dldHRpbmdfc3RhcnRlZC9zZXR1cF95b3VyX2Vudmlyb25tZW50XG4vLyBUaGlzIGVuYWJsZXMgYXV0b2NvbXBsZXRlLCBnbyB0byBkZWZpbml0aW9uLCBldGMuXG5cbkRlbm8uc2VydmUoYXN5bmMgKCkgPT4ge1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKFxuICAgIGBcIkhlbGxvIGZyb20gRWRnZSBGdW5jdGlvbnMhXCJgLFxuICAgIHsgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9IH0sXG4gIClcbn0pXG5cbi8vIFRvIGludm9rZTpcbi8vIGN1cmwgJ2h0dHA6Ly9sb2NhbGhvc3Q6PEtPTkdfSFRUUF9QT1JUPi9mdW5jdGlvbnMvdjEvaGVsbG8nIFxcXG4vLyAgIC0taGVhZGVyICdBdXRob3JpemF0aW9uOiBCZWFyZXIgPGFub24vc2VydmljZV9yb2xlIEFQSSBrZXk+J1xuIgogICAgY29tbWFuZDoKICAgICAgLSBzdGFydAogICAgICAtICctLW1haW4tc2VydmljZScKICAgICAgLSAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9tYWluCiAgc3VwYWJhc2Utc3VwYXZpc29yOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdXBhdmlzb3I6Mi43LjQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9PTEVSX1RFTkFOVF9JRD0ke1BPT0xFUl9URU5BTlRfSUQ6LWRldl90ZW5hbnR9JwogICAgICAtIFBPT0xFUl9QT09MX01PREU9dHJhbnNhY3Rpb24KICAgICAgLSAnUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFPSR7UE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFOi0yMH0nCiAgICAgIC0gJ1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk49JHtQT09MRVJfTUFYX0NMSUVOVF9DT05OOi0xMDB9JwogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1ROQU1FPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9ZWN0bzovL3N1cGFiYXNlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vX3N1cGFiYXNlJwogICAgICAtIENMVVNURVJfUE9TVEdSRVM9dHJ1ZQogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRVJWSUNFX1BBU1NXT1JEX1NVUEFWSVNPUlNFQ1JFVH0nCiAgICAgIC0gJ1ZBVUxUX0VOQ19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1ZBVUxURU5DfScKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSBSRUdJT049bG9jYWwKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAnREJfUE9PTF9TSVpFPSR7UE9PTEVSX0RCX1BPT0xfU0laRTotNX0nCiAgICAgIC0gR0xPQkFMX0RPV05TVFJFQU1fQ0VSVF9QQVRIPS9ldGMvc3NsL3NlcnZlci5jcnQKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9LRVlfUEFUSD0vZXRjL3NzbC9zZXJ2ZXIua2V5CiAgICBjb21tYW5kOgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICAgIC0gImlmIFsgISAtZiAvZXRjL3NzbC9zZXJ2ZXIuY3J0IF07IHRoZW5cbiAgb3BlbnNzbCByZXEgLXg1MDkgLW5vZGVzIC1kYXlzIDM2NTAgLW5ld2tleSByc2E6MjA0OCBcXFxuICAgIC1rZXlvdXQgL2V0Yy9zc2wvc2VydmVyLmtleSAtb3V0IC9ldGMvc3NsL3NlcnZlci5jcnQgXFxcbiAgICAtc3ViaiBcIi9DTj1zdXBhYmFzZS1wb29sZXJcIlxuZmlcbi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vc3VwYXZpc29yIGV2YWwgXCIkJChjYXQgL2V0Yy9wb29sZXIvcG9vbGVyLmV4cylcIiAmJiAvYXBwL2Jpbi9zZXJ2ZXJcbiIKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICB0YXJnZXQ6IC9ldGMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICBjb250ZW50OiAiezpvaywgX30gPSBBcHBsaWNhdGlvbi5lbnN1cmVfYWxsX3N0YXJ0ZWQoOnN1cGF2aXNvcilcbns6b2ssIHZlcnNpb259ID1cbiAgICBjYXNlIFN1cGF2aXNvci5SZXBvLnF1ZXJ5IShcInNlbGVjdCB2ZXJzaW9uKClcIikgZG9cbiAgICAle3Jvd3M6IFtbdmVyXV19IC0+IFN1cGF2aXNvci5IZWxwZXJzLnBhcnNlX3BnX3ZlcnNpb24odmVyKVxuICAgIF8gLT4gbmlsXG4gICAgZW5kXG5wYXJhbXMgPSAle1xuICAgIFwiZXh0ZXJuYWxfaWRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9URU5BTlRfSURcIiksXG4gICAgXCJkYl9ob3N0XCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19IT1NUTkFNRVwiKSxcbiAgICBcImRiX3BvcnRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BPUlRcIikgfD4gU3RyaW5nLnRvX2ludGVnZXIoKSxcbiAgICBcImRiX2RhdGFiYXNlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19EQlwiKSxcbiAgICBcInJlcXVpcmVfdXNlclwiID0+IGZhbHNlLFxuICAgIFwiYXV0aF9xdWVyeVwiID0+IFwiU0VMRUNUICogRlJPTSBwZ2JvdW5jZXIuZ2V0X2F1dGgoJDEpXCIsXG4gICAgXCJkZWZhdWx0X21heF9jbGllbnRzXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfTUFYX0NMSUVOVF9DT05OXCIpLFxuICAgIFwiZGVmYXVsdF9wb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImRlZmF1bHRfcGFyYW1ldGVyX3N0YXR1c1wiID0+ICV7XCJzZXJ2ZXJfdmVyc2lvblwiID0+IHZlcnNpb259LFxuICAgIFwidXNlcnNcIiA9PiBbJXtcbiAgICBcImRiX3VzZXJcIiA9PiBcInBnYm91bmNlclwiLFxuICAgIFwiZGJfcGFzc3dvcmRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BBU1NXT1JEXCIpLFxuICAgIFwibW9kZV90eXBlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfUE9PTF9NT0RFXCIpLFxuICAgIFwicG9vbF9zaXplXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfREVGQVVMVF9QT09MX1NJWkVcIiksXG4gICAgXCJpc19tYW5hZ2VyXCIgPT4gdHJ1ZVxuICAgIH1dXG59XG5cbnRlbmFudCA9IFN1cGF2aXNvci5UZW5hbnRzLmdldF90ZW5hbnRfYnlfZXh0ZXJuYWxfaWQocGFyYW1zW1wiZXh0ZXJuYWxfaWRcIl0pXG5cbmlmIHRlbmFudCBkb1xuICB7Om9rLCBffSA9IFN1cGF2aXNvci5UZW5hbnRzLnVwZGF0ZV90ZW5hbnQodGVuYW50LCBwYXJhbXMpXG5lbHNlXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMuY3JlYXRlX3RlbmFudChwYXJhbXMpXG5lbmRcbiIK",
+        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfU1VQQUJBU0VLT05HXzgwMDAKICAgICAgLSAnS09OR19QT1JUX01BUFM9NDQzOjgwMDAnCiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gS09OR19EQVRBQkFTRT1vZmYKICAgICAgLSBLT05HX0RFQ0xBUkFUSVZFX0NPTkZJRz0vdXNyL2xvY2FsL2tvbmcva29uZy55bWwKICAgICAgLSAnS09OR19ETlNfT1JERVI9TEFTVCxBLENOQU1FJwogICAgICAtIEtPTkdfRE5TX05PVF9GT1VORF9UVEw9MQogICAgICAtICdLT05HX1BMVUdJTlM9cmVxdWVzdC10cmFuc2Zvcm1lcixjb3JzLGtleS1hdXRoLGFjbCxiYXNpYy1hdXRoLHJlcXVlc3QtdGVybWluYXRpb24saXAtcmVzdHJpY3Rpb24scG9zdC1mdW5jdGlvbicKICAgICAgLSBLT05HX05HSU5YX1BST1hZX1BST1hZX0JVRkZFUl9TSVpFPTE2MGsKICAgICAgLSAnS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJTPTY0IDE2MGsnCiAgICAgIC0gJ0tPTkdfUFJPWFlfQUNDRVNTX0xPRz0vZGV2L3N0ZG91dCBjb21iaW5lZCcKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWT0ke1NVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWTotfScKICAgICAgLSAnU1VQQUJBU0VfU0VDUkVUX0tFWT0ke1NVUEFCQVNFX1NFQ1JFVF9LRVk6LX0nCiAgICAgIC0gJ0FOT05fS0VZX0FTWU1NRVRSSUM9JHtBTk9OX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM9JHtTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUM6LX0nCiAgICAgIC0gJ0RBU0hCT0FSRF9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0RBU0hCT0FSRF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtICdLT05HX1NUT1JBR0VfQ09OTkVDVF9USU1FT1VUPSR7S09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVDotNjB9JwogICAgICAtICdLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9XUklURV9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFQURfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ6LTM2MDB9JwogICAgICAtICdLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVRVUVTVF9CVUZGRVJJTkc6LWZhbHNlfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFU1BPTlNFX0JVRkZFUklORz0ke0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc6LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmctZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL2Jhc2hcbiMgQ3VzdG9tIGVudHJ5cG9pbnQgZm9yIEtvbmcgdGhhdCBidWlsZHMgTHVhIGV4cHJlc3Npb25zIGZvciByZXF1ZXN0LXRyYW5zZm9ybWVyXG4jIGFuZCBwZXJmb3JtcyBlbnZpcm9ubWVudCB2YXJpYWJsZSBzdWJzdGl0dXRpb24gaW4gdGhlIGRlY2xhcmF0aXZlIGNvbmZpZy5cblxuaWYgWyAtbiBcIiRTVVBBQkFTRV9TRUNSRVRfS0VZXCIgXSAmJiBbIC1uIFwiJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVwiIF07IHRoZW5cbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIChoZWFkZXJzLmFwaWtleSA9PSAnJFNVUEFCQVNFX1NFQ1JFVF9LRVknIGFuZCAnQmVhcmVyICRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnQmVhcmVyICRBTk9OX0tFWV9BU1lNTUVUUklDJykgb3IgaGVhZGVycy5hcGlrZXkpXCJcbiAgICBleHBvcnQgTFVBX1JUX1dTX0VYUFI9XCJcXCQoKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJyRTRVJWSUNFX1JPTEVfS0VZX0FTWU1NRVRSSUMnKSBvciAocXVlcnlfcGFyYW1zLmFwaWtleSA9PSAnJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWScgYW5kICckQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmVsc2VcbiAgICBleHBvcnQgTFVBX0FVVEhfRVhQUj1cIlxcJCgoaGVhZGVycy5hdXRob3JpemF0aW9uIH49IG5pbCBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uOnN1YigxLCAxMCkgfj0gJ0JlYXJlciBzYl8nIGFuZCBoZWFkZXJzLmF1dGhvcml6YXRpb24pIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKHF1ZXJ5X3BhcmFtcy5hcGlrZXkpXCJcbmZpXG5cbmF3ayAne1xuICByZXN1bHQgPSBcIlwiXG4gIHJlc3QgPSAkMFxuICB3aGlsZSAobWF0Y2gocmVzdCwgL1xcJFtBLVphLXpfXVtBLVphLXpfMC05XSovKSkge1xuICAgIHZhcm5hbWUgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgMSwgUkxFTkdUSCAtIDEpXG4gICAgaWYgKHZhcm5hbWUgaW4gRU5WSVJPTikge1xuICAgICAgcmVzdWx0ID0gcmVzdWx0IHN1YnN0cihyZXN0LCAxLCBSU1RBUlQgLSAxKSBFTlZJUk9OW3Zhcm5hbWVdXG4gICAgfSBlbHNlIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUICsgUkxFTkdUSCAtIDEpXG4gICAgfVxuICAgIHJlc3QgPSBzdWJzdHIocmVzdCwgUlNUQVJUICsgUkxFTkdUSClcbiAgfVxuICBwcmludCByZXN1bHQgcmVzdFxufScgL2hvbWUva29uZy90ZW1wLnltbCA+IFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuc2VkIC1pICcvXltbOnNwYWNlOl1dKi0ga2V5OltbOnNwYWNlOl1dKiQvZCcgXCIkS09OR19ERUNMQVJBVElWRV9DT05GSUdcIlxuXG5leGVjIC9lbnRyeXBvaW50LnNoIGtvbmcgZG9ja2VyLXN0YXJ0XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvYXBpL2tvbmcueW1sCiAgICAgICAgdGFyZ2V0OiAvaG9tZS9rb25nL3RlbXAueW1sCiAgICAgICAgY29udGVudDogIl9mb3JtYXRfdmVyc2lvbjogJzIuMSdcbl90cmFuc2Zvcm06IHRydWVcblxuIyMjXG4jIyMgQ29uc3VtZXJzIC8gVXNlcnNcbiMjI1xuY29uc3VtZXJzOlxuICAtIHVzZXJuYW1lOiBEQVNIQk9BUkRcbiAgLSB1c2VybmFtZTogYW5vblxuICAgIGtleWF1dGhfY3JlZGVudGlhbHM6XG4gICAgICAtIGtleTogJFNVUEFCQVNFX0FOT05fS0VZXG4gICAgICAtIGtleTogJFNVUEFCQVNFX1BVQkxJU0hBQkxFX0tFWVxuICAtIHVzZXJuYW1lOiBzZXJ2aWNlX3JvbGVcbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRVJWSUNFX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9TRUNSRVRfS0VZXG5cbiMjI1xuIyMjIEFjY2VzcyBDb250cm9sIExpc3RcbiMjI1xuYWNsczpcbiAgLSBjb25zdW1lcjogYW5vblxuICAgIGdyb3VwOiBhbm9uXG4gIC0gY29uc3VtZXI6IHNlcnZpY2Vfcm9sZVxuICAgIGdyb3VwOiBhZG1pblxuXG4jIyNcbiMjIyBEYXNoYm9hcmQgY3JlZGVudGlhbHNcbiMjI1xuYmFzaWNhdXRoX2NyZWRlbnRpYWxzOlxuLSBjb25zdW1lcjogREFTSEJPQVJEXG4gIHVzZXJuYW1lOiAnJERBU0hCT0FSRF9VU0VSTkFNRSdcbiAgcGFzc3dvcmQ6ICckREFTSEJPQVJEX1BBU1NXT1JEJ1xuXG5cbiMjI1xuIyMjIEFQSSBSb3V0ZXNcbiMjI1xuc2VydmljZXM6XG5cbiAgIyMgT3BlbiBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS92ZXJpZnlcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3BlblxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvdmVyaWZ5XG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9jYWxsYmFja1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWNhbGxiYWNrXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9jYWxsYmFja1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tYXV0aG9yaXplXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L2F1dGhvcml6ZVxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvYXV0aG9yaXplXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb24gLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb24nXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLWp3a3NcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvblxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvYWNzXCJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tYWNzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL2Fjc1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1zc28tbWV0YWRhdGFcbiAgICB1cmw6IFwiaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9zc28vc2FtbC9tZXRhZGF0YVwiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgIC0gL3Nzby9zYW1sL21ldGFkYXRhXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIFNlY3VyZSBBdXRoIHJvdXRlc1xuICAtIG5hbWU6IGF1dGgtdjFcbiAgICBfY29tbWVudDogJ0dvVHJ1ZTogL2F1dGgvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5LyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUkVTVCByb3V0ZXNcbiAgLSBuYW1lOiByZXN0LXYxXG4gICAgX2NvbW1lbnQ6ICdQb3N0Z1JFU1Q6IC9yZXN0L3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlc3QtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVzdC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIEdyYXBoUUwgcm91dGVzXG4gIC0gbmFtZTogZ3JhcGhxbC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvZ3JhcGhxbC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvcnBjL2dyYXBocWwnXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBncmFwaHFsLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2dyYXBocWwvdjFcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJDb250ZW50LVByb2ZpbGU6IGdyYXBocWxfcHVibGljXCJcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBSZWFsdGltZSByb3V0ZXNcbiAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS8qIC0+IHdzOi8vcmVhbHRpbWU6NDAwMC9zb2NrZXQvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9zb2NrZXRcbiAgICBwcm90b2NvbDogd3NcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXdzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvcmVhbHRpbWUvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgcXVlcnlzdHJpbmc6XG4gICAgICAgICAgICAgIC0gXCJhcGlrZXk6ICRMVUFfUlRfV1NfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgIF9jb21tZW50OiAnUmVhbHRpbWU6IC9yZWFsdGltZS92MS9hcGkvKiAtPiBodHRwOi8vcmVhbHRpbWU6NDAwMC9hcGkvKidcbiAgICB1cmw6IGh0dHA6Ly9yZWFsdGltZS1kZXY6NDAwMC9hcGlcbiAgICBwcm90b2NvbDogaHR0cFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogcmVhbHRpbWUtdjEtcmVzdFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL2FwaVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAgICAgcmVwbGFjZTpcbiAgICAgICAgICAgIGhlYWRlcnM6XG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTdG9yYWdlIEFQSSBlbmRwb2ludFxuICAjIyBObyBrZXktYXV0aCAtIFMzIHByb3RvY29sIHJlcXVlc3RzIGRvbid0IGNhcnJ5IGFuIGFwaWtleSBoZWFkZXIuXG4gIC0gbmFtZTogc3RvcmFnZS12MVxuICAgIF9jb21tZW50OiAnU3RvcmFnZTogL3N0b3JhZ2UvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwLyonXG4gICAgY29ubmVjdF90aW1lb3V0OiAkS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVFxuICAgIHdyaXRlX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVFxuICAgIHJlYWRfdGltZW91dDogJEtPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVRcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdG9yYWdlOjUwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBzdG9yYWdlLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3N0b3JhZ2UvdjEvXG4gICAgICAgIHJlcXVlc3RfYnVmZmVyaW5nOiAkS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HXG4gICAgICAgIHJlc3BvbnNlX2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkdcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IHBvc3QtZnVuY3Rpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFjY2VzczpcbiAgICAgICAgICAgIC0gfFxuICAgICAgICAgICAgICBsb2NhbCBhdXRoID0ga29uZy5yZXF1ZXN0LmdldF9oZWFkZXIoXCJhdXRob3JpemF0aW9uXCIpXG4gICAgICAgICAgICAgIGlmIGF1dGggPT0gbmlsIG9yIGF1dGggPT0gXCJcIiBvciBhdXRoOmZpbmQoXCJeJXMqJFwiKSB0aGVuXG4gICAgICAgICAgICAgICAga29uZy5zZXJ2aWNlLnJlcXVlc3QuY2xlYXJfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBlbmRcblxuICAjIyBFZGdlIEZ1bmN0aW9ucyByb3V0ZXNcbiAgLSBuYW1lOiBmdW5jdGlvbnMtdjFcbiAgICBfY29tbWVudDogJ0VkZ2UgRnVuY3Rpb25zOiAvZnVuY3Rpb25zL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOjkwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwL1xuICAgIHJlYWRfdGltZW91dDogMTUwMDAwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBmdW5jdGlvbnMtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvZnVuY3Rpb25zL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBPQXV0aCAyLjAgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgTWV0YWRhdGEgKFJGQyA4NDE0KVxuICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICBfY29tbWVudDogJ0F1dGg6IC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlciAtPiBodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5Ly53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogd2VsbC1rbm93bi1vYXV0aFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gLy53ZWxsLWtub3duL29hdXRoLWF1dGhvcml6YXRpb24tc2VydmVyXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuXG4gICMjIEFuYWx5dGljcyByb3V0ZXNcbiAgIyMgTm90IHVzZWQgLSBTdHVkaW8gYW5kIFZlY3RvciB0YWxrIGRpcmVjdGx5IHRvIGFuYWx5dGljcyB2aWEgRG9ja2VyIG5ldHdvcmtpbmcuXG4gICMgLSBuYW1lOiBhbmFseXRpY3MtdjFcbiAgIyAgIF9jb21tZW50OiAnQW5hbHl0aWNzOiAvYW5hbHl0aWNzL3YxLyogLT4gaHR0cDovL2xvZ2ZsYXJlOjQwMDAvKidcbiAgIyAgIHVybDogaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL1xuICAjICAgcm91dGVzOlxuICAjICAgICAtIG5hbWU6IGFuYWx5dGljcy12MS1hbGxcbiAgIyAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICMgICAgICAgcGF0aHM6XG4gICMgICAgICAgICAtIC9hbmFseXRpY3MvdjEvXG5cbiAgIyMgU2VjdXJlIERhdGFiYXNlIHJvdXRlc1xuICAtIG5hbWU6IG1ldGFcbiAgICBfY29tbWVudDogJ3BnLW1ldGE6IC9wZy8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtZXRhLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3BnL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuXG4gICMjIEJsb2NrIGFjY2VzcyB0byAvYXBpL21jcFxuICAtIG5hbWU6IG1jcC1ibG9ja2VyXG4gICAgX2NvbW1lbnQ6ICdCbG9jayBkaXJlY3QgYWNjZXNzIHRvIC9hcGkvbWNwJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3BcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IG1jcC1ibG9ja2VyLXJvdXRlXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXBpL21jcFxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcblxuICAjIyBNQ1AgZW5kcG9pbnQgLSBsb2NhbCBhY2Nlc3NcbiAgLSBuYW1lOiBtY3BcbiAgICBfY29tbWVudDogJ01DUDogL21jcCAtPiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcCAobG9jYWwgYWNjZXNzKSdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3BcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgIyBCbG9jayBhY2Nlc3MgdG8gL21jcCBieSBkZWZhdWx0XG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdGVybWluYXRpb25cbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIHN0YXR1c19jb2RlOiA0MDNcbiAgICAgICAgICBtZXNzYWdlOiBcIkFjY2VzcyBpcyBmb3JiaWRkZW4uXCJcbiAgICAgICMgRW5hYmxlIGxvY2FsIGFjY2VzcyAoZGFuZ2VyIHpvbmUhKVxuICAgICAgIyAxLiBDb21tZW50IG91dCB0aGUgJ3JlcXVlc3QtdGVybWluYXRpb24nIHNlY3Rpb24gYWJvdmVcbiAgICAgICMgMi4gVW5jb21tZW50IHRoZSBlbnRpcmUgc2VjdGlvbiBiZWxvdywgaW5jbHVkaW5nICdkZW55J1xuICAgICAgIyAzLiBBZGQgeW91ciBsb2NhbCBJUHMgdG8gdGhlICdhbGxvdycgbGlzdFxuICAgICAgIy0gbmFtZTogY29yc1xuICAgICAgIy0gbmFtZTogaXAtcmVzdHJpY3Rpb25cbiAgICAgICMgIGNvbmZpZzpcbiAgICAgICMgICAgYWxsb3c6XG4gICAgICAjICAgICAgLSAxMjcuMC4wLjFcbiAgICAgICMgICAgICAtIDo6MVxuICAgICAgIyAgICBkZW55OiBbXVxuXG4gICMjIFByb3RlY3RlZCBEYXNoYm9hcmQgLSBjYXRjaCBhbGwgcmVtYWluaW5nIHJvdXRlc1xuICAtIG5hbWU6IGRhc2hib2FyZFxuICAgIF9jb21tZW50OiAnU3R1ZGlvOiAvKiAtPiBodHRwOi8vc3R1ZGlvOjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGRhc2hib2FyZC1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGJhc2ljLWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IHRydWVcbiIKICBzdXBhYmFzZS1zdHVkaW86CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0dWRpbzoyMDI2LjAzLjE2LXNoYS01NTI4ODE3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5vZGUKICAgICAgICAtICctZScKICAgICAgICAtICJmZXRjaCgnaHR0cDovLzEyNy4wLjAuMTozMDAwL2FwaS9wbGF0Zm9ybS9wcm9maWxlJykudGhlbigocikgPT4ge2lmIChyLnN0YXR1cyAhPT0gMjAwKSB0aHJvdyBuZXcgRXJyb3Ioci5zdGF0dXMpfSkiCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAzCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIEhPU1ROQU1FPTAuMC4wLjAKICAgICAgLSAnU1RVRElPX1BHX01FVEFfVVJMPWh0dHA6Ly9zdXBhYmFzZS1tZXRhOjgwODAnCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1Q9JHtQT1NUR1JFU19IT1NUOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ1BPU1RHUkVTX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSAnREVGQVVMVF9PUkdBTklaQVRJT05fTkFNRT0ke1NUVURJT19ERUZBVUxUX09SR0FOSVpBVElPTjotRGVmYXVsdCBPcmdhbml6YXRpb259JwogICAgICAtICdERUZBVUxUX1BST0pFQ1RfTkFNRT0ke1NUVURJT19ERUZBVUxUX1BST0pFQ1Q6LURlZmF1bHQgUHJvamVjdH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnU1VQQUJBU0VfQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTVVBBQkFTRV9TRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdfTUVUQV9DUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogICAgICAtICdMT0dGTEFSRV9BUElfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFJJVkFURV9BQ0NFU1NfVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFUFJJVkFURX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1VSTD1odHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAnCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJyZWFsdGltZS1kZXZcIiknXG4gICAgICBzdG9yYWdlOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2Utc3RvcmFnZVwiKSdcbiAgICAgIGZ1bmN0aW9uczogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zXCIpJ1xuICAgICAgZGI6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1kYlwiKSdcbiAgIyBJZ25vcmVzIG5vbiBuZ2lueCBlcnJvcnMgc2luY2UgdGhleSBhcmUgcmVsYXRlZCB3aXRoIGtvbmcgYm9vdGluZyB1cFxuICBrb25nX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgcmVxLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiY29tYmluZWRcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcmVxLnRpbWVzdGFtcFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMucmVmZXJlciA9IHJlcS5yZWZlcmVyXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy51c2VyX2FnZW50ID0gcmVxLmFnZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcmVxLmNsaWVudFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IHJlcS5zdGF0dXNcbiAgICAgICAgICB1cmwsIHNwbGl0X2VyciA9IHNwbGl0KHJlcS5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBzcGxpdF9lcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfZXJyOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIua29uZ1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IFwiR0VUXCJcbiAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IDIwMFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiZXJyb3JcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcGFyc2VkLnRpbWVzdGFtcFxuICAgICAgICAgIC5zZXZlcml0eSA9IHBhcnNlZC5zZXZlcml0eVxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lmhvc3QgPSBwYXJzZWQuaG9zdFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMuY2ZfY29ubmVjdGluZ19pcCA9IHBhcnNlZC5jbGllbnRcbiAgICAgICAgICB1cmwsIGVyciA9IHNwbGl0KHBhcnNlZC5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIEdvdHJ1ZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIGpzb24gc3RyaW5ncyB3aGljaCBmcm9udGVuZCBwYXJzZXMgZGlyZWN0bHkuIEJ1dCB3ZSBrZWVwIG1ldGFkYXRhIGZvciBjb25zaXN0ZW5jeS5cbiAgYXV0aF9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuYXV0aFxuICAgIHNvdXJjZTogfC1cbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEgPSBtZXJnZSEoLm1ldGFkYXRhLCBwYXJzZWQpXG4gICAgICB9XG4gICMgUG9zdGdSRVNUIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2Ugc2VwYXJhdGUgdGltZXN0YW1wIGZyb20gbWVzc2FnZSB1c2luZyByZWdleFxuICByZXN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZXN0XG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+LiopOiAoP1A8bXNnPi4qKSQnKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZV90aW1lc3RhbXAhKHZhbHVlOiBwYXJzZWQudGltZSwgZm9ybWF0OiBcIiVkLyViLyVZOiVIOiVNOiVTICV6XCIpXG4gICAgICAgICAgLm1ldGFkYXRhLmhvc3QgPSAucHJvamVjdFxuICAgICAgfVxuICAjIEZpbHRlciBvdXQgaGVhbHRoY2hlY2sgbG9ncyBmcm9tIFJlYWx0aW1lXG4gIHJlYWx0aW1lX2xvZ3NfZmlsdGVyZWQ6XG4gICAgdHlwZTogZmlsdGVyXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIucmVhbHRpbWVcbiAgICBjb25kaXRpb246ICchY29udGFpbnMoc3RyaW5nISguZXZlbnRfbWVzc2FnZSksIFwiL2hlYWx0aFwiKSdcbiAgIyBSZWFsdGltZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIHNvIHdlIHBhcnNlIHRoZSBzZXZlcml0eSBsZXZlbCB1c2luZyByZWdleCAoaWdub3JlIHRpbWUgYmVjYXVzZSBpdCBoYXMgbm8gZGF0ZSlcbiAgcmVhbHRpbWVfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc19maWx0ZXJlZFxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLmV4dGVybmFsX2lkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfcmVnZXgoLmV2ZW50X21lc3NhZ2UsIHInXig/UDx0aW1lPlxcZCs6XFxkKzpcXGQrXFwuXFxkKykgXFxbKD9QPGxldmVsPlxcdyspXFxdICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLm1ldGFkYXRhLmxldmVsID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICMgU3RvcmFnZSBsb2dzIG1heSBjb250YWluIGpzb24gb2JqZWN0cyBzbyB3ZSBwYXJzZSB0aGVtIGZvciBjb21wbGV0ZW5lc3NcbiAgc3RvcmFnZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuc3RvcmFnZVxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLnRlbmFudElkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5ob3N0ID0gcGFyc2VkLmhvc3RuYW1lXG4gICAgICAgICAgLm1ldGFkYXRhLmNvbnRleHRbMF0ucGlkID0gcGFyc2VkLnBpZFxuICAgICAgfVxuICAjIEZ1bmN0aW9uIGxvZ3MgYXJlIHVuc3RydWN0dXJlZCBtZXNzYWdlcyBvbiBzdGRlcnJcbiAgZnVuY3Rpb25zX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5mdW5jdGlvbnNcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEucHJvamVjdF9yZWYgPSBkZWwoLnByb2plY3QpXG4gICMgUG9zdGdyZXMgbG9ncyBzb21lIG1lc3NhZ2VzIHRvIHN0ZGVyciB3aGljaCB3ZSBtYXAgdG8gd2FybmluZyBzZXZlcml0eSBsZXZlbFxuICBkYl9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuZGJcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEuaG9zdCA9IFwiZGItZGVmYXVsdFwiXG4gICAgICAubWV0YWRhdGEucGFyc2VkLnRpbWVzdGFtcCA9IC50aW1lc3RhbXBcblxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcicuKig/UDxsZXZlbD5JTkZPfE5PVElDRXxXQVJOSU5HfEVSUk9SfExPR3xGQVRBTHxQQU5JQz8pOi4qJywgbnVtZXJpY19ncm91cHM6IHRydWUpXG5cbiAgICAgIGlmIGVyciAhPSBudWxsIHx8IHBhcnNlZCA9PSBudWxsIHtcbiAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwiaW5mb1wiXG4gICAgICB9XG4gICAgICBpZiBwYXJzZWQubGV2ZWwgIT0gbnVsbCB7XG4gICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHBhcnNlZC5sZXZlbFxuICAgICAgfVxuICAgICAgaWYgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9PSBcImluZm9cIiB7XG4gICAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwibG9nXCJcbiAgICAgIH1cbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkgPSB1cGNhc2UhKC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkpXG5cbnNpbmtzOlxuICBsb2dmbGFyZV9hdXRoOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gYXV0aF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1nb3RydWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZWFsdGltZTpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlYWx0aW1lX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXJlYWx0aW1lLmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfcmVzdDpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlc3RfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cG9zdGdSRVNULmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfZGI6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBkYl9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z3Jlcy5sb2dzJ1xuICBsb2dmbGFyZV9mdW5jdGlvbnM6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBmdW5jdGlvbnNfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9ZGVuby1yZWxheS1sb2dzJ1xuICBsb2dmbGFyZV9zdG9yYWdlOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gc3RvcmFnZV9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1zdG9yYWdlLmxvZ3MucHJvZC4yJ1xuICBsb2dmbGFyZV9rb25nOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0ga29uZ19sb2dzXG4gICAgICAtIGtvbmdfZXJyXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1jbG91ZGZsYXJlLmxvZ3MucHJvZCdcbiIKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2V0Yy92ZWN0b3IvdmVjdG9yLnltbAogIHN1cGFiYXNlLXJlc3Q6CiAgICBpbWFnZTogJ3Bvc3RncmVzdC9wb3N0Z3Jlc3Q6djE0LjYnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQR1JTVF9EQl9VUkk9cG9zdGdyZXM6Ly9hdXRoZW50aWNhdG9yOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSBQR1JTVF9EQl9BTk9OX1JPTEU9YW5vbgogICAgICAtICdQR1JTVF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFBHUlNUX0RCX1VTRV9MRUdBQ1lfR1VDUz1mYWxzZQogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdSU1RfQVBQX1NFVFRJTkdTX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgIGNvbW1hbmQ6IHBvc3RncmVzdAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgc3VwYWJhc2UtYXV0aDoKICAgIGltYWdlOiAnc3VwYWJhc2UvZ290cnVlOnYyLjE4Ni4wJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSAnQVBJX0VYVEVSTkFMX1VSTD0ke0FQSV9FWFRFUk5BTF9VUkw6LWh0dHA6Ly9zdXBhYmFzZS1rb25nOjgwMDB9JwogICAgICAtIEdPVFJVRV9EQl9EUklWRVI9cG9zdGdyZXMKICAgICAgLSAnR09UUlVFX0RCX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovL3N1cGFiYXNlX2F1dGhfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD0ke0dPVFJVRV9TSVRFX1VSTDotJHtTRVJWSUNFX1VSTF9TVVBBQkFTRUtPTkd9fScKICAgICAgLSAnR09UUlVFX1VSSV9BTExPV19MSVNUPSR7QURESVRJT05BTF9SRURJUkVDVF9VUkxTfScKICAgICAgLSAnR09UUlVFX0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSBHT1RSVUVfSldUX0FETUlOX1JPTEVTPXNlcnZpY2Vfcm9sZQogICAgICAtIEdPVFJVRV9KV1RfQVVEPWF1dGhlbnRpY2F0ZWQKICAgICAgLSBHT1RSVUVfSldUX0RFRkFVTFRfR1JPVVBfTkFNRT1hdXRoZW50aWNhdGVkCiAgICAgIC0gJ0dPVFJVRV9KV1RfRVhQPSR7SldUX0VYUElSWTotMzYwMH0nCiAgICAgIC0gJ0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfRU1BSUxfRU5BQkxFRD0ke0VOQUJMRV9FTUFJTF9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfQU5PTllNT1VTX1VTRVJTX0VOQUJMRUQ9JHtFTkFCTEVfQU5PTllNT1VTX1VTRVJTOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfQVVUT0NPTkZJUk09JHtFTkFCTEVfRU1BSUxfQVVUT0NPTkZJUk06LWZhbHNlfScKICAgICAgLSAnR09UUlVFX1NNVFBfQURNSU5fRU1BSUw9JHtTTVRQX0FETUlOX0VNQUlMfScKICAgICAgLSAnR09UUlVFX1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1VTRVI9JHtTTVRQX1VTRVJ9JwogICAgICAtICdHT1RSVUVfU01UUF9QQVNTPSR7U01UUF9QQVNTfScKICAgICAgLSAnR09UUlVFX1NNVFBfU0VOREVSX05BTUU9JHtTTVRQX1NFTkRFUl9OQU1FfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19JTlZJVEU9JHtNQUlMRVJfVVJMUEFUSFNfSU5WSVRFOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT046LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk9JHtNQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfSU5WSVRFPSR7TUFJTEVSX1RFTVBMQVRFU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT049JHtNQUlMRVJfVEVNUExBVEVTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX1JFQ09WRVJZPSR7TUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTks9JHtNQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0U9JHtNQUlMRVJfVEVNUExBVEVTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUlk9JHtNQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTks9JHtNQUlMRVJfU1VCSkVDVFNfTUFHSUNfTElOS30nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfSU5WSVRFPSR7TUFJTEVSX1NVQkpFQ1RTX0lOVklURX0nCiAgICAgIC0gJ0dPVFJVRV9FWFRFUk5BTF9QSE9ORV9FTkFCTEVEPSR7RU5BQkxFX1BIT05FX1NJR05VUDotdHJ1ZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVNfQVVUT0NPTkZJUk09JHtFTkFCTEVfUEhPTkVfQVVUT0NPTkZJUk06LXRydWV9JwogIHJlYWx0aW1lLWRldjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcmVhbHRpbWU6djIuNzYuNScKICAgIGNvbnRhaW5lcl9uYW1lOiByZWFsdGltZS1kZXYuc3VwYWJhc2UtcmVhbHRpbWUKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctc1NmTCcKICAgICAgICAtICctLWhlYWQnCiAgICAgICAgLSAnLW8nCiAgICAgICAgLSAvZGV2L251bGwKICAgICAgICAtICctSCcKICAgICAgICAtICdBdXRob3JpemF0aW9uOiBCZWFyZXIgJHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9hcGkvdGVuYW50cy9yZWFsdGltZS1kZXYvaGVhbHRoJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9SVD00MDAwCiAgICAgIC0gJ0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdEQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gREJfVVNFUj1zdXBhYmFzZV9hZG1pbgogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnREJfQUZURVJfQ09OTkVDVF9RVUVSWT1TRVQgc2VhcmNoX3BhdGggVE8gX3JlYWx0aW1lJwogICAgICAtIERCX0VOQ19LRVk9c3VwYWJhc2VyZWFsdGltZQogICAgICAtICdBUElfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU0VDUkVUX0tFWV9CQVNFPSR7U0VSVklDRV9QQVNTV09SRF82NF9SRUFMVElNRX0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAiRE5TX05PREVTPScnIgogICAgICAtIFJMSU1JVF9OT0ZJTEU9MTAwMDAKICAgICAgLSBBUFBfTkFNRT1yZWFsdGltZQogICAgICAtIFNFRURfU0VMRl9IT1NUPXRydWUKICAgICAgLSBMT0dfTEVWRUw9ZXJyb3IKICAgICAgLSBSVU5fSkFOSVRPUj10cnVlCiAgICAgIC0gSkFOSVRPUl9JTlRFUlZBTD02MDAwMAogICAgICAtIERJU0FCTEVfSEVBTFRIQ0hFQ0tfTE9HR0lORz10cnVlCiAgICBjb21tYW5kOiAic2ggLWMgXCIvYXBwL2Jpbi9taWdyYXRlICYmIC9hcHAvYmluL3JlYWx0aW1lIGV2YWwgJ1JlYWx0aW1lLlJlbGVhc2Uuc2VlZHMoUmVhbHRpbWUuUmVwbyknICYmIC9hcHAvYmluL3NlcnZlclwiXG4iCiAgc3VwYWJhc2UtbWluaW86CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBjb21tYW5kOiAnc2VydmVyIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSIgL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovZGF0YScKICBtaW5pby1jcmVhdGVidWNrZXQ6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIHJlc3RhcnQ6ICdubycKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1taW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDoKICAgICAgLSAvZW50cnlwb2ludC5zaAogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vZW50cnlwb2ludC5zaAogICAgICAgIHRhcmdldDogL2VudHJ5cG9pbnQuc2gKICAgICAgICBjb250ZW50OiAiIyEvYmluL3NoXG4vdXNyL2Jpbi9tYyBhbGlhcyBzZXQgc3VwYWJhc2UtbWluaW8gaHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAgJHtNSU5JT19ST09UX1VTRVJ9ICR7TUlOSU9fUk9PVF9QQVNTV09SRH07XG4vdXNyL2Jpbi9tYyBtYiAtLWlnbm9yZS1leGlzdGluZyBzdXBhYmFzZS1taW5pby9zdHViO1xuZXhpdCAwXG4iCiAgc3VwYWJhc2Utc3RvcmFnZToKICAgIGltYWdlOiAnc3VwYWJhc2Uvc3RvcmFnZS1hcGk6djEuNDQuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLXJlc3Q6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgICAgaW1ncHJveHk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjUwMDAvc3RhdHVzJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVkVSX1BPUlQ9NTAwMAogICAgICAtIFNFUlZFUl9SRUdJT049bG9jYWwKICAgICAgLSBNVUxUSV9URU5BTlQ9ZmFsc2UKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly9zdXBhYmFzZV9zdG9yYWdlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtIERCX0lOU1RBTExfUk9MRVM9ZmFsc2UKICAgICAgLSBTVE9SQUdFX0JBQ0tFTkQ9czMKICAgICAgLSBTVE9SQUdFX1MzX0JVQ0tFVD1zdHViCiAgICAgIC0gJ1NUT1JBR0VfUzNfRU5EUE9JTlQ9aHR0cDovL3N1cGFiYXNlLW1pbmlvOjkwMDAnCiAgICAgIC0gU1RPUkFHRV9TM19GT1JDRV9QQVRIX1NUWUxFPXRydWUKICAgICAgLSBTVE9SQUdFX1MzX1JFR0lPTj11cy1lYXN0LTEKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9GSUxFX1NJWkVfTElNSVRfU1RBTkRBUkQ9NTI0Mjg4MDAwCiAgICAgIC0gVVBMT0FEX1NJR05FRF9VUkxfRVhQSVJBVElPTl9USU1FPTEyMAogICAgICAtIFRVU19VUkxfUEFUSD0vdXBsb2FkL3Jlc3VtYWJsZQogICAgICAtIFRVU19NQVhfU0laRT0zNjAwMDAwCiAgICAgIC0gRU5BQkxFX0lNQUdFX1RSQU5TRk9STUFUSU9OPXRydWUKICAgICAgLSAnSU1HUFJPWFlfVVJMPWh0dHA6Ly9pbWdwcm94eTo4MDgwJwogICAgICAtIElNR1BST1hZX1JFUVVFU1RfVElNRU9VVD0xNQogICAgICAtIERBVEFCQVNFX1NFQVJDSF9QQVRIPXN0b3JhZ2UKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gUkVRVUVTVF9BTExPV19YX0ZPUldBUkRFRF9QQVRIPXRydWUKICAgICAgLSAnQU5PTl9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAtICdTRVJWSUNFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1BPU1RHUkVTVF9VUkw9aHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMCcKICAgICAgLSAnUEdSU1RfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU1RPUkFHRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9VUkxfU1VQQUJBU0VLT05HfScKICAgICAgLSAnVEVOQU5UX0lEPSR7U1RPUkFHRV9URU5BTlRfSUQ6LXN0b3JhZ2Utc2luZ2xlLXRlbmFudH0nCiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIGltZ3Byb3h5OgogICAgaW1hZ2U6ICdkYXJ0aHNpbS9pbWdwcm94eTp2My4zMC4xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGltZ3Byb3h5CiAgICAgICAgLSBoZWFsdGgKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdJTUdQUk9YWV9CSU5EPTo4MDgwJwogICAgICAtIElNR1BST1hZX0xPQ0FMX0ZJTEVTWVNURU1fUk9PVD0vCiAgICAgIC0gSU1HUFJPWFlfVVNFX0VUQUc9dHJ1ZQogICAgICAtICdJTUdQUk9YWV9BVVRPX1dFQlA9JHtJTUdQUk9YWV9BVVRPX1dFQlA6LXRydWV9JwogICAgICAtIElNR1BST1hZX01BWF9TUkNfUkVTT0xVVElPTj0xNi44CiAgICB2b2x1bWVzOgogICAgICAtICcuL3ZvbHVtZXMvc3RvcmFnZTovdmFyL2xpYi9zdG9yYWdlJwogIHN1cGFiYXNlLW1ldGE6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3Bvc3RncmVzLW1ldGE6djAuOTUuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUEdfTUVUQV9QT1JUPTgwODAKICAgICAgLSAnUEdfTUVUQV9EQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUEdfTUVUQV9EQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHX01FVEFfREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUEdfTUVUQV9EQl9VU0VSPXN1cGFiYXNlX2FkbWluCiAgICAgIC0gJ1BHX01FVEFfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnQ1JZUFRPX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfUEdNRVRBQ1JZUFRPfScKICBzdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczoKICAgIGltYWdlOiAnc3VwYWJhc2UvZWRnZS1ydW50aW1lOnYxLjcxLjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnRWRnZSBGdW5jdGlvbnMgaXMgaGVhbHRoeScKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfVVJMX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvaGVsbG8vaW5kZXgudHMKICAgICAgICBjb250ZW50OiAiLy8gRm9sbG93IHRoaXMgc2V0dXAgZ3VpZGUgdG8gaW50ZWdyYXRlIHRoZSBEZW5vIGxhbmd1YWdlIHNlcnZlciB3aXRoIHlvdXIgZWRpdG9yOlxuLy8gaHR0cHM6Ly9kZW5vLmxhbmQvbWFudWFsL2dldHRpbmdfc3RhcnRlZC9zZXR1cF95b3VyX2Vudmlyb25tZW50XG4vLyBUaGlzIGVuYWJsZXMgYXV0b2NvbXBsZXRlLCBnbyB0byBkZWZpbml0aW9uLCBldGMuXG5cbkRlbm8uc2VydmUoYXN5bmMgKCkgPT4ge1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKFxuICAgIGBcIkhlbGxvIGZyb20gRWRnZSBGdW5jdGlvbnMhXCJgLFxuICAgIHsgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9IH0sXG4gIClcbn0pXG5cbi8vIFRvIGludm9rZTpcbi8vIGN1cmwgJ2h0dHA6Ly9sb2NhbGhvc3Q6PEtPTkdfSFRUUF9QT1JUPi9mdW5jdGlvbnMvdjEvaGVsbG8nIFxcXG4vLyAgIC0taGVhZGVyICdBdXRob3JpemF0aW9uOiBCZWFyZXIgPGFub24vc2VydmljZV9yb2xlIEFQSSBrZXk+J1xuIgogICAgY29tbWFuZDoKICAgICAgLSBzdGFydAogICAgICAtICctLW1haW4tc2VydmljZScKICAgICAgLSAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9tYWluCiAgc3VwYWJhc2Utc3VwYXZpc29yOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdXBhdmlzb3I6Mi43LjQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9PTEVSX1RFTkFOVF9JRD0ke1BPT0xFUl9URU5BTlRfSUQ6LWRldl90ZW5hbnR9JwogICAgICAtIFBPT0xFUl9QT09MX01PREU9dHJhbnNhY3Rpb24KICAgICAgLSAnUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFPSR7UE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFOi0yMH0nCiAgICAgIC0gJ1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk49JHtQT09MRVJfTUFYX0NMSUVOVF9DT05OOi0xMDB9JwogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1ROQU1FPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9ZWN0bzovL3N1cGFiYXNlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vX3N1cGFiYXNlJwogICAgICAtIENMVVNURVJfUE9TVEdSRVM9dHJ1ZQogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRVJWSUNFX1BBU1NXT1JEX1NVUEFWSVNPUlNFQ1JFVH0nCiAgICAgIC0gJ1ZBVUxUX0VOQ19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1ZBVUxURU5DfScKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSBSRUdJT049bG9jYWwKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAnREJfUE9PTF9TSVpFPSR7UE9PTEVSX0RCX1BPT0xfU0laRTotNX0nCiAgICAgIC0gR0xPQkFMX0RPV05TVFJFQU1fQ0VSVF9QQVRIPS9ldGMvc3NsL3NlcnZlci5jcnQKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9LRVlfUEFUSD0vZXRjL3NzbC9zZXJ2ZXIua2V5CiAgICBjb21tYW5kOgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICAgIC0gImlmIFsgISAtZiAvZXRjL3NzbC9zZXJ2ZXIuY3J0IF07IHRoZW5cbiAgb3BlbnNzbCByZXEgLXg1MDkgLW5vZGVzIC1kYXlzIDM2NTAgLW5ld2tleSByc2E6MjA0OCBcXFxuICAgIC1rZXlvdXQgL2V0Yy9zc2wvc2VydmVyLmtleSAtb3V0IC9ldGMvc3NsL3NlcnZlci5jcnQgXFxcbiAgICAtc3ViaiBcIi9DTj1zdXBhYmFzZS1wb29sZXJcIlxuZmlcbi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vc3VwYXZpc29yIGV2YWwgXCIkJChjYXQgL2V0Yy9wb29sZXIvcG9vbGVyLmV4cylcIiAmJiAvYXBwL2Jpbi9zZXJ2ZXJcbiIKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICB0YXJnZXQ6IC9ldGMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICBjb250ZW50OiAiezpvaywgX30gPSBBcHBsaWNhdGlvbi5lbnN1cmVfYWxsX3N0YXJ0ZWQoOnN1cGF2aXNvcilcbns6b2ssIHZlcnNpb259ID1cbiAgICBjYXNlIFN1cGF2aXNvci5SZXBvLnF1ZXJ5IShcInNlbGVjdCB2ZXJzaW9uKClcIikgZG9cbiAgICAle3Jvd3M6IFtbdmVyXV19IC0+IFN1cGF2aXNvci5IZWxwZXJzLnBhcnNlX3BnX3ZlcnNpb24odmVyKVxuICAgIF8gLT4gbmlsXG4gICAgZW5kXG5wYXJhbXMgPSAle1xuICAgIFwiZXh0ZXJuYWxfaWRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9URU5BTlRfSURcIiksXG4gICAgXCJkYl9ob3N0XCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19IT1NUTkFNRVwiKSxcbiAgICBcImRiX3BvcnRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BPUlRcIikgfD4gU3RyaW5nLnRvX2ludGVnZXIoKSxcbiAgICBcImRiX2RhdGFiYXNlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19EQlwiKSxcbiAgICBcInJlcXVpcmVfdXNlclwiID0+IGZhbHNlLFxuICAgIFwiYXV0aF9xdWVyeVwiID0+IFwiU0VMRUNUICogRlJPTSBwZ2JvdW5jZXIuZ2V0X2F1dGgoJDEpXCIsXG4gICAgXCJkZWZhdWx0X21heF9jbGllbnRzXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfTUFYX0NMSUVOVF9DT05OXCIpLFxuICAgIFwiZGVmYXVsdF9wb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImRlZmF1bHRfcGFyYW1ldGVyX3N0YXR1c1wiID0+ICV7XCJzZXJ2ZXJfdmVyc2lvblwiID0+IHZlcnNpb259LFxuICAgIFwidXNlcnNcIiA9PiBbJXtcbiAgICBcImRiX3VzZXJcIiA9PiBcInBnYm91bmNlclwiLFxuICAgIFwiZGJfcGFzc3dvcmRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BBU1NXT1JEXCIpLFxuICAgIFwibW9kZV90eXBlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfUE9PTF9NT0RFXCIpLFxuICAgIFwicG9vbF9zaXplXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfREVGQVVMVF9QT09MX1NJWkVcIiksXG4gICAgXCJpc19tYW5hZ2VyXCIgPT4gdHJ1ZVxuICAgIH1dXG59XG5cbnRlbmFudCA9IFN1cGF2aXNvci5UZW5hbnRzLmdldF90ZW5hbnRfYnlfZXh0ZXJuYWxfaWQocGFyYW1zW1wiZXh0ZXJuYWxfaWRcIl0pXG5cbmlmIHRlbmFudCBkb1xuICB7Om9rLCBffSA9IFN1cGF2aXNvci5UZW5hbnRzLnVwZGF0ZV90ZW5hbnQodGVuYW50LCBwYXJhbXMpXG5lbHNlXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMuY3JlYXRlX3RlbmFudChwYXJhbXMpXG5lbmRcbiIK",
         "tags": [
             "firebase",
             "alternative",
@@ -5299,7 +5386,7 @@
         "category": "backend",
         "logo": "svgs/supabase.svg",
         "minversion": "4.0.0-beta.228",
-        "template_last_updated_at": "2026-04-05T20:21:11+02:00",
+        "template_last_updated_at": "2026-10-15T23:15:19+02:00",
         "port": "8000"
     },
     "superset-with-postgresql": {
diff --git a/templates/service-templates.json b/templates/service-templates.json
index 778dd2597a..72aaa96e09 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -112,7 +112,7 @@
     "appflowy": {
         "documentation": "https://docs.appflowy.io/docs/documentation/appflowy-cloud?utm_source=coolify.io",
         "slogan": "AppFlowy is the AI collaborative workspace where you achieve more without losing control of your data.",
-        "compose": "c2VydmljZXM6CiAgbmdpbng6CiAgICBpbWFnZTogJ25naW54OjEuMjkuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BRE1JTgogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vbmdpbngvbmdpbnguY29uZgogICAgICAgIHRhcmdldDogL2V0Yy9uZ2lueC9uZ2lueC5jb25mCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIiMgUGxlYXNlIGRvIG5vdCBkaXJlY3RseSBlZGl0IHRoaXMgZmlsZS5cblxuZXJyb3JfbG9nICAvdmFyL2xvZy9uZ2lueC9lcnJvci5sb2cgbm90aWNlO1xucGlkICAgICAgICAvdmFyL3J1bi9uZ2lueC5waWQ7XG5cblxuZXZlbnRzIHtcbiAgICB3b3JrZXJfY29ubmVjdGlvbnMgIDEwMjQ7XG59XG5cblxuaHR0cCB7XG4gICAgcmVzb2x2ZXIgMTI3LjAuMC4xMSB2YWxpZD0xMHM7XG4gICAgbWFwICRodHRwX3VwZ3JhZGUgJGNvbm5lY3Rpb25fdXBncmFkZSB7XG4gICAgICAgIGRlZmF1bHQgdXBncmFkZTtcbiAgICAgICAgJycgY2xvc2U7XG4gICAgfVxuXG4gICAgc2VydmVyIHtcbiAgICAgICAgbGlzdGVuIDgwO1xuICAgICAgICBjbGllbnRfbWF4X2JvZHlfc2l6ZSAxME07XG4gICAgICAgIHVuZGVyc2NvcmVzX2luX2hlYWRlcnMgb247XG5cbiAgICAgICAgIyBCYWNrZW5kIHNlcnZpY2VzXG4gICAgICAgIHNldCAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZCBcImh0dHA6Ly9hcHBmbG93eV9jbG91ZDo4MDAwXCI7XG4gICAgICAgIHNldCAkZ290cnVlX2JhY2tlbmQgXCJodHRwOi8vZ290cnVlOjk5OTlcIjtcbiAgICAgICAgc2V0ICRhZG1pbl9mcm9udGVuZF9iYWNrZW5kIFwiaHR0cDovL2FkbWluX2Zyb250ZW5kOjMwMDBcIjtcbiAgICAgICAgIyBHb1RydWUgQXV0aGVudGljYXRpb24gU2VydmljZVxuICAgICAgICBsb2NhdGlvbiAvZ290cnVlLyB7XG4gICAgICAgICAgICBwcm94eV9wYXNzICRnb3RydWVfYmFja2VuZDtcblxuICAgICAgICAgICAgcmV3cml0ZSBeL2dvdHJ1ZSgvLiopJCAkMSBicmVhaztcbiAgICAgICAgICAgIFxuICAgICAgICAgICAgIyBBbGxvdyBoZWFkZXJzIGxpa2UgcmVkaXJlY3RfdG8gdG8gYmUgaGFuZGVkIG92ZXIgdG8gdGhlIGdvdHJ1ZVxuICAgICAgICAgICAgIyBmb3IgY29ycmVjdCByZWRpcmVjdGluZ1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBIb3N0ICRodHRwX2hvc3Q7XG4gICAgICAgICAgICBwcm94eV9wYXNzX3JlcXVlc3RfaGVhZGVycyBvbjtcbiAgICAgICAgfVxuXG4gICAgICAgICMgV2ViU29ja2V0IGVuZHBvaW50IC0gaGFuZGxlIGJvdGggL3dzIGFuZCAvd3MvdjJcbiAgICAgICAgbG9jYXRpb24gL3dzIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG5cbiAgICAgICAgICAgIHByb3h5X2h0dHBfdmVyc2lvbiAxLjE7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFVwZ3JhZGUgJGh0dHBfdXBncmFkZTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgQ29ubmVjdGlvbiBcIlVwZ3JhZGVcIjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaG9zdDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZWFsLUlQICRyZW1vdGVfYWRkcjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtRm9yICRwcm94eV9hZGRfeF9mb3J3YXJkZWRfZm9yO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Qcm90byAkc2NoZW1lO1xuICAgICAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDg2NDAwcztcbiAgICAgICAgfVxuXG4gICAgICAgICMgQVBJIGVuZHBvaW50c1xuICAgICAgICBsb2NhdGlvbiAvYXBpIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVxdWVzdC1JZCAkcmVxdWVzdF9pZDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaHR0cF9ob3N0O1xuXG4gICAgICAgICAgICAjIFNwZWNpYWwgaGFuZGxpbmcgZm9yIHB1Ymxpc2ggZW5kcG9pbnRcbiAgICAgICAgICAgIGxvY2F0aW9uIH4qIF4vYXBpL3dvcmtzcGFjZS8oW2EtekEtWjAtOV8tXSspL3B1Ymxpc2gkIHtcbiAgICAgICAgICAgICAgICBwcm94eV9wYXNzICRhcHBmbG93eV9jbG91ZF9iYWNrZW5kO1xuICAgICAgICAgICAgICAgIHByb3h5X3JlcXVlc3RfYnVmZmVyaW5nIG9mZjtcbiAgICAgICAgICAgICAgICBjbGllbnRfbWF4X2JvZHlfc2l6ZSAyNTZNO1xuICAgICAgICAgICAgfVxuXG4gICAgICAgICAgICAjIENoYXQgZW5kcG9pbnQgKHN0cmVhbWluZylcbiAgICAgICAgICAgIGxvY2F0aW9uIC9hcGkvY2hhdCB7XG4gICAgICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcblxuICAgICAgICAgICAgICAgIHByb3h5X2h0dHBfdmVyc2lvbiAxLjE7XG4gICAgICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBDb25uZWN0aW9uIFwiXCI7XG4gICAgICAgICAgICAgICAgY2h1bmtlZF90cmFuc2Zlcl9lbmNvZGluZyBvbjtcbiAgICAgICAgICAgICAgICBwcm94eV9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgICAgIHByb3h5X2NhY2hlIG9mZjtcblxuICAgICAgICAgICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X2Nvbm5lY3RfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X3NlbmRfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgfVxuXG4gICAgICAgICAgICAjIEltcG9ydCBlbmRwb2ludFxuICAgICAgICAgICAgbG9jYXRpb24gL2FwaS9pbXBvcnQge1xuICAgICAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG5cbiAgICAgICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVxdWVzdC1JZCAkcmVxdWVzdF9pZDtcbiAgICAgICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgJGh0dHBfaG9zdDtcblxuICAgICAgICAgICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X2Nvbm5lY3RfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X3NlbmRfdGltZW91dCA2MDBzO1xuXG4gICAgICAgICAgICAgICAgcHJveHlfcmVxdWVzdF9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgICAgIHByb3h5X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICAgICAgcHJveHlfY2FjaGUgb2ZmO1xuICAgICAgICAgICAgICAgIGNsaWVudF9tYXhfYm9keV9zaXplIDJHO1xuICAgICAgICAgICAgfVxuICAgICAgICB9XG5cbiAgICAgICAgIyBBZG1pbiBGcm9udGVuZFxuICAgICAgICAjIE9wdGlvbmFsIE1vZHVsZSwgY29tbWVudCB0aGlzIHNlY3Rpb24gaWYgeW91IGRpZCBub3QgZGVwbG95IGFkbWluX2Zyb250ZW5kIGluIGRvY2tlci1jb21wb3NlLnltbFxuICAgICAgICBsb2NhdGlvbiAvY29uc29sZSB7XG4gICAgICAgICAgICBwcm94eV9wYXNzICRhZG1pbl9mcm9udGVuZF9iYWNrZW5kO1xuXG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtU2NoZW1lICRzY2hlbWU7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgJGhvc3Q7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVhbC1JUCAkcmVtb3RlX2FkZHI7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtRm9yd2FyZGVkLUZvciAkcHJveHlfYWRkX3hfZm9yd2FyZGVkX2ZvcjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtUHJvdG8gJHNjaGVtZTtcblxuICAgICAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgQ29ubmVjdGlvbiBcIlwiO1xuXG4gICAgICAgICAgICBwcm94eV9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgcHJveHlfY2FjaGUgb2ZmO1xuXG4gICAgICAgICAgICBwcm94eV9yZWFkX3RpbWVvdXQgNjBzO1xuICAgICAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDYwcztcbiAgICAgICAgICAgIHByb3h5X3NlbmRfdGltZW91dCA2MHM7XG4gICAgICAgIH1cblxuICAgICAgICAjIFJlZGlyZWN0IHJvb3QgcGF0aCB0byAvY29uc29sZVxuICAgICAgICBsb2NhdGlvbiA9IC8ge1xuICAgICAgICAgICAgcmV0dXJuIDMwMSAvY29uc29sZTtcbiAgICAgICAgfVxuXG4gICAgICAgICMgSGVhbHRoIGNoZWNrIGVuZHBvaW50XG4gICAgICAgIGxvY2F0aW9uIC9oZWFsdGgge1xuICAgICAgICAgICAgYWNjZXNzX2xvZyBvZmY7XG4gICAgICAgICAgICByZXR1cm4gMjAwIFwiaGVhbHRoeVxcblwiO1xuICAgICAgICAgICAgYWRkX2hlYWRlciBDb250ZW50LVR5cGUgdGV4dC9wbGFpbjtcbiAgICAgICAgfVxuICAgIH1cbn1cbiIKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBwZmxvd3lfY2xvdWQKICAgICAgLSBnb3RydWUKICAgICAgLSBhZG1pbl9mcm9udGVuZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDQwcwogIGFwcGZsb3d5X3dlYjoKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BUFBGTE9XWVdFQgogICAgICAtICdBUFBGTE9XWV9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0vZ290cnVlJwogICAgICAtICdBUFBGTE9XWV9XU19CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0vd3MvdjInCiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FwcGZsb3d5X3dlYjowLjkuMTMyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcHBmbG93eV9jbG91ZAogIGFwcGZsb3d5X2Nsb3VkOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hcHBmbG93eV9jbG91ZDowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JVU1RfTE9HPSR7UlVTVF9MT0c6LWluZm99JwogICAgICAtICdBUFBGTE9XWV9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0nCiAgICAgIC0gQVBQRkxPV1lfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtICdBUFBGTE9XWV9EQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUkVESVNfVVJJPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD1odHRwOi8vZ290cnVlOjk5OTknCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0NSRUFURV9CVUNLRVQ9JHtBUFBGTE9XWV9TM19DUkVBVEVfQlVDS0VUOi10cnVlfScKICAgICAgLSBBUFBGTE9XWV9TM19VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBUFBGTE9XWV9TM19NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0JVQ0tFVD0ke0FQUEZMT1dZX1MzX0JVQ0tFVDotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9TM19SRUdJT049JHtBUFBGTE9XWV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX0hPU1Q9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX1BPUlQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRT0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1VTRVJOQU1FOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX0VNQUlMOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1BBU1NXT1JEOi1lbWFpbF9zZW5kZXJfcGFzc3dvcmR9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1RMU19LSU5EOi1ub25lfScKICAgICAgLSBBUFBGTE9XWV9BQ0NFU1NfQ09OVFJPTD10cnVlCiAgICAgIC0gQVBQRkxPV1lfREFUQUJBU0VfTUFYX0NPTk5FQ1RJT05TPTQwCiAgICAgIC0gQUlfU0VSVkVSX0hPU1Q9YWkKICAgICAgLSBBSV9TRVJWRVJfUE9SVD01MDAxCiAgICAgIC0gJ0FJX09QRU5BSV9BUElfS0VZPSR7QUlfT1BFTkFJX0FQSV9LRVk6LX0nCiAgICAgIC0gJ0FQUEZMT1dZX1dFQl9VUkw9JHtTRVJWSUNFX0ZRRE5fQVBQRkxPV1lXRUJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIC0tZmFpbCBodHRwOi8vMTI3LjAuMC4xOjgwMDAvYXBpL2hlYWx0aCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogICAgZGVwZW5kc19vbjoKICAgICAgZ290cnVlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgZ290cnVlOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9nb3RydWU6MC45LjE0OScKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSBQT1JUPTk5OTkKICAgICAgLSAnR09UUlVFX0FETUlOX0VNQUlMPSR7R09UUlVFX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ0dPVFJVRV9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtIEdPVFJVRV9ESVNBQkxFX1NJR05VUD1mYWxzZQogICAgICAtICdHT1RSVUVfU0lURV9VUkw9YXBwZmxvd3ktZmx1dHRlcjovLycKICAgICAgLSAnR09UUlVFX1VSSV9BTExPV19MSVNUPSoqJwogICAgICAtICdHT1RSVUVfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnR09UUlVFX0pXVF9FWFA9JHtHT1RSVUVfSldUX0VYUDotNzIwMH0nCiAgICAgIC0gR09UUlVFX0RCX0RSSVZFUj1wb3N0Z3JlcwogICAgICAtICdBUElfRVhURVJOQUxfVVJMPSR7U0VSVklDRV9GUUROX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotYXBwZmxvd3l9P3NlYXJjaF9wYXRoPWF1dGgnCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0hPU1Q9JHtHT1RSVUVfU01UUF9IT1NUfScKICAgICAgLSAnR09UUlVFX1NNVFBfUE9SVD0ke0dPVFJVRV9TTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1VTRVI9JHtHT1RSVUVfU01UUF9VU0VSfScKICAgICAgLSAnR09UUlVFX1NNVFBfUEFTUz0ke0dPVFJVRV9TTVRQX1BBU1N9JwogICAgICAtIEdPVFJVRV9NQUlMRVJfVVJMUEFUSFNfQ09ORklSTUFUSU9OPS92ZXJpZnkKICAgICAgLSBHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0lOVklURT0vdmVyaWZ5CiAgICAgIC0gR09UUlVFX01BSUxFUl9VUkxQQVRIU19SRUNPVkVSWT0vdmVyaWZ5CiAgICAgIC0gR09UUlVFX01BSUxFUl9VUkxQQVRIU19FTUFJTF9DSEFOR0U9L3ZlcmlmeQogICAgICAtICdHT1RSVUVfU01UUF9BRE1JTl9FTUFJTD0ke0dPVFJVRV9TTVRQX0FETUlOX0VNQUlMfScKICAgICAgLSBHT1RSVUVfU01UUF9NQVhfRlJFUVVFTkNZPTFucwogICAgICAtIEdPVFJVRV9SQVRFX0xJTUlUX0VNQUlMX1NFTlQ9MTAwCiAgICAgIC0gR09UUlVFX01BSUxFUl9BVVRPQ09ORklSTT10cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIC0tZmFpbCBodHRwOi8vMTI3LjAuMC4xOjk5OTkvaGVhbHRoIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgYWRtaW5fZnJvbnRlbmQ6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FkbWluX2Zyb250ZW5kOjAuOS4xNDknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0JBU0VfVVJMPSR7U0VSVklDRV9GUUROX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0FQUEZMT1dZX0JBU0VfVVJMPSR7U0VSVklDRV9GUUROX0FETUlOfScKICAgIGRlcGVuZHNfb246CiAgICAgIGdvdHJ1ZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHBmbG93eV9jbG91ZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZAogIGFpOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hcHBmbG93eV9haTowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7QUlfT1BFTkFJX0FQSV9LRVk6LX0nCiAgICAgIC0gQUlfU0VSVkVSX1BPUlQ9NTAwMQogICAgICAtIERFRkFVTFRfQUlfTU9ERUw9Z3B0LTQuMS1taW5pCiAgICAgIC0gREVGQVVMVF9BSV9DT01QTEVUSU9OX01PREVMPWdwdC00LjEtbWluaQogICAgICAtICdBSV9BUFBGTE9XWV9IT1NUPSR7U0VSVklDRV9GUUROX0FQUEZMT1dZV0VCfScKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0FaVVJFX09QRU5BSV9BUElfS0VZPSR7QVpVUkVfT1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdBWlVSRV9PUEVOQUlfRU5EUE9JTlQ9JHtBWlVSRV9PUEVOQUlfRU5EUE9JTlR9JwogICAgICAtICdBWlVSRV9PUEVOQUlfQVBJX1ZFUlNJT049JHtBWlVSRV9PUEVOQUlfQVBJX1ZFUlNJT059JwogICAgICAtICdBUFBGTE9XWV9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVBQRkxPV1lfUzNfU0VDUkVUX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19CVUNLRVQ9JHtBUFBGTE9XWV9TM19CVUNLRVQ6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUzNfUkVHSU9OPSR7QVBQRkxPV1lfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdBSV9EQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnQUlfUkVESVNfVVJMPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSBBSV9VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBSV9NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGFwcGZsb3d5X3dvcmtlcjoKICAgIGltYWdlOiAnYXBwZmxvd3lpbmMvYXBwZmxvd3lfd29ya2VyOjAuOS4xNDknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBSVVNUX0xPRz1pbmZvCiAgICAgIC0gQVBQRkxPV1lfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtIEFQUEZMT1dZX1dPUktFUl9FTlZJUk9OTUVOVD1wcm9kdWN0aW9uCiAgICAgIC0gJ0FQUEZMT1dZX1dPUktFUl9SRURJU19VUkw9cmVkaXM6Ly9yZWRpczo2Mzc5JwogICAgICAtICdBUFBGTE9XWV9XT1JLRVJfREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gJ0FQUEZMT1dZX1dPUktFUl9EQVRBQkFTRV9OQU1FPSR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSBBUFBGTE9XWV9XT1JLRVJfSU1QT1JUX1RJQ0tfSU5URVJWQUw9MzAKICAgICAgLSBBUFBGTE9XWV9TM19VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBUFBGTE9XWV9TM19NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0JVQ0tFVD0ke0FQUEZMT1dZX1MzX0JVQ0tFVDotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9TM19SRUdJT049JHtBUFBGTE9XWV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX0hPU1Q9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX1BPUlQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRT0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1VTRVJOQU1FOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX0VNQUlMOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1BBU1NXT1JEOi1lbWFpbF9zZW5kZXJfcGFzc3dvcmR9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1RMU19LSU5EOi1ub25lfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgbWluaW86CiAgICBpbWFnZTogJ21pbmlvL21pbmlvOlJFTEVBU0UuMjAyNS0wOS0wN1QxNi0xMy0wOVonCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjkwMDAvbWluaW8vaGVhbHRoL2xpdmUnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvX2RhdGE6L2RhdGEnCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3BndmVjdG9yL3BndmVjdG9yOnBnMTYnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBQT1NUR1JFU19IT1NUPXBvc3RncmVzCiAgICB2b2x1bWVzOgogICAgICAtICdwb3N0Z3Jlc19kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwZ19pc3JlYWR5CiAgICAgICAgLSAnLVUnCiAgICAgICAgLSAnJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAgIC0gJy1kJwogICAgICAgIC0gJyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjguMi4yLWFscGluZTMuMjInCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc19kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgLWggbG9jYWxob3N0IC1wIDYzNzkgcGluZycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMK",
+        "compose": "c2VydmljZXM6CiAgbmdpbng6CiAgICBpbWFnZTogJ25naW54OjEuMjkuMicKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BRE1JTgogICAgdm9sdW1lczoKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vbmdpbngvbmdpbnguY29uZgogICAgICAgIHRhcmdldDogL2V0Yy9uZ2lueC9uZ2lueC5jb25mCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIiMgUGxlYXNlIGRvIG5vdCBkaXJlY3RseSBlZGl0IHRoaXMgZmlsZS5cblxuZXJyb3JfbG9nICAvdmFyL2xvZy9uZ2lueC9lcnJvci5sb2cgbm90aWNlO1xucGlkICAgICAgICAvdmFyL3J1bi9uZ2lueC5waWQ7XG5cblxuZXZlbnRzIHtcbiAgICB3b3JrZXJfY29ubmVjdGlvbnMgIDEwMjQ7XG59XG5cblxuaHR0cCB7XG4gICAgcmVzb2x2ZXIgMTI3LjAuMC4xMSB2YWxpZD0xMHM7XG4gICAgbWFwICRodHRwX3VwZ3JhZGUgJGNvbm5lY3Rpb25fdXBncmFkZSB7XG4gICAgICAgIGRlZmF1bHQgdXBncmFkZTtcbiAgICAgICAgJycgY2xvc2U7XG4gICAgfVxuXG4gICAgc2VydmVyIHtcbiAgICAgICAgbGlzdGVuIDgwO1xuICAgICAgICBjbGllbnRfbWF4X2JvZHlfc2l6ZSAxME07XG4gICAgICAgIHVuZGVyc2NvcmVzX2luX2hlYWRlcnMgb247XG5cbiAgICAgICAgIyBCYWNrZW5kIHNlcnZpY2VzXG4gICAgICAgIHNldCAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZCBcImh0dHA6Ly9hcHBmbG93eV9jbG91ZDo4MDAwXCI7XG4gICAgICAgIHNldCAkZ290cnVlX2JhY2tlbmQgXCJodHRwOi8vZ290cnVlOjk5OTlcIjtcbiAgICAgICAgc2V0ICRhZG1pbl9mcm9udGVuZF9iYWNrZW5kIFwiaHR0cDovL2FkbWluX2Zyb250ZW5kOjMwMDBcIjtcbiAgICAgICAgIyBHb1RydWUgQXV0aGVudGljYXRpb24gU2VydmljZVxuICAgICAgICBsb2NhdGlvbiAvZ290cnVlLyB7XG4gICAgICAgICAgICBwcm94eV9wYXNzICRnb3RydWVfYmFja2VuZDtcblxuICAgICAgICAgICAgcmV3cml0ZSBeL2dvdHJ1ZSgvLiopJCAkMSBicmVhaztcbiAgICAgICAgICAgIFxuICAgICAgICAgICAgIyBBbGxvdyBoZWFkZXJzIGxpa2UgcmVkaXJlY3RfdG8gdG8gYmUgaGFuZGVkIG92ZXIgdG8gdGhlIGdvdHJ1ZVxuICAgICAgICAgICAgIyBmb3IgY29ycmVjdCByZWRpcmVjdGluZ1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBIb3N0ICRodHRwX2hvc3Q7XG4gICAgICAgICAgICBwcm94eV9wYXNzX3JlcXVlc3RfaGVhZGVycyBvbjtcbiAgICAgICAgfVxuXG4gICAgICAgICMgV2ViU29ja2V0IGVuZHBvaW50IC0gaGFuZGxlIGJvdGggL3dzIGFuZCAvd3MvdjJcbiAgICAgICAgbG9jYXRpb24gL3dzIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG5cbiAgICAgICAgICAgIHByb3h5X2h0dHBfdmVyc2lvbiAxLjE7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFVwZ3JhZGUgJGh0dHBfdXBncmFkZTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgQ29ubmVjdGlvbiBcIlVwZ3JhZGVcIjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaG9zdDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1SZWFsLUlQICRyZW1vdGVfYWRkcjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtRm9yICRwcm94eV9hZGRfeF9mb3J3YXJkZWRfZm9yO1xuICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBYLUZvcndhcmRlZC1Qcm90byAkc2NoZW1lO1xuICAgICAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDg2NDAwcztcbiAgICAgICAgfVxuXG4gICAgICAgICMgQVBJIGVuZHBvaW50c1xuICAgICAgICBsb2NhdGlvbiAvYXBpIHtcbiAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVxdWVzdC1JZCAkcmVxdWVzdF9pZDtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCAkaHR0cF9ob3N0O1xuXG4gICAgICAgICAgICAjIFNwZWNpYWwgaGFuZGxpbmcgZm9yIHB1Ymxpc2ggZW5kcG9pbnRcbiAgICAgICAgICAgIGxvY2F0aW9uIH4qIF4vYXBpL3dvcmtzcGFjZS8oW2EtekEtWjAtOV8tXSspL3B1Ymxpc2gkIHtcbiAgICAgICAgICAgICAgICBwcm94eV9wYXNzICRhcHBmbG93eV9jbG91ZF9iYWNrZW5kO1xuICAgICAgICAgICAgICAgIHByb3h5X3JlcXVlc3RfYnVmZmVyaW5nIG9mZjtcbiAgICAgICAgICAgICAgICBjbGllbnRfbWF4X2JvZHlfc2l6ZSAyNTZNO1xuICAgICAgICAgICAgfVxuXG4gICAgICAgICAgICAjIENoYXQgZW5kcG9pbnQgKHN0cmVhbWluZylcbiAgICAgICAgICAgIGxvY2F0aW9uIC9hcGkvY2hhdCB7XG4gICAgICAgICAgICAgICAgcHJveHlfcGFzcyAkYXBwZmxvd3lfY2xvdWRfYmFja2VuZDtcblxuICAgICAgICAgICAgICAgIHByb3h5X2h0dHBfdmVyc2lvbiAxLjE7XG4gICAgICAgICAgICAgICAgcHJveHlfc2V0X2hlYWRlciBDb25uZWN0aW9uIFwiXCI7XG4gICAgICAgICAgICAgICAgY2h1bmtlZF90cmFuc2Zlcl9lbmNvZGluZyBvbjtcbiAgICAgICAgICAgICAgICBwcm94eV9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgICAgIHByb3h5X2NhY2hlIG9mZjtcblxuICAgICAgICAgICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X2Nvbm5lY3RfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X3NlbmRfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgfVxuXG4gICAgICAgICAgICAjIEltcG9ydCBlbmRwb2ludFxuICAgICAgICAgICAgbG9jYXRpb24gL2FwaS9pbXBvcnQge1xuICAgICAgICAgICAgICAgIHByb3h5X3Bhc3MgJGFwcGZsb3d5X2Nsb3VkX2JhY2tlbmQ7XG5cbiAgICAgICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVxdWVzdC1JZCAkcmVxdWVzdF9pZDtcbiAgICAgICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgJGh0dHBfaG9zdDtcblxuICAgICAgICAgICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X2Nvbm5lY3RfdGltZW91dCA2MDBzO1xuICAgICAgICAgICAgICAgIHByb3h5X3NlbmRfdGltZW91dCA2MDBzO1xuXG4gICAgICAgICAgICAgICAgcHJveHlfcmVxdWVzdF9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgICAgIHByb3h5X2J1ZmZlcmluZyBvZmY7XG4gICAgICAgICAgICAgICAgcHJveHlfY2FjaGUgb2ZmO1xuICAgICAgICAgICAgICAgIGNsaWVudF9tYXhfYm9keV9zaXplIDJHO1xuICAgICAgICAgICAgfVxuICAgICAgICB9XG5cbiAgICAgICAgIyBBZG1pbiBGcm9udGVuZFxuICAgICAgICAjIE9wdGlvbmFsIE1vZHVsZSwgY29tbWVudCB0aGlzIHNlY3Rpb24gaWYgeW91IGRpZCBub3QgZGVwbG95IGFkbWluX2Zyb250ZW5kIGluIGRvY2tlci1jb21wb3NlLnltbFxuICAgICAgICBsb2NhdGlvbiAvY29uc29sZSB7XG4gICAgICAgICAgICBwcm94eV9wYXNzICRhZG1pbl9mcm9udGVuZF9iYWNrZW5kO1xuXG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtU2NoZW1lICRzY2hlbWU7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgJGhvc3Q7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtUmVhbC1JUCAkcmVtb3RlX2FkZHI7XG4gICAgICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtRm9yd2FyZGVkLUZvciAkcHJveHlfYWRkX3hfZm9yd2FyZGVkX2ZvcjtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtUHJvdG8gJHNjaGVtZTtcblxuICAgICAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTtcbiAgICAgICAgICAgIHByb3h5X3NldF9oZWFkZXIgQ29ubmVjdGlvbiBcIlwiO1xuXG4gICAgICAgICAgICBwcm94eV9idWZmZXJpbmcgb2ZmO1xuICAgICAgICAgICAgcHJveHlfY2FjaGUgb2ZmO1xuXG4gICAgICAgICAgICBwcm94eV9yZWFkX3RpbWVvdXQgNjBzO1xuICAgICAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDYwcztcbiAgICAgICAgICAgIHByb3h5X3NlbmRfdGltZW91dCA2MHM7XG4gICAgICAgIH1cblxuICAgICAgICAjIFJlZGlyZWN0IHJvb3QgcGF0aCB0byAvY29uc29sZVxuICAgICAgICBsb2NhdGlvbiA9IC8ge1xuICAgICAgICAgICAgcmV0dXJuIDMwMSAvY29uc29sZTtcbiAgICAgICAgfVxuXG4gICAgICAgICMgSGVhbHRoIGNoZWNrIGVuZHBvaW50XG4gICAgICAgIGxvY2F0aW9uIC9oZWFsdGgge1xuICAgICAgICAgICAgYWNjZXNzX2xvZyBvZmY7XG4gICAgICAgICAgICByZXR1cm4gMjAwIFwiaGVhbHRoeVxcblwiO1xuICAgICAgICAgICAgYWRkX2hlYWRlciBDb250ZW50LVR5cGUgdGV4dC9wbGFpbjtcbiAgICAgICAgfVxuICAgIH1cbn1cbiIKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBwZmxvd3lfY2xvdWQKICAgICAgLSBnb3RydWUKICAgICAgLSBhZG1pbl9mcm9udGVuZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDQwcwogIGFwcGZsb3d5X3dlYjoKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BUFBGTE9XWVdFQgogICAgICAtICdBUFBGTE9XWV9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0vZ290cnVlJwogICAgICAtICdBUFBGTE9XWV9XU19CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0vd3MvdjInCiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FwcGZsb3d5X3dlYjowLjkuMTMyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcHBmbG93eV9jbG91ZAogIGFwcGZsb3d5X2Nsb3VkOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hcHBmbG93eV9jbG91ZDowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JVU1RfTE9HPSR7UlVTVF9MT0c6LWluZm99JwogICAgICAtICdBUFBGTE9XWV9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9BRE1JTn0nCiAgICAgIC0gQVBQRkxPV1lfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtICdBUFBGTE9XWV9EQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUkVESVNfVVJJPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0FQUEZMT1dZX0dPVFJVRV9CQVNFX1VSTD1odHRwOi8vZ290cnVlOjk5OTknCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0NSRUFURV9CVUNLRVQ9JHtBUFBGTE9XWV9TM19DUkVBVEVfQlVDS0VUOi10cnVlfScKICAgICAgLSBBUFBGTE9XWV9TM19VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBUFBGTE9XWV9TM19NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0JVQ0tFVD0ke0FQUEZMT1dZX1MzX0JVQ0tFVDotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9TM19SRUdJT049JHtBUFBGTE9XWV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX0hPU1Q9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX1BPUlQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRT0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1VTRVJOQU1FOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX0VNQUlMOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1BBU1NXT1JEOi1lbWFpbF9zZW5kZXJfcGFzc3dvcmR9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1RMU19LSU5EOi1ub25lfScKICAgICAgLSBBUFBGTE9XWV9BQ0NFU1NfQ09OVFJPTD10cnVlCiAgICAgIC0gQVBQRkxPV1lfREFUQUJBU0VfTUFYX0NPTk5FQ1RJT05TPTQwCiAgICAgIC0gQUlfU0VSVkVSX0hPU1Q9YWkKICAgICAgLSBBSV9TRVJWRVJfUE9SVD01MDAxCiAgICAgIC0gJ0FJX09QRU5BSV9BUElfS0VZPSR7QUlfT1BFTkFJX0FQSV9LRVk6LX0nCiAgICAgIC0gJ0FQUEZMT1dZX1dFQl9VUkw9JHtTRVJWSUNFX0ZRRE5fQVBQRkxPV1lXRUJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIC0tZmFpbCBodHRwOi8vMTI3LjAuMC4xOjgwMDAvYXBpL2hlYWx0aCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogICAgZGVwZW5kc19vbjoKICAgICAgZ290cnVlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgZ290cnVlOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9nb3RydWU6MC45LjE0OScKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSBQT1JUPTk5OTkKICAgICAgLSAnR09UUlVFX0FETUlOX0VNQUlMPSR7R09UUlVFX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ0dPVFJVRV9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtIEdPVFJVRV9ESVNBQkxFX1NJR05VUD1mYWxzZQogICAgICAtICdHT1RSVUVfU0lURV9VUkw9YXBwZmxvd3ktZmx1dHRlcjovLycKICAgICAgLSAnR09UUlVFX1VSSV9BTExPV19MSVNUPSoqJwogICAgICAtICdHT1RSVUVfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnR09UUlVFX0pXVF9FWFA9JHtHT1RSVUVfSldUX0VYUDotNzIwMH0nCiAgICAgIC0gR09UUlVFX0RCX0RSSVZFUj1wb3N0Z3JlcwogICAgICAtICdBUElfRVhURVJOQUxfVVJMPSR7U0VSVklDRV9GUUROX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotYXBwZmxvd3l9P3NlYXJjaF9wYXRoPWF1dGgnCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0hPU1Q9JHtHT1RSVUVfU01UUF9IT1NUfScKICAgICAgLSAnR09UUlVFX1NNVFBfUE9SVD0ke0dPVFJVRV9TTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1VTRVI9JHtHT1RSVUVfU01UUF9VU0VSfScKICAgICAgLSAnR09UUlVFX1NNVFBfUEFTUz0ke0dPVFJVRV9TTVRQX1BBU1N9JwogICAgICAtIEdPVFJVRV9NQUlMRVJfVVJMUEFUSFNfQ09ORklSTUFUSU9OPS92ZXJpZnkKICAgICAgLSBHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0lOVklURT0vdmVyaWZ5CiAgICAgIC0gR09UUlVFX01BSUxFUl9VUkxQQVRIU19SRUNPVkVSWT0vdmVyaWZ5CiAgICAgIC0gR09UUlVFX01BSUxFUl9VUkxQQVRIU19FTUFJTF9DSEFOR0U9L3ZlcmlmeQogICAgICAtICdHT1RSVUVfU01UUF9BRE1JTl9FTUFJTD0ke0dPVFJVRV9TTVRQX0FETUlOX0VNQUlMfScKICAgICAgLSBHT1RSVUVfU01UUF9NQVhfRlJFUVVFTkNZPTFucwogICAgICAtIEdPVFJVRV9SQVRFX0xJTUlUX0VNQUlMX1NFTlQ9MTAwCiAgICAgIC0gR09UUlVFX01BSUxFUl9BVVRPQ09ORklSTT10cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIC0tZmFpbCBodHRwOi8vMTI3LjAuMC4xOjk5OTkvaGVhbHRoIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgYWRtaW5fZnJvbnRlbmQ6CiAgICBpbWFnZTogJ2FwcGZsb3d5aW5jL2FkbWluX2Zyb250ZW5kOjAuOS4xNDknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0JBU0VfVVJMPSR7U0VSVklDRV9GUUROX0FETUlOfS9nb3RydWUnCiAgICAgIC0gJ0FQUEZMT1dZX0JBU0VfVVJMPSR7U0VSVklDRV9GUUROX0FETUlOfScKICAgIGRlcGVuZHNfb246CiAgICAgIGdvdHJ1ZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHBmbG93eV9jbG91ZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZAogIGFpOgogICAgaW1hZ2U6ICdhcHBmbG93eWluYy9hcHBmbG93eV9haTowLjkuMTQ5JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7QUlfT1BFTkFJX0FQSV9LRVk6LX0nCiAgICAgIC0gQUlfU0VSVkVSX1BPUlQ9NTAwMQogICAgICAtIERFRkFVTFRfQUlfTU9ERUw9Z3B0LTQuMS1taW5pCiAgICAgIC0gREVGQVVMVF9BSV9DT01QTEVUSU9OX01PREVMPWdwdC00LjEtbWluaQogICAgICAtICdBSV9BUFBGTE9XWV9IT1NUPSR7U0VSVklDRV9GUUROX0FQUEZMT1dZV0VCfScKICAgICAgLSAnQVBQRkxPV1lfR09UUlVFX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0FaVVJFX09QRU5BSV9BUElfS0VZPSR7QVpVUkVfT1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdBWlVSRV9PUEVOQUlfRU5EUE9JTlQ9JHtBWlVSRV9PUEVOQUlfRU5EUE9JTlR9JwogICAgICAtICdBWlVSRV9PUEVOQUlfQVBJX1ZFUlNJT049JHtBWlVSRV9PUEVOQUlfQVBJX1ZFUlNJT059JwogICAgICAtICdBUFBGTE9XWV9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVBQRkxPV1lfUzNfU0VDUkVUX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19CVUNLRVQ9JHtBUFBGTE9XWV9TM19CVUNLRVQ6LWFwcGZsb3d5fScKICAgICAgLSAnQVBQRkxPV1lfUzNfUkVHSU9OPSR7QVBQRkxPV1lfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdBSV9EQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU306JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSAnQUlfUkVESVNfVVJMPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgICAgLSBBSV9VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBSV9NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGFwcGZsb3d5X3dvcmtlcjoKICAgIGltYWdlOiAnYXBwZmxvd3lpbmMvYXBwZmxvd3lfd29ya2VyOjAuOS4xNDknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBSVVNUX0xPRz1pbmZvCiAgICAgIC0gQVBQRkxPV1lfRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgogICAgICAtIEFQUEZMT1dZX1dPUktFUl9FTlZJUk9OTUVOVD1wcm9kdWN0aW9uCiAgICAgIC0gJ0FQUEZMT1dZX1dPUktFUl9SRURJU19VUkw9cmVkaXM6Ly9yZWRpczo2Mzc5JwogICAgICAtICdBUFBGTE9XWV9XT1JLRVJfREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gJ0FQUEZMT1dZX1dPUktFUl9EQVRBQkFTRV9OQU1FPSR7UE9TVEdSRVNfREI6LWFwcGZsb3d5fScKICAgICAgLSBBUFBGTE9XWV9XT1JLRVJfSU1QT1JUX1RJQ0tfSU5URVJWQUw9MzAKICAgICAgLSBBUFBGTE9XWV9TM19VU0VfTUlOSU89dHJ1ZQogICAgICAtICdBUFBGTE9XWV9TM19NSU5JT19VUkw9aHR0cDovL21pbmlvOjkwMDAnCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0FDQ0VTU19LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdBUFBGTE9XWV9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0FQUEZMT1dZX1MzX0JVQ0tFVD0ke0FQUEZMT1dZX1MzX0JVQ0tFVDotYXBwZmxvd3l9JwogICAgICAtICdBUFBGTE9XWV9TM19SRUdJT049JHtBUFBGTE9XWV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX0hPU1Q9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9IT1NUOi1zbXRwLmdtYWlsLmNvbX0nCiAgICAgIC0gJ0FQUEZMT1dZX01BSUxFUl9TTVRQX1BPUlQ9JHtBUFBGTE9XWV9NQUlMRVJfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9VU0VSTkFNRT0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1VTRVJOQU1FOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9FTUFJTD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX0VNQUlMOi1ub3RpZnlAYXBwZmxvd3kuaW99JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9QQVNTV09SRD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1BBU1NXT1JEOi1lbWFpbF9zZW5kZXJfcGFzc3dvcmR9JwogICAgICAtICdBUFBGTE9XWV9NQUlMRVJfU01UUF9UTFNfS0lORD0ke0FQUEZMT1dZX01BSUxFUl9TTVRQX1RMU19LSU5EOi1ub25lfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgbWluaW86CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAzCiAgICB2b2x1bWVzOgogICAgICAtICdtaW5pb19kYXRhOi9kYXRhJwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwZ3ZlY3Rvci9wZ3ZlY3RvcjpwZzE2JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1wb3N0Z3JlcwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNfZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdfaXNyZWFkeQogICAgICAgIC0gJy1VJwogICAgICAgIC0gJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgICAtICctZCcKICAgICAgICAtICcke1BPU1RHUkVTX0RCOi1hcHBmbG93eX0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo4LjIuMi1hbHBpbmUzLjIyJwogICAgdm9sdW1lczoKICAgICAgLSAncmVkaXNfZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncmVkaXMtY2xpIC1oIGxvY2FsaG9zdCAtcCA2Mzc5IHBpbmcnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "appflowy",
             "notion",
@@ -162,7 +162,7 @@
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
         "slogan": "A backend-as-a-service platform that simplifies the web & mobile app development.",
-        "compose": "c2VydmljZXM6CiAgYXBwd3JpdGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFPS92MQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9FWEVDVVRJT05TX0RVQUxfV1JJVEU9JHtfQVBQX0VYRUNVVElPTlNfRFVBTF9XUklURTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfRVhFQ1VUSU9OUz1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM9JHtfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TOi0yfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMOi0xODB9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU6LXYxLXN0YXRzLXJlc291cmNlc30nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw6LTM2MDB9JwogICAgICAtICdfQVBQX0VESVRJT049JHtfQVBQX0VESVRJT046LXNlbGYtaG9zdGVkfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfUE9PTF9BREFQVEVSPSR7X0FQUF9QT09MX0FEQVBURVI6LXN0YWNrfScKICAgICAgLSAnX0FQUF9MT0NBTEU9JHtfQVBQX0xPQ0FMRTotZW59JwogICAgICAtICdfQVBQX0NPTVBSRVNTSU9OX0VOQUJMRUQ9JHtfQVBQX0NPTVBSRVNTSU9OX0VOQUJMRUQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0NPTVBSRVNTSU9OX01JTl9TSVpFX0JZVEVTPSR7X0FQUF9DT01QUkVTU0lPTl9NSU5fU0laRV9CWVRFU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9XSElURUxJU1RfUk9PVD0ke19BUFBfQ09OU09MRV9XSElURUxJU1RfUk9PVDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9XSElURUxJU1RfRU1BSUxTPSR7X0FQUF9DT05TT0xFX1dISVRFTElTVF9FTUFJTFN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0VTU0lPTl9BTEVSVFM9JHtfQVBQX0NPTlNPTEVfU0VTU0lPTl9BTEVSVFM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9JUFM9JHtfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0lQU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9IT1NUTkFNRVM9JHtfQVBQX0NPTlNPTEVfSE9TVE5BTUVTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1NDSEVNQT0ke19BUFBfQ09OU09MRV9TQ0hFTUE6LWFwcHdyaXRlaW99JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUSFVCX0FQUF9JRD0ke19BUFBfQ09OU09MRV9HSVRIVUJfQVBQX0lEfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVEhVQl9TRUNSRVQ9JHtfQVBQX0NPTlNPTEVfR0lUSFVCX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRMQUJfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dJVExBQl9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUTEFCX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HSVRMQUJfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVExBQl9FTkRQT0lOVD0ke19BUFBfQ09OU09MRV9HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQklUQlVDS0VUX0FQUF9JRD0ke19BUFBfQ09OU09MRV9CSVRCVUNLRVRfQVBQX0lEfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0JJVEJVQ0tFVF9TRUNSRVQ9JHtfQVBQX0NPTlNPTEVfQklUQlVDS0VUX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HT09HTEVfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dPT0dMRV9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR09PR0xFX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HT09HTEVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TWVNURU1fRU1BSUxfTkFNRT0ke19BUFBfU1lTVEVNX0VNQUlMX05BTUU6LUFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUz0ke19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M6LW5vcmVwbHlAYXBwd3JpdGUuaW99JwogICAgICAtICdfQVBQX1NZU1RFTV9URUFNX0VNQUlMPSR7X0FQUF9TWVNURU1fVEVBTV9FTUFJTDotdGVhbUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU1lTVEVNX1JFU1BPTlNFX0ZPUk1BVD0ke19BUFBfU1lTVEVNX1JFU1BPTlNFX0ZPUk1BVH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRV9JTkNSRUFTRURfTElNSVRfUFJPSkVDVFM9JHtfQVBQX09QVElPTlNfQUJVU0VfSU5DUkVBU0VEX0xJTUlUX1BST0pFQ1RTfScKICAgICAgLSAnX0FQUF9PUFRJT05TX1JPVVRFUl9QUk9URUNUSU9OPSR7X0FQUF9PUFRJT05TX1JPVVRFUl9QUk9URUNUSU9OOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTPSR7X0FQUF9ST1VURVJfQVVUT19DRVJUSUZJQ0FURVM6LWRpc2FibGVkfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0NPTlNPTEVfRE9NQUlOPSR7X0FQUF9DT05TT0xFX0RPTUFJTn0nCiAgICAgIC0gX0FQUF9DT05TT0xFX1VSTF9TQ0hFTUU9cm9vdAogICAgICAtICdfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUUz0ke19BUFBfQ09OU09MRV9UUlVTVEVEX1BST0pFQ1RTfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NOQU1FPSR7X0FQUF9ET01BSU5fVEFSR0VUX0NOQU1FOi1sb2NhbGhvc3R9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBOi06OjF9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9BOi0xMjcuMC4wLjF9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0NBQX0nCiAgICAgIC0gJ19BUFBfRE5TPSR7X0FQUF9ETlN9JwogICAgICAtICdfQVBQX0RPTUFJTl9GVU5DVElPTlM9JHtfQVBQX0RPTUFJTl9GVU5DVElPTlM6LWZ1bmN0aW9ucy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCPSR7X0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVF9WRUNUT1JTREI9JHtfQVBQX0RCX0hPU1RfVkVDVE9SU0RCOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQj0ke19BUFBfREJfUE9SVF9WRUNUT1JTREI6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQV9WRUNUT1JTREI9JHtfQVBQX0RCX1NDSEVNQV9WRUNUT1JTREI6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVJfVkVDVE9SU0RCPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1NfVkVDVE9SU0RCPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfQURBUFRFUl9ET0NVTUVOVFNEQjotbW9uZ29kYn0nCiAgICAgIC0gJ19BUFBfREJfSE9TVF9ET0NVTUVOVFNEQj0ke19BUFBfREJfSE9TVF9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9ET0NVTUVOVFNEQj0ke19BUFBfREJfUE9SVF9ET0NVTUVOVFNEQjotMjcwMTd9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQj0ke19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9VU0VSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9VU0VSX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QQVNTX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QQVNTX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQj0ke19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQj0ke19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCfScKICAgICAgLSAnX0FQUF9TTVRQX0hPU1Q9JHtfQVBQX1NNVFBfSE9TVH0nCiAgICAgIC0gJ19BUFBfU01UUF9QT1JUPSR7X0FQUF9TTVRQX1BPUlR9JwogICAgICAtICdfQVBQX1NNVFBfU0VDVVJFPSR7X0FQUF9TTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ19BUFBfU01UUF9VU0VSTkFNRT0ke19BUFBfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ19BUFBfU01UUF9QQVNTV09SRD0ke19BUFBfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU1JVD0ke19BUFBfU1RPUkFHRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUFJFVklFV19MSU1JVD0ke19BUFBfU1RPUkFHRV9QUkVWSUVXX0xJTUlUOi0yMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9BTlRJVklSVVM9JHtfQVBQX1NUT1JBR0VfQU5USVZJUlVTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9BTlRJVklSVVNfSE9TVD0ke19BUFBfU1RPUkFHRV9BTlRJVklSVVNfSE9TVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9BTlRJVklSVVNfUE9SVD0ke19BUFBfU1RPUkFHRV9BTlRJVklSVVNfUE9SVDotMzMxMH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ERVZJQ0U9JHtfQVBQX1NUT1JBR0VfREVWSUNFOi1sb2NhbH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX1MzX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19SRUdJT049JHtfQVBQX1NUT1JBR0VfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX1MzX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19FTkRQT0lOVD0ke19BUFBfU1RPUkFHRV9TM19FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT046LXVzLXdlc3QtMDA0fScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9MSU5PREVfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OOi1ldS1jZW50cmFsLTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVR9JwogICAgICAtICdfQVBQX0NPTVBVVEVfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9TSVpFX0xJTUlUOi0zMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ9JHtfQVBQX0ZVTkNUSU9OU19USU1FT1VUOi05MDB9JwogICAgICAtICdfQVBQX1NJVEVTX1RJTUVPVVQ9JHtfQVBQX1NJVEVTX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9CVUlMRF9USU1FT1VUPSR7X0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ6LTI3MDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQ1BVUz0ke19BUFBfQ09NUFVURV9DUFVTOi0wfScKICAgICAgLSAnX0FQUF9DT01QVVRFX01FTU9SWT0ke19BUFBfQ09NUFVURV9NRU1PUlk6LTB9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19SVU5USU1FUz0ke19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTOi1ub2RlLTIyfScKICAgICAgLSAnX0FQUF9TSVRFU19SVU5USU1FUz0ke19BUFBfU0lURVNfUlVOVElNRVM6LXN0YXRpYy0xLG5vZGUtMjJ9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSBfQVBQX0VYRUNVVE9SX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9FWEVDVVRPUgogICAgICAtICdfQVBQX0VYRUNVVE9SX0hPU1Q9JHtfQVBQX0VYRUNVVE9SX0hPU1Q6LWh0dHA6Ly9vcGVucnVudGltZXMtZXhlY3V0b3IvdjF9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfTE9DS0lOR19FTkFCTEVEPSR7X0FQUF9MT0NLSU5HX0VOQUJMRUQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9NQUlOVEVOQU5DRV9JTlRFUlZBTDotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9FWEVDVVRJT049JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9FWEVDVVRJT046LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9DQUNIRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFOi0yNTkyMDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQUJVU0U9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRTotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEV9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9IT1VSTFk9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9IT1VSTFk6LTg2NDAwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9TQ0hFRFVMRVM9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9TQ0hFRFVMRVM6LTg2NDAwfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX0lOVFJPU1BFQ1RJT049JHtfQVBQX0dSQVBIUUxfSU5UUk9TUEVDVElPTjotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfQkFUQ0hfU0laRT0ke19BUFBfR1JBUEhRTF9NQVhfQkFUQ0hfU0laRTotMTB9JwogICAgICAtICdfQVBQX0dSQVBIUUxfTUFYX0NPTVBMRVhJVFk9JHtfQVBQX0dSQVBIUUxfTUFYX0NPTVBMRVhJVFk6LTI1MH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfREVQVEg9JHtfQVBQX0dSQVBIUUxfTUFYX0RFUFRIOi0zfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRIVUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEhVQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVEhVQl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfU0VDUkVUPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX0FTU0lTVEFOVF9PUEVOQUlfQVBJX0tFWT0ke19BUFBfQVNTSVNUQU5UX09QRU5BSV9BUElfS0VZfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0NPVU5UUklFU19ERU5ZTElTVD0ke19BUFBfQ09OU09MRV9DT1VOVFJJRVNfREVOWUxJU1R9JwogICAgICAtICdfQVBQX0VYUEVSSU1FTlRfTE9HR0lOR19QUk9WSURFUj0ke19BUFBfRVhQRVJJTUVOVF9MT0dHSU5HX1BST1ZJREVSfScKICAgICAgLSAnX0FQUF9FWFBFUklNRU5UX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9FWFBFUklNRU5UX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfTkFNRVNQQUNFPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfTkFNRVNQQUNFfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfQ1JFQVRJT05fQUJVU0VfTElNSVQ9JHtfQVBQX0ZVTkNUSU9OU19DUkVBVElPTl9BQlVTRV9MSU1JVH0nCiAgICAgIC0gJ19BUFBfQ1VTVE9NX0RPTUFJTl9ERU5ZX0xJU1Q9JHtfQVBQX0NVU1RPTV9ET01BSU5fREVOWV9MSVNUOi1leGFtcGxlLmNvbSx0ZXN0LmNvbSxhcHAuZXhhbXBsZS5jb219JwogICAgICAtICdfQVBQX1RSVVNURURfSEVBREVSUz0ke19BUFBfVFJVU1RFRF9IRUFERVJTOi14LWZvcndhcmRlZC1mb3J9JwogICAgICAtICdfQVBQX01JR1JBVElPTl9IT1NUPSR7X0FQUF9NSUdSQVRJT05fSE9TVDotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfR0VPX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9HRU8KICAgICAgLSAnX0FQUF9HRU9fRU5EUE9JTlQ9JHtfQVBQX0dFT19FTkRQT0lOVDotaHR0cDovL2FwcHdyaXRlLWdlby92MX0nCiAgICAgIC0gJ19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g9JHtfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIOi0xMDB9JwogICAgICAtICdfQVBQX0RPQ1VNRU5UU0RCPSR7X0FQUF9ET0NVTUVOVFNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1ZFQ1RPUlNEQj0ke19BUFBfVkVDVE9SU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfRU1CRURESU5HPSR7X0FQUF9FTUJFRERJTkc6LWRpc2FibGVkfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXVwbG9hZHM6L3N0b3JhZ2UvdXBsb2FkczpydycKICAgICAgLSAnYXBwd3JpdGUtaW1wb3J0czovc3RvcmFnZS9pbXBvcnRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1jYWNoZTovc3RvcmFnZS9jYWNoZTpydycKICAgICAgLSAnYXBwd3JpdGUtY29uZmlnOi9zdG9yYWdlL2NvbmZpZzpydycKICAgICAgLSAnYXBwd3JpdGUtY2VydGlmaWNhdGVzOi9zdG9yYWdlL2NlcnRpZmljYXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWJ1aWxkczovc3RvcmFnZS9idWlsZHM6cncnCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtZ2VvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWZzUyAtbyAvZGV2L251bGwgaHR0cDovL2xvY2FsaG9zdC92MS9oZWFsdGgvdmVyc2lvbiB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNgogICAgICBzdGFydF9wZXJpb2Q6IDEyMHMKICBhcHB3cml0ZS1jb25zb2xlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9uZXc6MS4xLjE2JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFXzMwMDA9LwogICAgICAtIFZJVEVfQ09OU09MRV9QUk9GSUxFPXNlbGYtaG9zdGVkCiAgICAgIC0gQVBQV1JJVEVfRU5EUE9JTlRfU0FNRV9PUklHSU49dHJ1ZQogICAgICAtICdWSVRFX0dST1dUSF9FTkRQT0lOVD0ke1ZJVEVfR1JPV1RIX0VORFBPSU5UOi1odHRwczovL2dyb3d0aC5hcHB3cml0ZS5pby92MX0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdidW4gLWUgImZldGNoKCcnaHR0cDovL2xvY2FsaG9zdDozMDAwJycpLnRoZW4ociA9PiBwcm9jZXNzLmV4aXQoci5zdGF0dXMgPCA1MDAgPyAwIDogMSkpLmNhdGNoKCgpID0+IHByb2Nlc3MuZXhpdCgxKSkiJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS1yZWFsdGltZToKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi4wLjAnCiAgICBlbnRyeXBvaW50OiByZWFsdGltZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFPS92MS9yZWFsdGltZQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTj0ke19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfSE9TVE5BTUVTPSR7X0FQUF9DT05TT0xFX0hPU1ROQU1FU30nCiAgICAgIC0gJ19BUFBfUkVBTFRJTUVfVEFJTF9SQVRFPSR7X0FQUF9SRUFMVElNRV9UQUlMX1JBVEU6LTUwfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUdfUkVBTFRJTUU9JHtfQVBQX0xPR0dJTkdfQ09ORklHX1JFQUxUSU1FfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSD0ke19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g6LTEwMH0nCiAgICAgIC0gJ19BUFBfRE9DVU1FTlRTREI9JHtfQVBQX0RPQ1VNRU5UU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfVkVDVE9SU0RCPSR7X0FQUF9WRUNUT1JTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9FTUJFRERJTkc9JHtfQVBQX0VNQkVERElORzotZGlzYWJsZWR9JwogICAgICAtIF9BUFBfUE9PTF9BREFQVEVSPXN3b29sZQogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1zIGxvY2FsaG9zdCA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLXdvcmtlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi4wLjAnCiAgICBlbnRyeXBvaW50OiB3b3JrZXIKICAgIGVudmlyb25tZW50OgogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9FWEVDVVRJT05TX0RVQUxfV1JJVEU9JHtfQVBQX0VYRUNVVElPTlNfRFVBTF9XUklURTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfRVhFQ1VUSU9OUz1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM9JHtfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TOi0yfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMOi0xODB9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU6LXYxLXN0YXRzLXJlc291cmNlc30nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw6LTM2MDB9JwogICAgICAtIF9BUFBfV09SS0VSU19OVU09MQogICAgICAtIF9BUFBfV09SS0VSX01BWF9DT1JPVVRJTkVTPTc4CiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX1BPT0xfQURBUFRFUj0ke19BUFBfUE9PTF9BREFQVEVSOi1zdGFja30nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX0VNQUlMX1NFQ1VSSVRZPSR7X0FQUF9FTUFJTF9TRUNVUklUWTotc2VjdXJpdHlAYXBwd3JpdGUuaW99JwogICAgICAtICdfQVBQX0VNQUlMX0NFUlRJRklDQVRFUz0ke19BUFBfRU1BSUxfQ0VSVElGSUNBVEVTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0NPTkZJRz0ke19BUFBfTE9HR0lOR19DT05GSUd9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSAnX0FQUF9MT0dHSU5HX1BST1ZJREVSPSR7X0FQUF9MT0dHSU5HX1BST1ZJREVSfScKICAgICAgLSAnX0FQUF9RVUVVRV9OQU1FPSR7X0FQUF9RVUVVRV9OQU1FfScKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSBfQVBQX0NPTlNPTEVfVVJMX1NDSEVNRT1yb290CiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9PUFRJT05TX1JPVVRFUl9GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9XRUJIT09LX01BWF9GQUlMRURfQVRURU1QVFM9JHtfQVBQX1dFQkhPT0tfTUFYX0ZBSUxFRF9BVFRFTVBUUzotMTB9JwogICAgICAtICdfQVBQX1NUT1JBR0VfREVWSUNFPSR7X0FQUF9TVE9SQUdFX0RFVklDRTotbG9jYWx9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9TM19TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9TM19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlQ9JHtfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9ET19TUEFDRVNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT049JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfUkVHSU9OOi11cy13ZXN0LTAwNH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9MSU5PREVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT049JHtfQVBQX1NUT1JBR0VfTElOT0RFX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9XQVNBQklfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUPSR7X0FQUF9TVE9SQUdFX1dBU0FCSV9TRUNSRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9XQVNBQklfUkVHSU9OOi1ldS1jZW50cmFsLTF9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfQlVDS0VUfScKICAgICAgLSBfQVBQX0VYRUNVVE9SX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9FWEVDVVRPUgogICAgICAtICdfQVBQX0VYRUNVVE9SX0hPU1Q9JHtfQVBQX0VYRUNVVE9SX0hPU1Q6LWh0dHA6Ly9vcGVucnVudGltZXMtZXhlY3V0b3IvdjF9JwogICAgICAtICdfQVBQX0RPQ0tFUl9IVUJfVVNFUk5BTUU9JHtfQVBQX0RPQ0tFUl9IVUJfVVNFUk5BTUV9JwogICAgICAtICdfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkQ9JHtfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkR9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19USU1FT1VUPSR7X0FQUF9GVU5DVElPTlNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9TSVRFU19USU1FT1VUPSR7X0FQUF9TSVRFU19USU1FT1VUOi05MDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVD0ke19BUFBfQ09NUFVURV9CVUlMRF9USU1FT1VUOi0yNzAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0NQVVM9JHtfQVBQX0NPTVBVVEVfQ1BVUzotMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9NRU1PUlk9JHtfQVBQX0NPTVBVVEVfTUVNT1JZOi0wfScKICAgICAgLSAnX0FQUF9PUEVOX1JVTlRJTUVTX05GVD0ke19BUFBfT1BFTl9SVU5USU1FU19ORlQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0NPTVBVVEVfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9TSVpFX0xJTUlUOi0zMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9BUFBfTkFNRT0ke19BUFBfVkNTX0dJVEhVQl9BUFBfTkFNRX0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX0dJVEhVQl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEhVQl9BUFBfSUQ9JHtfQVBQX1ZDU19HSVRIVUJfQVBQX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRFQV9CUk9XU0VSX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEVBX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9XRUJIT09LX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0VORFBPSU5UPSR7X0FQUF9WQ1NfR0lUTEFCX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVExBQl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUTEFCX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX1dFQkhPT0tfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfQklUQlVDS0VUX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX1dFQkhPT0tfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRD0ke19BUFBfVkNTX09SSUdJTl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fUFJJVkFURV9LRVk9JHtfQVBQX1ZDU19PUklHSU5fUFJJVkFURV9LRVl9JwogICAgICAtICdfQVBQX1ZDU19XRUJIT09LX1VSTD0ke19BUFBfVkNTX1dFQkhPT0tfVVJMfScKICAgICAgLSAnX0FQUF9CVUlMRFNfVk9MVU1FPSR7Q09NUE9TRV9QUk9KRUNUX05BTUV9X2FwcHdyaXRlLWJ1aWxkcycKICAgICAgLSAnX0FQUF9KT0JTX0hPU1Q9JHtfQVBQX0pPQlNfSE9TVDotaHR0cDovL29yY2hlc3RyYXRvcjo4MDgwfScKICAgICAgLSBfQVBQX0pPQlNfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0pPQlMKICAgICAgLSAnX0FQUF9KT0JTX0VORFBPSU5UPSR7X0FQUF9KT0JTX0VORFBPSU5UOi1odHRwOi8vYXBwd3JpdGV9JwogICAgICAtICdfQVBQX0JST1dTRVJfSE9TVD0ke19BUFBfQlJPV1NFUl9IT1NUOi1odHRwOi8vYXBwd3JpdGUtYnJvd3NlcjozMDAwL3YxfScKICAgICAgLSAnX0FQUF9XT1JLRVJfU0NSRUVOU0hPVFNfUk9VVEVSPSR7X0FQUF9XT1JLRVJfU0NSRUVOU0hPVFNfUk9VVEVSOi1odHRwOi8vYXBwd3JpdGV9JwogICAgICAtIF9BUFBfTk9USUZJQ0FUSU9OU19UUkFDS0lOR19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfTk9USUZJQ0FUSU9OUwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9OQU1FPSR7X0FQUF9TWVNURU1fRU1BSUxfTkFNRTotQXBwd3JpdGV9JwogICAgICAtICdfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTPSR7X0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUzotbm9yZXBseUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU01UUF9IT1NUPSR7X0FQUF9TTVRQX0hPU1R9JwogICAgICAtICdfQVBQX1NNVFBfUE9SVD0ke19BUFBfU01UUF9QT1JUfScKICAgICAgLSAnX0FQUF9TTVRQX1NFQ1VSRT0ke19BUFBfU01UUF9TRUNVUkV9JwogICAgICAtICdfQVBQX1NNVFBfVVNFUk5BTUU9JHtfQVBQX1NNVFBfVVNFUk5BTUV9JwogICAgICAtICdfQVBQX1NNVFBfUEFTU1dPUkQ9JHtfQVBQX1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdfQVBQX1NNU19GUk9NPSR7X0FQUF9TTVNfRlJPTX0nCiAgICAgIC0gJ19BUFBfU01TX1BST1ZJREVSPSR7X0FQUF9TTVNfUFJPVklERVJ9JwogICAgICAtICdfQVBQX1NNU19QUk9KRUNUU19ERU5ZX0xJU1Q9JHtfQVBQX1NNU19QUk9KRUNUU19ERU5ZX0xJU1R9JwogICAgICAtICdfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfU0VDUkVUPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX01JR1JBVElPTl9IT1NUPSR7X0FQUF9NSUdSQVRJT05fSE9TVDotYXBwd3JpdGV9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEV9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICB2b2x1bWVzOgogICAgICAtICdhcHB3cml0ZS11cGxvYWRzOi9zdG9yYWdlL3VwbG9hZHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWltcG9ydHM6L3N0b3JhZ2UvaW1wb3J0czpydycKICAgICAgLSAnYXBwd3JpdGUtY2FjaGU6L3N0b3JhZ2UvY2FjaGU6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNvbmZpZzovc3RvcmFnZS9jb25maWc6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNlcnRpZmljYXRlczovc3RvcmFnZS9jZXJ0aWZpY2F0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWZ1bmN0aW9uczovc3RvcmFnZS9mdW5jdGlvbnM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLXNpdGVzOi9zdG9yYWdlL3NpdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1idWlsZHM6L3N0b3JhZ2UvYnVpbGRzOnJ3JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9wZW5ydW50aW1lcy1leGVjdXRvcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBvcmNoZXN0cmF0b3I6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAicHMgYXV4IHwgZ3JlcCAtcSAnW3BdaHAnIHx8IGV4aXQgMSIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtdGFzay1zY2hlZHVsZXI6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW50cnlwb2ludDogc2NoZWR1bGUKICAgIGVudmlyb25tZW50OgogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9FWEVDVVRJT05TX0RVQUxfV1JJVEU9JHtfQVBQX0VYRUNVVElPTlNfRFVBTF9XUklURTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfRVhFQ1VUSU9OUz1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM9JHtfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TOi0yfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfVFRMOi0xODB9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU6LXYxLXN0YXRzLXJlc291cmNlc30nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw6LTM2MDB9JwogICAgICAtICdfQVBQX0xPR0dJTkdfRk9STUFUPSR7X0FQUF9MT0dHSU5HX0ZPUk1BVDotcHJldHR5fScKICAgICAgLSBfQVBQX1dPUktFUl9NQVhfQ09ST1VUSU5FUz04CiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX1BPT0xfQURBUFRFUj0ke19BUFBfUE9PTF9BREFQVEVSOi1zdGFja30nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX09QVElPTlNfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfRk9SQ0VfSFRUUFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ9JHtfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ6LTB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLW1haW50ZW5hbmNlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjAuMCcKICAgIGVudHJ5cG9pbnQ6IG1haW50ZW5hbmNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9QT09MX0FEQVBURVI9JHtfQVBQX1BPT0xfQURBUFRFUjotc3RhY2t9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NOQU1FPSR7X0FQUF9ET01BSU5fVEFSR0VUX0NOQU1FOi1sb2NhbGhvc3R9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBOi06OjF9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9BOi0xMjcuMC4wLjF9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0NBQX0nCiAgICAgIC0gJ19BUFBfRE5TPSR7X0FQUF9ETlN9JwogICAgICAtICdfQVBQX0RPTUFJTl9GVU5DVElPTlM9JHtfQVBQX0RPTUFJTl9GVU5DVElPTlM6LWZ1bmN0aW9ucy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9FRElUSU9OPSR7X0FQUF9FRElUSU9OOi1zZWxmLWhvc3RlZH0nCiAgICAgIC0gJ19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTPSR7X0FQUF9ST1VURVJfQVVUT19DRVJUSUZJQ0FURVM6LWRpc2FibGVkfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9JTlRFUlZBTD0ke19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw6LTg2NDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fRVhFQ1VUSU9OPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fRVhFQ1VUSU9OOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9DQUNIRTotMjU5MjAwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQUJVU0U6LTg2NDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVDotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEU9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfSE9VUkxZPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fVVNBR0VfSE9VUkxZOi04NjQwMDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fU0NIRURVTEVTPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fU0NIRURVTEVTOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfU1RBUlRfVElNRT0ke19BUFBfTUFJTlRFTkFOQ0VfU1RBUlRfVElNRX0nCiAgICAgIC0gJ19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFUz0ke19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFU30nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgLXEgJ1twXWhwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLXRhc2staW50ZXJ2YWw6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuMC4wJwogICAgZW50cnlwb2ludDogaW50ZXJ2YWwKICAgIGVudmlyb25tZW50OgogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfV09SS0VSX1BFUl9DT1JFPSR7X0FQUF9XT1JLRVJfUEVSX0NPUkU6LTZ9JwogICAgICAtICdfQVBQX1BPT0xfQURBUFRFUj0ke19BUFBfUE9PTF9BREFQVEVSOi1zdGFja30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTPSR7X0FQUF9EQVRBQkFTRV9TSEFSRURfVEFCTEVTfScKICAgICAgLSAnX0FQUF9JTlRFUlZBTF9ET01BSU5fVkVSSUZJQ0FUSU9OPSR7X0FQUF9JTlRFUlZBTF9ET01BSU5fVkVSSUZJQ0FUSU9OOi0xMjB9JwogICAgICAtICdfQVBQX0lOVEVSVkFMX0NMRUFOVVBfU1RBTEVfRVhFQ1VUSU9OUz0ke19BUFBfSU5URVJWQUxfQ0xFQU5VUF9TVEFMRV9FWEVDVVRJT05TOi0zMDB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS1nZW86CiAgICBpbWFnZTogJ2FwcHdyaXRlL2dlbzowLjMuMScKICAgIGVudmlyb25tZW50OgogICAgICAtIEdFT19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfR0VPCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBocCAtciBcImV4aXQoanNvbl9kZWNvZGUoZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9sb2NhbGhvc3QvdjEvaGVhbHRoJykpLT5zdGF0dXMgPT09ICdvaycgPyAwIDogMSk7XCIiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGFwcHdyaXRlLWFzc2lzdGFudDoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXNzaXN0YW50OjAuOC40JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfQVNTSVNUQU5UX09QRU5BSV9BUElfS0VZPSR7X0FQUF9BU1NJU1RBTlRfT1BFTkFJX0FQSV9LRVl9JwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgYXBwd3JpdGUtYnJvd3NlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYnJvd3NlcjowLjMuNCcKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogIG9wZW5ydW50aW1lcy1leGVjdXRvcjoKICAgIGltYWdlOiAnb3BlbnJ1bnRpbWVzL2V4ZWN1dG9yOjAuMjkuMCcKICAgIGhvc3RuYW1lOiBvcGVucnVudGltZXMtZXhlY3V0b3IKICAgIHN0b3Bfc2lnbmFsOiBTSUdJTlQKICAgIGVudmlyb25tZW50OgogICAgICAtICdPUFJfRVhFQ1VUT1JfSU1BR0VTPSR7X0FQUF9FWEVDVVRPUl9JTUFHRVM6LW9wZW5ydW50aW1lcy9ub2RlOnY1LTIyLG9wZW5ydW50aW1lcy9zdGF0aWM6djUtMX0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9JTkFDVElWRV9USFJFU0hPTEQ9JHtfQVBQX0NPTVBVVEVfSU5BQ1RJVkVfVEhSRVNIT0xEOi02MDB9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX0NPTVBVVEVfTUFJTlRFTkFOQ0VfSU5URVJWQUw6LTYwMH0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9ORVRXT1JLPSR7X0FQUF9DT01QVVRFX1JVTlRJTUVTX05FVFdPUks6LXJ1bnRpbWVzfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0RPQ0tFUl9IVUJfVVNFUk5BTUU9JHtfQVBQX0RPQ0tFUl9IVUJfVVNFUk5BTUV9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfRE9DS0VSX0hVQl9QQVNTV09SRD0ke19BUFBfRE9DS0VSX0hVQl9QQVNTV09SRH0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9SVU5USU1FUz0ke19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTOi1ub2RlLTIyfSwke19BUFBfU0lURVNfUlVOVElNRVM6LXN0YXRpYy0xLG5vZGUtMjJ9JwogICAgICAtIE9QUl9FWEVDVVRPUl9TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfRVhFQ1VUT1IKICAgICAgLSBPUFJfRVhFQ1VUT1JfUlVOVElNRV9WRVJTSU9OUz12NQogICAgICAtICdPUEVOX1JVTlRJTUVTX05GVD0ke19BUFBfT1BFTl9SVU5USU1FU19ORlQ6LWVuYWJsZWR9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0NPTk5FQ1RJT05fU1RPUkFHRT0ke19BUFBfRVhFQ1VUT1JfQ09OTkVDVElPTl9TVE9SQUdFOi1sb2NhbDovL2xvY2FsaG9zdH0nCiAgICAgIC0gT1BSX0VYRUNVVE9SX0NPTk5FQ1RJT05fQlVJTERfQ0FDSEVfU1RPUkFHRT0KICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAtICdhcHB3cml0ZS1idWlsZHM6L3N0b3JhZ2UvYnVpbGRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1mdW5jdGlvbnM6L3N0b3JhZ2UvZnVuY3Rpb25zOnJ3JwogICAgICAtICdhcHB3cml0ZS1zaXRlczovc3RvcmFnZS9zaXRlczpydycKICAgICAgLSAnL3RtcDovdG1wOnJ3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mc1MgLUggIkF1dGhvcml6YXRpb246IEJlYXJlciAkJE9QUl9FWEVDVVRPUl9TRUNSRVQiIGh0dHA6Ly9sb2NhbGhvc3QvdjEvaGVhbHRoID4gL2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgb3JjaGVzdHJhdG9yOgogICAgaW1hZ2U6ICdnaGNyLmlvL29wZW4tcnVudGltZXMvb3JjaGVzdHJhdG9yL29yY2hlc3RyYXRvcjoyLjAuMScKICAgIGhvc3RuYW1lOiBvcmNoZXN0cmF0b3IKICAgIHVzZXI6IHJvb3QKICAgIGVudmlyb25tZW50OgogICAgICAtIE9SQ0hFU1RSQVRPUl9CQUNLRU5EPWRvY2tlcgogICAgICAtICdPUkNIRVNUUkFUT1JfTkVUV09SSz0ke0NPTVBPU0VfUFJPSkVDVF9OQU1FfScKICAgICAgLSAnRE9DS0VSX05FVFdPUks9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX0nCiAgICAgIC0gJ0FSVElGQUNUX0VORFBPSU5UPWh0dHA6Ly9vcmNoZXN0cmF0b3I6ODA4MCcKICAgICAgLSAnUzNfRU5EUE9JTlQ9JHtfQVBQX1NUT1JBR0VfUzNfRU5EUE9JTlR9JwogICAgICAtICdTM19SRUdJT049JHtfQVBQX1NUT1JBR0VfUzNfUkVHSU9OOi11cy1lYXN0LTF9JwogICAgICAtICdTM19BQ0NFU1NfS0VZX0lEPSR7X0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVl9JwogICAgICAtICdTM19TRUNSRVRfQUNDRVNTX0tFWT0ke19BUFBfU1RPUkFHRV9TM19TRUNSRVR9JwogICAgdm9sdW1lczoKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL2tvLWFwcC9vcmNoZXN0cmF0b3IKICAgICAgICAtICctY2hlY2stcmVhZHknCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGFwcHdyaXRlLXBvc3RncmVzcWw6CiAgICBpbWFnZTogJ2FwcHdyaXRlL3Bvc3RncmVzOjAuMS4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBQT1NUR1JFU19VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBQT1NUR1JFU19QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtcG9zdGdyZXNxbDovdmFyL2xpYi9wb3N0Z3Jlc3FsOnJ3JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGFwcHdyaXRlLXJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQuNy1hbHBpbmUnCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tbWF4bWVtb3J5IDUxMm1iIC0tbWF4bWVtb3J5LXBvbGljeSBhbGxrZXlzLWxydSAtLW1heG1lbW9yeS1zYW1wbGVzIDUnCiAgICB2b2x1bWVzOgogICAgICAtICdhcHB3cml0ZS1yZWRpczovZGF0YTpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQogIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICBpbWFnZTogJ2NsaWNraG91c2UvY2xpY2tob3VzZS1zZXJ2ZXI6MjYuNC4zLWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtIENMSUNLSE9VU0VfREI9YXBwd3JpdGUKICAgICAgLSBDTElDS0hPVVNFX1VTRVI9YXBwd3JpdGUKICAgICAgLSBDTElDS0hPVVNFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSBDTElDS0hPVVNFX0RFRkFVTFRfQUNDRVNTX01BTkFHRU1FTlQ9MQogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtY2xpY2tob3VzZTovdmFyL2xpYi9jbGlja2hvdXNlOnJ3JwogICAgdWxpbWl0czoKICAgICAgbm9maWxlOgogICAgICAgIHNvZnQ6IDI2MjE0NAogICAgICAgIGhhcmQ6IDI2MjE0NAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjbGlja2hvdXNlLWNsaWVudCAtLXVzZXIgIiQkQ0xJQ0tIT1VTRV9VU0VSIiAtLXBhc3N3b3JkICIkJENMSUNLSE9VU0VfUEFTU1dPUkQiIC0tcXVlcnkgIlNFTEVDVCAxIiA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMjAKICAgICAgc3RhcnRfcGVyaW9kOiAzMHMK",
+        "compose": "c2VydmljZXM6CiAgYXBwd3JpdGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL2FwcHdyaXRlOjIuNS4wJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFPS92MQogICAgICAtICdfQVBQX0ROU19FWFRFUk5BTD0ke19BUFBfRE5TX0VYVEVSTkFMfScKICAgICAgLSAnX0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFUz0ke19BUFBfQUxMT1dFRF9JTlRFUk5BTF9BRERSRVNTRVN9JwogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtIF9BUFBfVVNBR0VfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREJfVVNBR0U9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9VU0FHRT0ke19BUFBfUE9PTF9TSVpFX1VTQUdFOi0yfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9FWEVDVVRJT05TPWh0dHA6Ly9hcHB3cml0ZTokU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFQGFwcHdyaXRlLWNsaWNraG91c2U6ODEyMy9hcHB3cml0ZScKICAgICAgLSAnX0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUz0ke19BUFBfUE9PTF9TSVpFX0VYRUNVVElPTlM6LTJ9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9UVEw9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9VU0FHRV9UVEw6LTE4MH0nCiAgICAgIC0gJ19BUFBfU1RBVFNfVVNBR0VfUVVFVUVfTkFNRT0ke19BUFBfU1RBVFNfVVNBR0VfUVVFVUVfTkFNRTotdjEtc3RhdHMtdXNhZ2V9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19SRVNPVVJDRVNfUVVFVUVfTkFNRTotdjEtc3RhdHMtcmVzb3VyY2VzfScKICAgICAgLSAnX0FQUF9TVEFUU19SRVNPVVJDRVNfSU5URVJWQUw9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTDotMzYwMH0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9MT0NBTEU9JHtfQVBQX0xPQ0FMRTotZW59JwogICAgICAtICdfQVBQX0NPTVBSRVNTSU9OX0VOQUJMRUQ9JHtfQVBQX0NPTVBSRVNTSU9OX0VOQUJMRUQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX0NPTVBSRVNTSU9OX01JTl9TSVpFX0JZVEVTPSR7X0FQUF9DT01QUkVTU0lPTl9NSU5fU0laRV9CWVRFU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9XSElURUxJU1RfUk9PVD0ke19BUFBfQ09OU09MRV9XSElURUxJU1RfUk9PVDotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9XSElURUxJU1RfRU1BSUxTPSR7X0FQUF9DT05TT0xFX1dISVRFTElTVF9FTUFJTFN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0VTU0lPTl9BTEVSVFM9JHtfQVBQX0NPTlNPTEVfU0VTU0lPTl9BTEVSVFM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1dISVRFTElTVF9JUFM9JHtfQVBQX0NPTlNPTEVfV0hJVEVMSVNUX0lQU30nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9IT1NUTkFNRVM9JHtfQVBQX0NPTlNPTEVfSE9TVE5BTUVTfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1NDSEVNQT0ke19BUFBfQ09OU09MRV9TQ0hFTUE6LWFwcHdyaXRlaW99JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUSFVCX0FQUF9JRD0ke19BUFBfQ09OU09MRV9HSVRIVUJfQVBQX0lEfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVEhVQl9TRUNSRVQ9JHtfQVBQX0NPTlNPTEVfR0lUSFVCX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HSVRMQUJfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dJVExBQl9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR0lUTEFCX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HSVRMQUJfU0VDUkVUfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0dJVExBQl9FTkRQT0lOVD0ke19BUFBfQ09OU09MRV9HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQklUQlVDS0VUX0FQUF9JRD0ke19BUFBfQ09OU09MRV9CSVRCVUNLRVRfQVBQX0lEfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0JJVEJVQ0tFVF9TRUNSRVQ9JHtfQVBQX0NPTlNPTEVfQklUQlVDS0VUX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9HT09HTEVfQVBQX0lEPSR7X0FQUF9DT05TT0xFX0dPT0dMRV9BUFBfSUR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfR09PR0xFX1NFQ1JFVD0ke19BUFBfQ09OU09MRV9HT09HTEVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TWVNURU1fRU1BSUxfTkFNRT0ke19BUFBfU1lTVEVNX0VNQUlMX05BTUU6LUFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9TWVNURU1fRU1BSUxfQUREUkVTUz0ke19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M6LW5vcmVwbHlAYXBwd3JpdGUuaW99JwogICAgICAtICdfQVBQX1NZU1RFTV9URUFNX0VNQUlMPSR7X0FQUF9TWVNURU1fVEVBTV9FTUFJTDotdGVhbUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfU1lTVEVNX1JFU1BPTlNFX0ZPUk1BVD0ke19BUFBfU1lTVEVNX1JFU1BPTlNFX0ZPUk1BVH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRV9JTkNSRUFTRURfTElNSVRfUFJPSkVDVFM9JHtfQVBQX09QVElPTlNfQUJVU0VfSU5DUkVBU0VEX0xJTUlUX1BST0pFQ1RTfScKICAgICAgLSAnX0FQUF9PUFRJT05TX1JPVVRFUl9QUk9URUNUSU9OPSR7X0FQUF9PUFRJT05TX1JPVVRFUl9QUk9URUNUSU9OOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX1JPVVRFUl9GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUz0ke19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTOi1kaXNhYmxlZH0nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtIF9BUFBfTk9USUZJQ0FUSU9OU19UUkFDS0lOR19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfTk9USUZJQ0FUSU9OUwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfVVJMPSR7X0FQUF9DT05TT0xFX1VSTH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9UUlVTVEVEX1BST0pFQ1RTPSR7X0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFN9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX1NNVFBfSE9TVD0ke19BUFBfU01UUF9IT1NUfScKICAgICAgLSAnX0FQUF9TTVRQX1BPUlQ9JHtfQVBQX1NNVFBfUE9SVH0nCiAgICAgIC0gJ19BUFBfU01UUF9TRUNVUkU9JHtfQVBQX1NNVFBfU0VDVVJFfScKICAgICAgLSAnX0FQUF9TTVRQX1VTRVJOQU1FPSR7X0FQUF9TTVRQX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9TTVRQX1BBU1NXT1JEPSR7X0FQUF9TTVRQX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTUlUPSR7X0FQUF9TVE9SQUdFX0xJTUlUOi0zMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9QUkVWSUVXX0xJTUlUPSR7X0FQUF9TVE9SQUdFX1BSRVZJRVdfTElNSVQ6LTIwMDAwMDAwfScKICAgICAgLSAnX0FQUF9BVVRPR1JBVklUWV9IT1NUPSR7X0FQUF9BVVRPR1JBVklUWV9IT1NUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVUz0ke19BUFBfU1RPUkFHRV9BTlRJVklSVVM6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVU19IT1NUPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVU19IT1NUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0FOVElWSVJVU19QT1JUPSR7X0FQUF9TVE9SQUdFX0FOVElWSVJVU19QT1JUOi0zMzEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9TSVpFX0xJTUlUPSR7X0FQUF9DT01QVVRFX1NJWkVfTElNSVQ6LTMwMDAwMDAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVDotMjAwMDAwMDAwMH0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ9JHtfQVBQX0ZVTkNUSU9OU19USU1FT1VUOi05MDB9JwogICAgICAtICdfQVBQX1NJVEVTX1RJTUVPVVQ9JHtfQVBQX1NJVEVTX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9CVUlMRF9USU1FT1VUPSR7X0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ6LTI3MDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQ1BVUz0ke19BUFBfQ09NUFVURV9DUFVTOi0wfScKICAgICAgLSAnX0FQUF9DT01QVVRFX01FTU9SWT0ke19BUFBfQ09NUFVURV9NRU1PUlk6LTB9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19SVU5USU1FUz0ke19BUFBfRlVOQ1RJT05TX1JVTlRJTUVTOi1ub2RlLTIyfScKICAgICAgLSAnX0FQUF9TSVRFU19SVU5USU1FUz0ke19BUFBfU0lURVNfUlVOVElNRVM6LXN0YXRpYy0xLG5vZGUtMjJ9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSBfQVBQX0VYRUNVVE9SX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9FWEVDVVRPUgogICAgICAtICdfQVBQX0VYRUNVVE9SX0hPU1Q9JHtfQVBQX0VYRUNVVE9SX0hPU1Q6LWh0dHA6Ly9vcGVucnVudGltZXMtZXhlY3V0b3IvdjF9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19DT05GSUc9JHtfQVBQX0xPR0dJTkdfQ09ORklHfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gJ19BUFBfTE9DS0lOR19FTkFCTEVEPSR7X0FQUF9MT0NLSU5HX0VOQUJMRUQ6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9NQUlOVEVOQU5DRV9JTlRFUlZBTDotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9FWEVDVVRJT049JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9FWEVDVVRJT046LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9DQUNIRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFOi0yNTkyMDAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQUJVU0U9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRTotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUOi0xMjA5NjAwfScKICAgICAgLSAnX0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUX0NPTlNPTEV9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9TQ0hFRFVMRVM9JHtfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9TQ0hFRFVMRVM6LTg2NDAwfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9HUkFQSFFMX0lOVFJPU1BFQ1RJT049JHtfQVBQX0dSQVBIUUxfSU5UUk9TUEVDVElPTjotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfQkFUQ0hfU0laRT0ke19BUFBfR1JBUEhRTF9NQVhfQkFUQ0hfU0laRTotMTB9JwogICAgICAtICdfQVBQX0dSQVBIUUxfTUFYX0NPTVBMRVhJVFk9JHtfQVBQX0dSQVBIUUxfTUFYX0NPTVBMRVhJVFk6LTI1MH0nCiAgICAgIC0gJ19BUFBfR1JBUEhRTF9NQVhfREVQVEg9JHtfQVBQX0dSQVBIUUxfTUFYX0RFUFRIOi0zfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRIVUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke19BUFBfVkNTX0dJVEhVQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0NMSUVOVF9JRD0ke19BUFBfVkNTX0dJVEhVQl9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfU0VDUkVUPSR7X0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfQ09VTlRSSUVTX0RFTllMSVNUPSR7X0FQUF9DT05TT0xFX0NPVU5UUklFU19ERU5ZTElTVH0nCiAgICAgIC0gJ19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFUz0ke19BUFBfREFUQUJBU0VfU0hBUkVEX1RBQkxFU30nCiAgICAgIC0gJ19BUFBfREFUQUJBU0VfU0hBUkVEX05BTUVTUEFDRT0ke19BUFBfREFUQUJBU0VfU0hBUkVEX05BTUVTUEFDRX0nCiAgICAgIC0gJ19BUFBfRlVOQ1RJT05TX0NSRUFUSU9OX0FCVVNFX0xJTUlUPSR7X0FQUF9GVU5DVElPTlNfQ1JFQVRJT05fQUJVU0VfTElNSVR9JwogICAgICAtICdfQVBQX0NVU1RPTV9ET01BSU5fREVOWV9MSVNUPSR7X0FQUF9DVVNUT01fRE9NQUlOX0RFTllfTElTVDotZXhhbXBsZS5jb20sdGVzdC5jb20sYXBwLmV4YW1wbGUuY29tfScKICAgICAgLSAnX0FQUF9UUlVTVEVEX0hFQURFUlM9JHtfQVBQX1RSVVNURURfSEVBREVSUzoteC1mb3J3YXJkZWQtZm9yfScKICAgICAgLSAnX0FQUF9UUlVTVEVEX1BST1hJRVM9JHtfQVBQX1RSVVNURURfUFJPWElFUzotMTI3LjAuMC4xLDo6MSwxMC4wLjAuMC84LDEwMC42NC4wLjAvMTAsMTcyLjE2LjAuMC8xMiwxOTIuMTY4LjAuMC8xNn0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9HRU9fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0dFTwogICAgICAtICdfQVBQX0dFT19FTkRQT0lOVD0ke19BUFBfR0VPX0VORFBPSU5UOi1odHRwOi8vYXBwd3JpdGUtZ2VvL3YxfScKICAgICAgLSAnX0FQUF9QV05FRF9QQVNTV09SRFNfRFNOPSR7X0FQUF9QV05FRF9QQVNTV09SRFNfRFNOOi1ub25lOi8vbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSD0ke19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g6LTEwMH0nCiAgICAgIC0gJ19BUFBfRE9DVU1FTlRTREI9JHtfQVBQX0RPQ1VNRU5UU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfVkVDVE9SU0RCPSR7X0FQUF9WRUNUT1JTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9FTUJFRERJTkc9JHtfQVBQX0VNQkVERElORzotZGlzYWJsZWR9JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtdXBsb2Fkczovc3RvcmFnZS91cGxvYWRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1pbXBvcnRzOi9zdG9yYWdlL2ltcG9ydHM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWNhY2hlOi9zdG9yYWdlL2NhY2hlOnJ3JwogICAgICAtICdhcHB3cml0ZS1jb25maWc6L3N0b3JhZ2UvY29uZmlnOnJ3JwogICAgICAtICdhcHB3cml0ZS1jZXJ0aWZpY2F0ZXM6L3N0b3JhZ2UvY2VydGlmaWNhdGVzOnJ3JwogICAgICAtICdhcHB3cml0ZS1mdW5jdGlvbnM6L3N0b3JhZ2UvZnVuY3Rpb25zOnJ3JwogICAgICAtICdhcHB3cml0ZS1zaXRlczovc3RvcmFnZS9zaXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgIGRlcGVuZHNfb246CiAgICAgIGFwcHdyaXRlLXBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtcmVkaXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgYXBwd3JpdGUtY2xpY2tob3VzZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1nZW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1vIC9kZXYvbnVsbCBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aC92ZXJzaW9uIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA2CiAgICAgIHN0YXJ0X3BlcmlvZDogMTIwcwogIGFwcHdyaXRlLWNvbnNvbGU6CiAgICBpbWFnZTogJ2FwcHdyaXRlL25ldzoxLjIuNzQtc2VsZi1ob3N0ZWQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fQVBQV1JJVEVfMzAwMD0vCiAgICAgIC0gVklURV9DT05TT0xFX1BST0ZJTEU9c2VsZi1ob3N0ZWQKICAgICAgLSBWSVRFX0FQUFdSSVRFX1ZFUlNJT049Mi41LjAKICAgICAgLSBBUFBXUklURV9FTkRQT0lOVF9TQU1FX09SSUdJTj10cnVlCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdidW4gLWUgImZldGNoKCcnaHR0cDovL2xvY2FsaG9zdDozMDAwJycpLnRoZW4ociA9PiBwcm9jZXNzLmV4aXQoci5zdGF0dXMgPCA1MDAgPyAwIDogMSkpLmNhdGNoKCgpID0+IHByb2Nlc3MuZXhpdCgxKSkiJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS1yZWFsdGltZToKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi41LjAnCiAgICBlbnRyeXBvaW50OiByZWFsdGltZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0FQUFdSSVRFPS92MS9yZWFsdGltZQogICAgICAtICdfQVBQX0VOVj0ke19BUFBfRU5WOi1wcm9kdWN0aW9ufScKICAgICAgLSAnX0FQUF9VU0FHRV9TVEFUUz0ke19BUFBfVVNBR0VfU1RBVFM6LWVuYWJsZWR9JwogICAgICAtICdfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1VTQUdFX1FVRVVFX05BTUU6LXYxLXN0YXRzLXVzYWdlfScKICAgICAgLSAnX0FQUF9XT1JLRVJfUEVSX0NPUkU9JHtfQVBQX1dPUktFUl9QRVJfQ09SRTotNn0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19BQlVTRT0ke19BUFBfT1BUSU9OU19BQlVTRTotZW5hYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTj0ke19BUFBfT1BUSU9OU19ST1VURVJfUFJPVEVDVElPTjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0NPTlNPTEVfSE9TVE5BTUVTPSR7X0FQUF9DT05TT0xFX0hPU1ROQU1FU30nCiAgICAgIC0gJ19BUFBfUkVBTFRJTUVfVEFJTF9SQVRFPSR7X0FQUF9SRUFMVElNRV9UQUlMX1JBVEU6LTUwfScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9IRUFERVJTPSR7X0FQUF9UUlVTVEVEX0hFQURFUlM6LXgtZm9yd2FyZGVkLWZvcn0nCiAgICAgIC0gJ19BUFBfVFJVU1RFRF9QUk9YSUVTPSR7X0FQUF9UUlVTVEVEX1BST1hJRVM6LTEyNy4wLjAuMSw6OjEsMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4xNi4wLjAvMTIsMTkyLjE2OC4wLjAvMTZ9JwogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI9JHtfQVBQX0RCX0FEQVBURVJfVkVDVE9SU0RCOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQj0ke19BUFBfREJfSE9TVF9WRUNUT1JTREI6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlRfVkVDVE9SU0RCPSR7X0FQUF9EQl9QT1JUX1ZFQ1RPUlNEQjotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQj0ke19BUFBfREJfU0NIRU1BX1ZFQ1RPUlNEQjotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUl9WRUNUT1JTREI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTU19WRUNUT1JTREI9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9BREFQVEVSX0RPQ1VNRU5UU0RCOi1tb25nb2RifScKICAgICAgLSAnX0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9IT1NUX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9QT1JUX0RPQ1VNRU5UU0RCOi0yNzAxN30nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BX0RPQ1VNRU5UU0RCPSR7X0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1VTRVJfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BBU1NfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfVkVDVE9SU0RCPSR7X0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREJ9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIPSR7X0FQUF9MSU1JVF9EQVRBQkFTRV9CQVRDSDotMTAwfScKICAgICAgLSAnX0FQUF9ET0NVTUVOVFNEQj0ke19BUFBfRE9DVU1FTlRTREI6LWRpc2FibGVkfScKICAgICAgLSAnX0FQUF9WRUNUT1JTREI9JHtfQVBQX1ZFQ1RPUlNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0VNQkVERElORz0ke19BUFBfRU1CRURESU5HOi1kaXNhYmxlZH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLXMgbG9jYWxob3N0ID4gL2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgYXBwd3JpdGUtd29ya2VyOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IHdvcmtlcgogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX0ROU19FWFRFUk5BTD0ke19BUFBfRE5TX0VYVEVSTkFMfScKICAgICAgLSAnX0FQUF9BTExPV0VEX0lOVEVSTkFMX0FERFJFU1NFUz0ke19BUFBfQUxMT1dFRF9JTlRFUk5BTF9BRERSRVNTRVN9JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSBfQVBQX1dPUktFUlNfTlVNPTEKICAgICAgLSBfQVBQX1dPUktFUl9NQVhfQ09ST1VUSU5FUz03OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfRU1BSUxfU0VDVVJJVFk9JHtfQVBQX0VNQUlMX1NFQ1VSSVRZOi1zZWN1cml0eUBhcHB3cml0ZS5pb30nCiAgICAgIC0gJ19BUFBfRU1BSUxfQ0VSVElGSUNBVEVTPSR7X0FQUF9FTUFJTF9DRVJUSUZJQ0FURVN9JwogICAgICAtICdfQVBQX0RCX0FEQVBURVI9JHtfQVBQX0RCX0FEQVBURVI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1Q9JHtfQVBQX0RCX0hPU1Q6LWFwcHdyaXRlLXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX1BPUlQ9JHtfQVBQX0RCX1BPUlQ6LTU0MzJ9JwogICAgICAtICdfQVBQX0RCX1NDSEVNQT0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSPSRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgLSBfQVBQX0RCX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSX1ZFQ1RPUlNEQj0ke19BUFBfREJfQURBUFRFUl9WRUNUT1JTREI6LXBvc3RncmVzcWx9JwogICAgICAtICdfQVBQX0RCX0hPU1RfVkVDVE9SU0RCPSR7X0FQUF9EQl9IT1NUX1ZFQ1RPUlNEQjotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVF9WRUNUT1JTREI9JHtfQVBQX0RCX1BPUlRfVkVDVE9SU0RCOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCPSR7X0FQUF9EQl9TQ0hFTUFfVkVDVE9SU0RCOi1hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9EQl9VU0VSX1ZFQ1RPUlNEQj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTX1ZFQ1RPUlNEQj0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0FEQVBURVJfRE9DVU1FTlRTREI6LW1vbmdvZGJ9JwogICAgICAtICdfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREI9JHtfQVBQX0RCX0hPU1RfRE9DVU1FTlRTREJ9JwogICAgICAtICdfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1BPUlRfRE9DVU1FTlRTREI6LTI3MDE3fScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUFfRE9DVU1FTlRTREI9JHtfQVBQX0RCX1NDSEVNQV9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQj0ke19BUFBfREJfVVNFUl9ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfREJfUEFTU19ET0NVTUVOVFNEQj0ke19BUFBfREJfUEFTU19ET0NVTUVOVFNEQn0nCiAgICAgIC0gJ19BUFBfQ09OTkVDVElPTlNfREFUQUJBU0VfRE9DVU1FTlRTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX0RPQ1VNRU5UU0RCfScKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQVRBQkFTRV9WRUNUT1JTREI9JHtfQVBQX0NPTk5FQ1RJT05TX0RBVEFCQVNFX1ZFQ1RPUlNEQn0nCiAgICAgIC0gJ19BUFBfUkVESVNfSE9TVD0ke19BUFBfUkVESVNfSE9TVDotYXBwd3JpdGUtcmVkaXN9JwogICAgICAtICdfQVBQX1JFRElTX1BPUlQ9JHtfQVBQX1JFRElTX1BPUlQ6LTYzNzl9JwogICAgICAtICdfQVBQX1JFRElTX1VTRVI9JHtfQVBQX1JFRElTX1VTRVJ9JwogICAgICAtICdfQVBQX1JFRElTX1BBU1M9JHtfQVBQX1JFRElTX1BBU1N9JwogICAgICAtICdfQVBQX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1FVRVVFX05BTUU9JHtfQVBQX1FVRVVFX05BTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0NPTlNPTEVfVVJMPSR7X0FQUF9DT05TT0xFX1VSTH0nCiAgICAgIC0gJ19BUFBfQ09OU09MRV9ET01BSU49JHtfQVBQX0NPTlNPTEVfRE9NQUlOfScKICAgICAgLSAnX0FQUF9DT05TT0xFX1RSVVNURURfUFJPSkVDVFM9JHtfQVBQX0NPTlNPTEVfVFJVU1RFRF9QUk9KRUNUU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOPSR7X0FQUF9ET01BSU46LSRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ05BTUU6LWxvY2FsaG9zdH0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BQUFBPSR7X0FQUF9ET01BSU5fVEFSR0VUX0FBQUE6LTo6MX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9BPSR7X0FQUF9ET01BSU5fVEFSR0VUX0E6LTEyNy4wLjAuMX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQ0FBfScKICAgICAgLSAnX0FQUF9ETlM9JHtfQVBQX0ROU30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTPSR7X0FQUF9PUFRJT05TX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfT1BUSU9OU19ST1VURVJfRk9SQ0VfSFRUUFM9JHtfQVBQX09QVElPTlNfUk9VVEVSX0ZPUkNFX0hUVFBTOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfV0VCSE9PS19NQVhfRkFJTEVEX0FUVEVNUFRTPSR7X0FQUF9XRUJIT09LX01BWF9GQUlMRURfQVRURU1QVFM6LTEwfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RFVklDRT0ke19BUFBfU1RPUkFHRV9ERVZJQ0U6LWxvY2FsfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX1JFR0lPTj0ke19BUFBfU1RPUkFHRV9TM19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9TM19CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfUzNfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0RPX1NQQUNFU19TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfRE9fU1BBQ0VTX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19SRUdJT046LXVzLWVhc3QtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9ET19TUEFDRVNfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0RPX1NQQUNFU19CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0JBQ0tCTEFaRV9SRUdJT049JHtfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX1JFR0lPTjotdXMtd2VzdC0wMDR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfQkFDS0JMQVpFX0JVQ0tFVD0ke19BUFBfU1RPUkFHRV9CQUNLQkxBWkVfQlVDS0VUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9BQ0NFU1NfS0VZfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX0xJTk9ERV9TRUNSRVQ9JHtfQVBQX1NUT1JBR0VfTElOT0RFX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9SRUdJT046LWV1LWNlbnRyYWwtMX0nCiAgICAgIC0gJ19BUFBfU1RPUkFHRV9MSU5PREVfQlVDS0VUPSR7X0FQUF9TVE9SQUdFX0xJTk9ERV9CVUNLRVR9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0FDQ0VTU19LRVl9JwogICAgICAtICdfQVBQX1NUT1JBR0VfV0FTQUJJX1NFQ1JFVD0ke19BUFBfU1RPUkFHRV9XQVNBQklfU0VDUkVUfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9SRUdJT049JHtfQVBQX1NUT1JBR0VfV0FTQUJJX1JFR0lPTjotZXUtY2VudHJhbC0xfScKICAgICAgLSAnX0FQUF9TVE9SQUdFX1dBU0FCSV9CVUNLRVQ9JHtfQVBQX1NUT1JBR0VfV0FTQUJJX0JVQ0tFVH0nCiAgICAgIC0gX0FQUF9FWEVDVVRPUl9TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfRVhFQ1VUT1IKICAgICAgLSAnX0FQUF9FWEVDVVRPUl9IT1NUPSR7X0FQUF9FWEVDVVRPUl9IT1NUOi1odHRwOi8vb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yL3YxfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnX0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEPSR7X0FQUF9ET0NLRVJfSFVCX1BBU1NXT1JEfScKICAgICAgLSAnX0FQUF9GVU5DVElPTlNfVElNRU9VVD0ke19BUFBfRlVOQ1RJT05TX1RJTUVPVVQ6LTkwMH0nCiAgICAgIC0gJ19BUFBfU0lURVNfVElNRU9VVD0ke19BUFBfU0lURVNfVElNRU9VVDotOTAwfScKICAgICAgLSAnX0FQUF9DT01QVVRFX0JVSUxEX1RJTUVPVVQ9JHtfQVBQX0NPTVBVVEVfQlVJTERfVElNRU9VVDotMjcwMH0nCiAgICAgIC0gJ19BUFBfQ09NUFVURV9DUFVTPSR7X0FQUF9DT01QVVRFX0NQVVM6LTB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfTUVNT1JZPSR7X0FQUF9DT01QVVRFX01FTU9SWTotMH0nCiAgICAgIC0gJ19BUFBfT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnX0FQUF9DT01QVVRFX1NJWkVfTElNSVQ9JHtfQVBQX0NPTVBVVEVfU0laRV9MSU1JVDotMzAwMDAwMDB9JwogICAgICAtICdfQVBQX0NPTVBVVEVfQlVJTERfU0laRV9MSU1JVD0ke19BUFBfQ09NUFVURV9CVUlMRF9TSVpFX0xJTUlUOi0yMDAwMDAwMDAwfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FPSR7X0FQUF9WQ1NfR0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZPSR7X0FQUF9WQ1NfR0lUSFVCX1BSSVZBVEVfS0VZfScKICAgICAgLSAnX0FQUF9WQ1NfR0lUSFVCX0FQUF9JRD0ke19BUFBfVkNTX0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0VORFBPSU5UfScKICAgICAgLSAnX0FQUF9WQ1NfR0lURUFfQlJPV1NFUl9FTkRQT0lOVD0ke19BUFBfVkNTX0dJVEVBX0JST1dTRVJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUQ9JHtfQVBQX1ZDU19HSVRFQV9DTElFTlRfSUR9JwogICAgICAtICdfQVBQX1ZDU19HSVRFQV9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVEVBX1dFQkhPT0tfU0VDUkVUPSR7X0FQUF9WQ1NfR0lURUFfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlQ9JHtfQVBQX1ZDU19HSVRMQUJfRU5EUE9JTlR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0dJVExBQl9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfR0lUTEFCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19HSVRMQUJfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX0JJVEJVQ0tFVF9DTElFTlRfU0VDUkVUPSR7X0FQUF9WQ1NfQklUQlVDS0VUX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVQ9JHtfQVBQX1ZDU19CSVRCVUNLRVRfV0VCSE9PS19TRUNSRVR9JwogICAgICAtICdfQVBQX1ZDU19PUklHSU5fQ0xJRU5UX0lEPSR7X0FQUF9WQ1NfT1JJR0lOX0NMSUVOVF9JRH0nCiAgICAgIC0gJ19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWT0ke19BUFBfVkNTX09SSUdJTl9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ19BUFBfVkNTX1dFQkhPT0tfVVJMPSR7X0FQUF9WQ1NfV0VCSE9PS19VUkx9JwogICAgICAtICdfQVBQX0JVSUxEU19WT0xVTUU9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX1fYXBwd3JpdGUtYnVpbGRzJwogICAgICAtICdfQVBQX0pPQlNfSE9TVD0ke19BUFBfSk9CU19IT1NUOi1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODB9JwogICAgICAtIF9BUFBfSk9CU19TRUNSRVQ9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfSk9CUwogICAgICAtICdfQVBQX0pPQlNfRU5EUE9JTlQ9JHtfQVBQX0pPQlNfRU5EUE9JTlQ6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfQlJPV1NFUl9IT1NUPSR7X0FQUF9CUk9XU0VSX0hPU1Q6LWh0dHA6Ly9hcHB3cml0ZS1icm93c2VyOjMwMDAvdjF9JwogICAgICAtICdfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI9JHtfQVBQX1dPUktFUl9TQ1JFRU5TSE9UU19ST1VURVI6LWh0dHA6Ly9hcHB3cml0ZX0nCiAgICAgIC0gX0FQUF9OT1RJRklDQVRJT05TX1RSQUNLSU5HX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9OT1RJRklDQVRJT05TCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX05BTUU9JHtfQVBQX1NZU1RFTV9FTUFJTF9OQU1FOi1BcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfU1lTVEVNX0VNQUlMX0FERFJFU1M9JHtfQVBQX1NZU1RFTV9FTUFJTF9BRERSRVNTOi1ub3JlcGx5QGFwcHdyaXRlLmlvfScKICAgICAgLSAnX0FQUF9TTVRQX0hPU1Q9JHtfQVBQX1NNVFBfSE9TVH0nCiAgICAgIC0gJ19BUFBfU01UUF9QT1JUPSR7X0FQUF9TTVRQX1BPUlR9JwogICAgICAtICdfQVBQX1NNVFBfU0VDVVJFPSR7X0FQUF9TTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ19BUFBfU01UUF9VU0VSTkFNRT0ke19BUFBfU01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ19BUFBfU01UUF9QQVNTV09SRD0ke19BUFBfU01UUF9QQVNTV09SRH0nCiAgICAgIC0gJ19BUFBfU01TX0ZST009JHtfQVBQX1NNU19GUk9NfScKICAgICAgLSAnX0FQUF9TTVNfUFJPVklERVI9JHtfQVBQX1NNU19QUk9WSURFUn0nCiAgICAgIC0gJ19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVD0ke19BUFBfU01TX1BST0pFQ1RTX0RFTllfTElTVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OU19GSVJFQkFTRV9DTElFTlRfSUQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX0lEfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05TX0ZJUkVCQVNFX0NMSUVOVF9TRUNSRVQ9JHtfQVBQX01JR1JBVElPTlNfRklSRUJBU0VfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ19BUFBfTUlHUkFUSU9OX0hPU1Q9JHtfQVBQX01JR1JBVElPTl9IT1NUOi1hcHB3cml0ZX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTElNSVRfREFUQUJBU0VfQkFUQ0g9JHtfQVBQX0xJTUlUX0RBVEFCQVNFX0JBVENIOi0xMDB9JwogICAgICAtICdfQVBQX0RPQ1VNRU5UU0RCPSR7X0FQUF9ET0NVTUVOVFNEQjotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX1ZFQ1RPUlNEQj0ke19BUFBfVkVDVE9SU0RCOi1kaXNhYmxlZH0nCiAgICAgIC0gJ19BUFBfRU1CRURESU5HPSR7X0FQUF9FTUJFRERJTkc6LWRpc2FibGVkfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXVwbG9hZHM6L3N0b3JhZ2UvdXBsb2FkczpydycKICAgICAgLSAnYXBwd3JpdGUtaW1wb3J0czovc3RvcmFnZS9pbXBvcnRzOnJ3JwogICAgICAtICdhcHB3cml0ZS1jYWNoZTovc3RvcmFnZS9jYWNoZTpydycKICAgICAgLSAnYXBwd3JpdGUtY29uZmlnOi9zdG9yYWdlL2NvbmZpZzpydycKICAgICAgLSAnYXBwd3JpdGUtY2VydGlmaWNhdGVzOi9zdG9yYWdlL2NlcnRpZmljYXRlczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJ2FwcHdyaXRlLWJ1aWxkczovc3RvcmFnZS9idWlsZHM6cncnCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLWNsaWNraG91c2U6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG9yY2hlc3RyYXRvcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLXNjaGVkdWxlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYXBwd3JpdGU6Mi41LjAnCiAgICBlbnRyeXBvaW50OiBzY2hlZHVsZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ19BUFBfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdfQVBQX1VTQUdFX1NUQVRTPSR7X0FQUF9VU0FHRV9TVEFUUzotZW5hYmxlZH0nCiAgICAgIC0gX0FQUF9VU0FHRV9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0UKICAgICAgLSAnX0FQUF9DT05ORUNUSU9OU19EQl9VU0FHRT1odHRwOi8vYXBwd3JpdGU6JFNFUlZJQ0VfUEFTU1dPUkRfQ0xJQ0tIT1VTRUBhcHB3cml0ZS1jbGlja2hvdXNlOjgxMjMvYXBwd3JpdGUnCiAgICAgIC0gJ19BUFBfUE9PTF9TSVpFX1VTQUdFPSR7X0FQUF9QT09MX1NJWkVfVVNBR0U6LTJ9JwogICAgICAtICdfQVBQX0NPTk5FQ1RJT05TX0RCX0VYRUNVVElPTlM9aHR0cDovL2FwcHdyaXRlOiRTRVJWSUNFX1BBU1NXT1JEX0NMSUNLSE9VU0VAYXBwd3JpdGUtY2xpY2tob3VzZTo4MTIzL2FwcHdyaXRlJwogICAgICAtICdfQVBQX1BPT0xfU0laRV9FWEVDVVRJT05TPSR7X0FQUF9QT09MX1NJWkVfRVhFQ1VUSU9OUzotMn0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTD0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1VTQUdFX1RUTDotMTgwfScKICAgICAgLSAnX0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FPSR7X0FQUF9TVEFUU19VU0FHRV9RVUVVRV9OQU1FOi12MS1zdGF0cy11c2FnZX0nCiAgICAgIC0gJ19BUFBfU1RBVFNfUkVTT1VSQ0VTX1FVRVVFX05BTUU9JHtfQVBQX1NUQVRTX1JFU09VUkNFU19RVUVVRV9OQU1FOi12MS1zdGF0cy1yZXNvdXJjZXN9JwogICAgICAtICdfQVBQX1NUQVRTX1JFU09VUkNFU19JTlRFUlZBTD0ke19BUFBfU1RBVFNfUkVTT1VSQ0VTX0lOVEVSVkFMOi0zNjAwfScKICAgICAgLSAnX0FQUF9MT0dHSU5HX0ZPUk1BVD0ke19BUFBfTE9HR0lOR19GT1JNQVQ6LXByZXR0eX0nCiAgICAgIC0gX0FQUF9XT1JLRVJfTUFYX0NPUk9VVElORVM9OAogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSBfQVBQX09QRU5TU0xfS0VZX1YxPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0FQUFdSSVRFCiAgICAgIC0gJ19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUz0ke19BUFBfT1BUSU9OU19GT1JDRV9IVFRQUzotZGlzYWJsZWR9JwogICAgICAtICdfQVBQX0RPTUFJTj0ke19BUFBfRE9NQUlOOi0kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9DT05TT0xFX0RPTUFJTj0ke19BUFBfQ09OU09MRV9ET01BSU59JwogICAgICAtICdfQVBQX0NPTlNPTEVfU0NIRU1BPSR7X0FQUF9DT05TT0xFX1NDSEVNQTotYXBwd3JpdGVpb30nCiAgICAgIC0gJ19BUFBfRE9NQUlOX0ZVTkNUSU9OUz0ke19BUFBfRE9NQUlOX0ZVTkNUSU9OUzotZnVuY3Rpb25zLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtICdfQVBQX0RPTUFJTl9TSVRFUz0ke19BUFBfRE9NQUlOX1NJVEVTOi1zaXRlcy4kU0VSVklDRV9GUUROX0FQUFdSSVRFfScKICAgICAgLSAnX0FQUF9NSUdSQVRJT05fSE9TVD0ke19BUFBfTUlHUkFUSU9OX0hPU1Q6LWFwcHdyaXRlfScKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ9JHtfQVBQX0ZVTkNUSU9OU19TQ0hFRFVMRV9TUFJFQUQ6LTB9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLW1haW50ZW5hbmNlOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IG1haW50ZW5hbmNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRURJVElPTj0ke19BUFBfRURJVElPTjotc2VsZi1ob3N0ZWR9JwogICAgICAtICdfQVBQX1JPVVRFUl9BVVRPX0NFUlRJRklDQVRFUz0ke19BUFBfUk9VVEVSX0FVVE9fQ0VSVElGSUNBVEVTOi1kaXNhYmxlZH0nCiAgICAgIC0gX0FQUF9PUEVOU1NMX0tFWV9WMT0kU0VSVklDRV9QQVNTV09SRF82NF9BUFBXUklURQogICAgICAtICdfQVBQX1JFRElTX0hPU1Q9JHtfQVBQX1JFRElTX0hPU1Q6LWFwcHdyaXRlLXJlZGlzfScKICAgICAgLSAnX0FQUF9SRURJU19QT1JUPSR7X0FQUF9SRURJU19QT1JUOi02Mzc5fScKICAgICAgLSAnX0FQUF9SRURJU19VU0VSPSR7X0FQUF9SRURJU19VU0VSfScKICAgICAgLSAnX0FQUF9SRURJU19QQVNTPSR7X0FQUF9SRURJU19QQVNTfScKICAgICAgLSAnX0FQUF9EQl9BREFQVEVSPSR7X0FQUF9EQl9BREFQVEVSOi1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9IT1NUPSR7X0FQUF9EQl9IT1NUOi1hcHB3cml0ZS1wb3N0Z3Jlc3FsfScKICAgICAgLSAnX0FQUF9EQl9QT1JUPSR7X0FQUF9EQl9QT1JUOi01NDMyfScKICAgICAgLSAnX0FQUF9EQl9TQ0hFTUE9JHtfQVBQX0RCX1NDSEVNQTotYXBwd3JpdGV9JwogICAgICAtIF9BUFBfREJfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gX0FQUF9EQl9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfSU5URVJWQUw9JHtfQVBQX01BSU5URU5BTkNFX0lOVEVSVkFMOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTj0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0VYRUNVVElPTjotMTIwOTYwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0NBQ0hFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQ0FDSEU6LTI1OTIwMDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BQlVTRT0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FCVVNFOi04NjQwMH0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX0FVRElUPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVQ6LTEyMDk2MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1JFVEVOVElPTl9BVURJVF9DT05TT0xFPSR7X0FQUF9NQUlOVEVOQU5DRV9SRVRFTlRJT05fQVVESVRfQ09OU09MRX0nCiAgICAgIC0gJ19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUz0ke19BUFBfTUFJTlRFTkFOQ0VfUkVURU5USU9OX1NDSEVEVUxFUzotODY0MDB9JwogICAgICAtICdfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUU9JHtfQVBQX01BSU5URU5BTkNFX1NUQVJUX1RJTUV9JwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgZGVwZW5kc19vbjoKICAgICAgYXBwd3JpdGUtcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBhcHB3cml0ZS1yZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJwcyBhdXggfCBncmVwIC1xICdbcF1ocCcgfHwgZXhpdCAxIgogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICBhcHB3cml0ZS10YXNrLWludGVydmFsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9hcHB3cml0ZToyLjUuMCcKICAgIGVudHJ5cG9pbnQ6IGludGVydmFsCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnX0FQUF9FTlY9JHtfQVBQX0VOVjotcHJvZHVjdGlvbn0nCiAgICAgIC0gJ19BUFBfTE9HR0lOR19GT1JNQVQ9JHtfQVBQX0xPR0dJTkdfRk9STUFUOi1wcmV0dHl9JwogICAgICAtICdfQVBQX1dPUktFUl9QRVJfQ09SRT0ke19BUFBfV09SS0VSX1BFUl9DT1JFOi02fScKICAgICAgLSAnX0FQUF9ET01BSU49JHtfQVBQX0RPTUFJTjotJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DTkFNRTotbG9jYWxob3N0fScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0FBQUE9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQUFBQTotOjoxfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0E9JHtfQVBQX0RPTUFJTl9UQVJHRVRfQTotMTI3LjAuMC4xfScKICAgICAgLSAnX0FQUF9ET01BSU5fVEFSR0VUX0NBQT0ke19BUFBfRE9NQUlOX1RBUkdFVF9DQUF9JwogICAgICAtICdfQVBQX0ROUz0ke19BUFBfRE5TfScKICAgICAgLSAnX0FQUF9ET01BSU5fRlVOQ1RJT05TPSR7X0FQUF9ET01BSU5fRlVOQ1RJT05TOi1mdW5jdGlvbnMuJFNFUlZJQ0VfRlFETl9BUFBXUklURX0nCiAgICAgIC0gJ19BUFBfRE9NQUlOX1NJVEVTPSR7X0FQUF9ET01BSU5fU0lURVM6LXNpdGVzLiRTRVJWSUNFX0ZRRE5fQVBQV1JJVEV9JwogICAgICAtIF9BUFBfT1BFTlNTTF9LRVlfVjE9JFNFUlZJQ0VfUEFTU1dPUkRfNjRfQVBQV1JJVEUKICAgICAgLSAnX0FQUF9SRURJU19IT1NUPSR7X0FQUF9SRURJU19IT1NUOi1hcHB3cml0ZS1yZWRpc30nCiAgICAgIC0gJ19BUFBfUkVESVNfUE9SVD0ke19BUFBfUkVESVNfUE9SVDotNjM3OX0nCiAgICAgIC0gJ19BUFBfUkVESVNfVVNFUj0ke19BUFBfUkVESVNfVVNFUn0nCiAgICAgIC0gJ19BUFBfUkVESVNfUEFTUz0ke19BUFBfUkVESVNfUEFTU30nCiAgICAgIC0gJ19BUFBfREJfQURBUFRFUj0ke19BUFBfREJfQURBUFRFUjotcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfSE9TVD0ke19BUFBfREJfSE9TVDotYXBwd3JpdGUtcG9zdGdyZXNxbH0nCiAgICAgIC0gJ19BUFBfREJfUE9SVD0ke19BUFBfREJfUE9SVDotNTQzMn0nCiAgICAgIC0gJ19BUFBfREJfU0NIRU1BPSR7X0FQUF9EQl9TQ0hFTUE6LWFwcHdyaXRlfScKICAgICAgLSBfQVBQX0RCX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIF9BUFBfREJfUEFTUz0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogICAgICAtICdfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVM9JHtfQVBQX0RBVEFCQVNFX1NIQVJFRF9UQUJMRVN9JwogICAgICAtICdfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT049JHtfQVBQX0lOVEVSVkFMX0RPTUFJTl9WRVJJRklDQVRJT046LTEyMH0nCiAgICAgIC0gJ19BUFBfSU5URVJWQUxfQ0xFQU5VUF9TVEFMRV9FWEVDVVRJT05TPSR7X0FQUF9JTlRFUlZBTF9DTEVBTlVQX1NUQUxFX0VYRUNVVElPTlM6LTMwMH0nCiAgICBkZXBlbmRzX29uOgogICAgICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGFwcHdyaXRlLXJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgLXEgJ1twXWhwJyB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogIGFwcHdyaXRlLWdlbzoKICAgIGltYWdlOiAnYXBwd3JpdGUvZ2VvOjAuMy4yJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR0VPX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF82NF9HRU8KICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAicGhwIC1yIFwiZXhpdChqc29uX2RlY29kZShmaWxlX2dldF9jb250ZW50cygnaHR0cDovL2xvY2FsaG9zdC92MS9oZWFsdGgnKSktPnN0YXR1cyA9PT0gJ29rJyA/IDAgOiAxKTtcIiIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgYXBwd3JpdGUtYnJvd3NlcjoKICAgIGltYWdlOiAnYXBwd3JpdGUvYnJvd3NlcjowLjMuNicKICAgIGVudmlyb25tZW50OgogICAgICAtIEFMTE9XRURfSE9TVFM9YXBwd3JpdGUKICAgIGRuczoKICAgICAgLSAxLjEuMS4xCiAgICAgIC0gOC44LjguOAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yOgogICAgaW1hZ2U6ICdvcGVucnVudGltZXMvZXhlY3V0b3I6MS4xLjInCiAgICBob3N0bmFtZTogb3BlbnJ1bnRpbWVzLWV4ZWN1dG9yCiAgICBzdG9wX3NpZ25hbDogU0lHSU5UCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnT1BSX0VYRUNVVE9SX0lNQUdFUz0ke19BUFBfRVhFQ1VUT1JfSU1BR0VTOi1vcGVucnVudGltZXMvbm9kZTp2NS0yMixvcGVucnVudGltZXMvc3RhdGljOnY1LTF9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfSU5BQ1RJVkVfVEhSRVNIT0xEPSR7X0FQUF9DT01QVVRFX0lOQUNUSVZFX1RIUkVTSE9MRDotNjAwfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX01BSU5URU5BTkNFX0lOVEVSVkFMPSR7X0FQUF9DT01QVVRFX01BSU5URU5BTkNFX0lOVEVSVkFMOi02MDB9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfTkVUV09SSz0ke19BUFBfQ09NUFVURV9SVU5USU1FU19ORVRXT1JLOi1ydW50aW1lc30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9ET0NLRVJfSFVCX1VTRVJOQU1FPSR7X0FQUF9ET0NLRVJfSFVCX1VTRVJOQU1FfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0RPQ0tFUl9IVUJfUEFTU1dPUkQ9JHtfQVBQX0RPQ0tFUl9IVUJfUEFTU1dPUkR9JwogICAgICAtICdPUFJfRVhFQ1VUT1JfRU5WPSR7X0FQUF9FTlY6LXByb2R1Y3Rpb259JwogICAgICAtICdPUFJfRVhFQ1VUT1JfUlVOVElNRVM9JHtfQVBQX0ZVTkNUSU9OU19SVU5USU1FUzotbm9kZS0yMn0sJHtfQVBQX1NJVEVTX1JVTlRJTUVTOi1zdGF0aWMtMSxub2RlLTIyfScKICAgICAgLSBPUFJfRVhFQ1VUT1JfU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEXzY0X0VYRUNVVE9SCiAgICAgIC0gT1BSX0VYRUNVVE9SX1JVTlRJTUVfVkVSU0lPTlM9djUKICAgICAgLSAnT1BFTl9SVU5USU1FU19ORlQ9JHtfQVBQX09QRU5fUlVOVElNRVNfTkZUOi1lbmFibGVkfScKICAgICAgLSAnT1BSX0VYRUNVVE9SX0xPR0dJTkdfQ09ORklHPSR7X0FQUF9MT0dHSU5HX0NPTkZJR30nCiAgICAgIC0gJ09QUl9FWEVDVVRPUl9DT05ORUNUSU9OX1NUT1JBR0U9JHtfQVBQX0VYRUNVVE9SX0NPTk5FQ1RJT05fU1RPUkFHRTotbG9jYWw6Ly9sb2NhbGhvc3R9JwogICAgICAtIE9QUl9FWEVDVVRPUl9DT05ORUNUSU9OX0JVSUxEX0NBQ0hFX1NUT1JBR0U9CiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnYXBwd3JpdGUtYnVpbGRzOi9zdG9yYWdlL2J1aWxkczpydycKICAgICAgLSAnYXBwd3JpdGUtZnVuY3Rpb25zOi9zdG9yYWdlL2Z1bmN0aW9uczpydycKICAgICAgLSAnYXBwd3JpdGUtc2l0ZXM6L3N0b3JhZ2Uvc2l0ZXM6cncnCiAgICAgIC0gJy90bXA6L3RtcDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIC1IICJBdXRob3JpemF0aW9uOiBCZWFyZXIgJCRPUFJfRVhFQ1VUT1JfU0VDUkVUIiBodHRwOi8vbG9jYWxob3N0L3YxL2hlYWx0aCA+IC9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG9yY2hlc3RyYXRvcjoKICAgIGltYWdlOiAnZ2hjci5pby9vcGVuLXJ1bnRpbWVzL29yY2hlc3RyYXRvci9vcmNoZXN0cmF0b3I6Mi4yLjInCiAgICBob3N0bmFtZTogb3JjaGVzdHJhdG9yCiAgICB1c2VyOiByb290CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBPUkNIRVNUUkFUT1JfQkFDS0VORD1kb2NrZXIKICAgICAgLSAnT1JDSEVTVFJBVE9SX05FVFdPUks9JHtDT01QT1NFX1BST0pFQ1RfTkFNRX0nCiAgICAgIC0gJ0RPQ0tFUl9ORVRXT1JLPSR7Q09NUE9TRV9QUk9KRUNUX05BTUV9JwogICAgICAtICdBUlRJRkFDVF9FTkRQT0lOVD1odHRwOi8vb3JjaGVzdHJhdG9yOjgwODAnCiAgICAgIC0gJ1MzX0VORFBPSU5UPSR7X0FQUF9TVE9SQUdFX1MzX0VORFBPSU5UfScKICAgICAgLSAnUzNfUkVHSU9OPSR7X0FQUF9TVE9SQUdFX1MzX1JFR0lPTjotdXMtZWFzdC0xfScKICAgICAgLSAnUzNfQUNDRVNTX0tFWV9JRD0ke19BUFBfU1RPUkFHRV9TM19BQ0NFU1NfS0VZfScKICAgICAgLSAnUzNfU0VDUkVUX0FDQ0VTU19LRVk9JHtfQVBQX1NUT1JBR0VfUzNfU0VDUkVUfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy92YXIvcnVuL2RvY2tlci5zb2NrOi92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9rby1hcHAvb3JjaGVzdHJhdG9yCiAgICAgICAgLSAnLWNoZWNrLXJlYWR5JwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1wb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdhcHB3cml0ZS9wb3N0Z3JlczowLjEuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke19BUFBfREJfU0NIRU1BOi1hcHB3cml0ZX0nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2FwcHdyaXRlLXBvc3RncmVzcWw6L3Zhci9saWIvcG9zdGdyZXNxbDpydycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTAKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBhcHB3cml0ZS1yZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LjctYWxwaW5lJwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLW1heG1lbW9yeSA1MTJtYiAtLW1heG1lbW9yeS1wb2xpY3kgYWxsa2V5cy1scnUgLS1tYXhtZW1vcnktc2FtcGxlcyA1JwogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtcmVkaXM6L2RhdGE6cncnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUKICBhcHB3cml0ZS1jbGlja2hvdXNlOgogICAgaW1hZ2U6ICdjbGlja2hvdXNlL2NsaWNraG91c2Utc2VydmVyOjI2LjQuMy1hbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBDTElDS0hPVVNFX0RCPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9VU0VSPWFwcHdyaXRlCiAgICAgIC0gQ0xJQ0tIT1VTRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DTElDS0hPVVNFCiAgICAgIC0gQ0xJQ0tIT1VTRV9ERUZBVUxUX0FDQ0VTU19NQU5BR0VNRU5UPTEKICAgICAgLSBDTElDS0hPVVNFX0FMV0FZU19SVU5fSU5JVERCX1NDUklQVFM9MQogICAgdm9sdW1lczoKICAgICAgLSAnYXBwd3JpdGUtY2xpY2tob3VzZTovdmFyL2xpYi9jbGlja2hvdXNlOnJ3JwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi9jbGlja2hvdXNlLWNvbmZpZy54bWwKICAgICAgICB0YXJnZXQ6IC9ldGMvY2xpY2tob3VzZS1zZXJ2ZXIvY29uZmlnLmQvYXBwd3JpdGUueG1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogIjw/eG1sIHZlcnNpb249XCIxLjBcIj8+XG48IS0tXG4gICAgUmV0ZW50aW9uIGZvciBDbGlja0hvdXNlJ3Mgb3duIHN5c3RlbSBsb2cgdGFibGVzLlxuXG4gICAgRXZlcnkgPHR0bD4gaW4gdGhlIGltYWdlJ3MgY29uZmlnLnhtbCBzaXRzIGluc2lkZSBhbiBYTUwgY29tbWVudCwgc28gdGhlc2VcbiAgICB0YWJsZXMga2VlcCBldmVyeSByb3cgZm9yZXZlciwgYW5kIHRoZSBtZXRyaWMgb25lcyBhZGQgYSByb3cgcGVyIHNlY29uZFxuICAgIHdoZXRoZXIgb3Igbm90IHRoZSBpbnN0YW5jZSBzZXJ2ZXMgdHJhZmZpYy4gTGVmdCBhbG9uZSB0aGV5IG91dGdyb3cgdGhlXG4gICAgdXNhZ2UgZGF0YSB0aGV5IHNpdCBuZXh0IHRvIGFuZCBmaWxsIHRoZSB2b2x1bWUuXG5cbiAgICBXaGVuIGEgd2luZG93IGhlcmUgY2hhbmdlcywgQ2xpY2tIb3VzZSByZXBsYWNlcyB0aGUgdGFibGUgb24gdGhlIG5leHRcbiAgICByZXN0YXJ0IGFuZCBrZWVwcyB0aGUgb2xkIG9uZSwgcm93cyBhbmQgYWxsLCBhcyA8bG9nPl88Tj4uXG4gICAgY2xpY2tob3VzZS1pbml0LnNoIGdpdmVzIHRob3NlIG9sZCB0YWJsZXMgdGhlIHNhbWUgd2luZG93LlxuLS0+XG48Y2xpY2tob3VzZT5cbiAgICA8IS0tIFRoZSBtZXRyaWMsIHRyYWNlIGFuZCBwcm9maWxlIGxvZ3Mgc2FtcGxlIHRoZSBzZXJ2ZXIgZXZlcnkgc2Vjb25kIHdoZXRoZXJcbiAgICAgICAgIG9yIG5vdCBBcHB3cml0ZSBzZXJ2ZXMgdHJhZmZpYywgYW5kIG5vdGhpbmcgcmVhZHMgdGhlbSBiYWNrLCBzbyB0aGVpclxuICAgICAgICAgd3JpdGVzIGFuZCB0aGUgbWVyZ2VzIGJlaGluZCB0aGVtIGFyZSBwdXJlIG92ZXJoZWFkLiAtLT5cbiAgICA8YXN5bmNocm9ub3VzX21ldHJpY19sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8bWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxoaXN0b2dyYW1fbWV0cmljX2xvZyByZW1vdmU9XCIxXCIvPlxuICAgIDxxdWVyeV9tZXRyaWNfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPHByb2Nlc3NvcnNfcHJvZmlsZV9sb2cgcmVtb3ZlPVwiMVwiLz5cbiAgICA8dHJhY2VfbG9nIHJlbW92ZT1cIjFcIi8+XG4gICAgPCEtLSB0ZXh0X2xvZyByZXBlYXRzIHRoZSBzZXJ2ZXIgbG9nIHRoZSBjb250YWluZXIgYWxyZWFkeSB3cml0ZXMuIC0tPlxuICAgIDx0ZXh0X2xvZyByZW1vdmU9XCIxXCIvPlxuXG4gICAgPCEtLSBLZXB0IGZvciBkZWJ1Z2dpbmcsIGNhcHBlZCBzbyB0aGV5IGNhbm5vdCBmaWxsIHRoZSB2b2x1bWUuIC0tPlxuICAgIDxhc3luY2hyb25vdXNfaW5zZXJ0X2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAzIERBWSBERUxFVEU8L3R0bD48L2FzeW5jaHJvbm91c19pbnNlcnRfbG9nPlxuICAgIDxxdWVyeV9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9xdWVyeV9sb2c+XG4gICAgPHF1ZXJ5X3ZpZXdzX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3ZpZXdzX2xvZz5cbiAgICA8cXVlcnlfdGhyZWFkX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEU8L3R0bD48L3F1ZXJ5X3RocmVhZF9sb2c+XG4gICAgPHBhcnRfbG9nPjx0dGw+ZXZlbnRfZGF0ZSArIElOVEVSVkFMIDcgREFZIERFTEVURTwvdHRsPjwvcGFydF9sb2c+XG4gICAgPGJhY2tncm91bmRfc2NoZWR1bGVfcG9vbF9sb2c+PHR0bD5ldmVudF9kYXRlICsgSU5URVJWQUwgNyBEQVkgREVMRVRFPC90dGw+PC9iYWNrZ3JvdW5kX3NjaGVkdWxlX3Bvb2xfbG9nPlxuXG4gICAgPCEtLSBMb25nZXIsIHNvIGl0IHN0aWxsIGNvdmVycyBhIHJlcG9ydCB0aGF0IHJlYWNoZXMgdXMgbGF0ZS4gY3Jhc2hfbG9nIGlzXG4gICAgICAgICBkZWxpYmVyYXRlbHkgbGVmdCBhbG9uZTogaXQgaXMgdGlueSBhbmQgd29ydGgga2VlcGluZy4gLS0+XG4gICAgPGVycm9yX2xvZz48dHRsPmV2ZW50X2RhdGUgKyBJTlRFUlZBTCAxNCBEQVkgREVMRVRFPC90dGw+PC9lcnJvcl9sb2c+XG48L2NsaWNraG91c2U+XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2NsaWNraG91c2UtaW5pdC5zaAogICAgICAgIHJlYWRfb25seTogdHJ1ZQogICAgICAgIGNvbnRlbnQ6ICIjIS9iaW4vYmFzaFxuIyBUaGUgQ2xpY2tIb3VzZSBlbnRyeXBvaW50IHNvdXJjZXMgdGhpcyBmaWxlLCBzbyBhIHN1YnNoZWxsIGtlZXBzIHRoZXNlIG9wdGlvbnMgb3V0IG9mIGl0LlxuKFxuICBzZXQgLWV1byBwaXBlZmFpbFxuXG4gIGNsaWVudCgpIHtcbiAgICBjbGlja2hvdXNlLWNsaWVudCAtLWhvc3QgMTI3LjAuMC4xIC0tdXNlciBcIiRDTElDS0hPVVNFX1VTRVJcIiAtLXBhc3N3b3JkIFwiJENMSUNLSE9VU0VfUEFTU1dPUkRcIiBcIiRAXCJcbiAgfVxuXG4gICMgRmx1c2hpbmcgcmVwbGFjZXMgbG9nIHRhYmxlcyB3aG9zZSBkZWZpbml0aW9uIGNoYW5nZWQsIGtlZXBpbmcgZWFjaCBvbGQgdGFibGUgYXMgPGxvZz5fPE4+LlxuICBjbGllbnQgLS1xdWVyeSAnU1lTVEVNIEZMVVNIIExPR1MnXG5cbiAgIyBUYWJsZXMgbGVmdCBiZWhpbmQgbmV2ZXIgZXhwaXJlIG9uIHRoZWlyIG93bjogdGFrZSB0aGUgVFRMIG9mIHRoZSBsb2cgdGhhdFxuICAjIHJlcGxhY2VkIHRoaXMgb25lLCBvciBhIHdlZWsgd2hlbiB0aGUgbG9nIGlzIG5vIGxvbmdlciB3cml0dGVuIGF0IGFsbC5cbiAgIyBUaGUgbmFtZWQgbG9ncyBtdXN0IG1hdGNoIHRoZSBvbmVzIGNsaWNraG91c2UtY29uZmlnLnhtbCByZW1vdmVzOiBhIGxvZyB0aGF0XG4gICMgaXMgc3RpbGwgd3JpdHRlbiBnZXRzIHJlcGxhY2VkIG9uIHRoZSBuZXh0IHJlc3RhcnQgaWYgaXRzIFRUTCBpcyBhbHRlcmVkIGhlcmUuXG4gIGNsaWVudCAtLWZvcm1hdCBUU1ZSYXcgPDwnU1FMJyB8IGNsaWVudCAtLW11bHRpcXVlcnlcblNFTEVDVCBjb25jYXQoJ0FMVEVSIFRBQkxFIHN5c3RlbS4nLCBzdGFsZS5uYW1lLCAnIE1PRElGWSBUVEwgJywgaWYoYWN0aXZlLm5hbWUgPSAnJywgJ2V2ZW50X2RhdGUgKyBJTlRFUlZBTCA3IERBWSBERUxFVEUnLCBzcGxpdEJ5U3RyaW5nKCcgU0VUVElOR1MgJywgc3BsaXRCeVN0cmluZygnIFRUTCAnLCBhY3RpdmUuZW5naW5lX2Z1bGwpWzJdKVsxXSksICc7JylcbkZST00gKFxuICBTRUxFQ1QgbmFtZSwgc3BsaXRCeUNoYXIoJ18nLCBuYW1lKVstMV0gQVMgc3VmZml4LCBhcnJheVN0cmluZ0NvbmNhdChhcnJheVBvcEJhY2soc3BsaXRCeUNoYXIoJ18nLCBuYW1lKSksICdfJykgQVMgbG9nXG4gIEZST00gc3lzdGVtLnRhYmxlc1xuICBXSEVSRSBkYXRhYmFzZSA9ICdzeXN0ZW0nXG4gICAgQU5EIHBvc2l0aW9uKGVuZ2luZV9mdWxsLCAnIFRUTCAnKSA9IDBcbiAgICBBTkQgZW5kc1dpdGgoZW5naW5lLCAnTWVyZ2VUcmVlJylcbiAgICBBTkQgbmFtZSBJTiAoU0VMRUNUIHRhYmxlIEZST00gc3lzdGVtLmNvbHVtbnMgV0hFUkUgZGF0YWJhc2UgPSAnc3lzdGVtJyBBTkQgbmFtZSA9ICdldmVudF9kYXRlJyBBTkQgdHlwZSA9ICdEYXRlJylcbikgQVMgc3RhbGVcbkxFRlQgSk9JTiBzeXN0ZW0udGFibGVzIEFTIGFjdGl2ZVxuICBPTiBhY3RpdmUuZGF0YWJhc2UgPSAnc3lzdGVtJ1xuICBBTkQgYWN0aXZlLm5hbWUgPSBzdGFsZS5sb2dcbiAgQU5EIHBvc2l0aW9uKGFjdGl2ZS5lbmdpbmVfZnVsbCwgJyBUVEwgJykgPiAwXG5XSEVSRSAoZW5kc1dpdGgoc3RhbGUubG9nLCAnX2xvZycpIEFORCB0b1VJbnQ2NE9yTnVsbChzdGFsZS5zdWZmaXgpIElTIE5PVCBOVUxMKVxuICBPUiBzdGFsZS5uYW1lIElOICgnYXN5bmNocm9ub3VzX21ldHJpY19sb2cnLCAnbWV0cmljX2xvZycsICdoaXN0b2dyYW1fbWV0cmljX2xvZycsICdxdWVyeV9tZXRyaWNfbG9nJywgJ3Byb2Nlc3NvcnNfcHJvZmlsZV9sb2cnLCAndHJhY2VfbG9nJywgJ3RleHRfbG9nJylcblNRTFxuKSIKICAgIHVsaW1pdHM6CiAgICAgIG5vZmlsZToKICAgICAgICBzb2Z0OiAyNjIxNDQKICAgICAgICBoYXJkOiAyNjIxNDQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY2xpY2tob3VzZS1jbGllbnQgLS11c2VyICIkJENMSUNLSE9VU0VfVVNFUiIgLS1wYXNzd29yZCAiJCRDTElDS0hPVVNFX1BBU1NXT1JEIiAtLXF1ZXJ5ICJTRUxFQ1QgMSIgPiAvZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDIwCiAgICAgIHN0YXJ0X3BlcmlvZDogMzBzCg==",
         "tags": [
             "backend",
             "backend-as-a-service",
@@ -172,7 +172,7 @@
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
         "template_last_updated_at": "2026-09-08T19:41:04+02:00",
-        "port": "3003"
+        "port": "80"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -404,7 +404,7 @@
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
         "slogan": "Low code platform for building business apps and workflows in minutes. Supports PostgreSQL, MySQL, MSSQL, MongoDB, Rest API, Docker, K8s, and more.",
-        "compose": "c2VydmljZXM6CiAgYXBwLXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UuZG9ja2VyLnNjYXJmLnNoL2J1ZGliYXNlL2FwcHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFTEZfSE9TVEVEPTEKICAgICAgLSAnQ09VQ0hfREJfVVJMPWh0dHA6Ly8kU0VSVklDRV9VU0VSX0NPVUNIREI6JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQkBjb3VjaGRiLXNlcnZpY2U6NTk4NCcKICAgICAgLSAnV09SS0VSX1VSTD1odHRwOi8vd29ya2VyLXNlcnZpY2U6NDAwMycKICAgICAgLSAnTUlOSU9fVVJMPWh0dHA6Ly9taW5pby1zZXJ2aWNlOjkwMDAnCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdCVURJQkFTRV9FTlZJUk9OTUVOVD0ke0JVRElCQVNFX0VOVklST05NRU5UOi1QUk9EVUNUSU9OfScKICAgICAgLSBQT1JUPTQwMDIKICAgICAgLSBBUElfRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFQVBJCiAgICAgIC0gRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFCiAgICAgIC0gSldUX1NFQ1JFVD0kU0VSVklDRV9CQVNFNjRfNjRfQlVESUJBU0VKV1QKICAgICAgLSBMT0dfTEVWRUw9aW5mbwogICAgICAtICdFTkFCTEVfQU5BTFlUSUNTPSR7RU5BQkxFX0FOQUxZVElDUzotdHJ1ZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpcy1zZXJ2aWNlOjYzNzknCiAgICAgIC0gUkVESVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMKICAgICAgLSBCQl9BRE1JTl9VU0VSX0VNQUlMPQogICAgICAtIEJCX0FETUlOX1VTRVJfUEFTU1dPUkQ9CiAgICBkZXBlbmRzX29uOgogICAgICAtIHdvcmtlci1zZXJ2aWNlCiAgICAgIC0gcmVkaXMtc2VydmljZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICctcU8tJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6NDAwMi9oZWFsdGgnCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICB3b3JrZXItc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS5kb2NrZXIuc2NhcmYuc2gvYnVkaWJhc2Uvd29ya2VyCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRUxGX0hPU1RFRD0xCiAgICAgIC0gUE9SVD00MDAzCiAgICAgIC0gQ0xVU1RFUl9QT1JUPTEwMDAwCiAgICAgIC0gQVBJX0VOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF82NF9CVURJQkFTRUFQSQogICAgICAtIEpXVF9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFSldUCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtICdNSU5JT19VUkw9aHR0cDovL21pbmlvLXNlcnZpY2U6OTAwMCcKICAgICAgLSAnQVBQU19VUkw9aHR0cDovL2FwcC1zZXJ2aWNlOjQwMDInCiAgICAgIC0gQ09VQ0hfREJfVVNFUk5BTUU9JFNFUlZJQ0VfVVNFUl9DT1VDSERCCiAgICAgIC0gQ09VQ0hfREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQgogICAgICAtICdDT1VDSF9EQl9VUkw9aHR0cDovLyRTRVJWSUNFX1VTRVJfQ09VQ0hEQjokU0VSVklDRV9QQVNTV09SRF9DT1VDSERCQGNvdWNoZGItc2VydmljZTo1OTg0JwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdSRURJU19VUkw9cmVkaXMtc2VydmljZTo2Mzc5JwogICAgICAtIFJFRElTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JFRElTCiAgICBkZXBlbmRzX29uOgogICAgICAtIHJlZGlzLXNlcnZpY2UKICAgICAgLSBtaW5pby1zZXJ2aWNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJy1xTy0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo0MDAzL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG1pbmlvLXNlcnZpY2U6CiAgICBpbWFnZTogJ2doY3IuaW8vY29vbGxhYnNpby9taW5pbzpSRUxFQVNFLjIwMjUtMTAtMTVUMTctMjktNTVaJwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW9fZGF0YTovZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1JPT1RfVVNFUj0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIE1JTklPX0JST1dTRVI9b2ZmCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcHJveHktc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS9wcm94eQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0JVRElCQVNFXzEwMDAwCiAgICAgIC0gUFJPWFlfUkFURV9MSU1JVF9XRUJIT09LU19QRVJfU0VDT05EPTEwCiAgICAgIC0gUFJPWFlfUkFURV9MSU1JVF9BUElfUEVSX1NFQ09ORD0yMAogICAgICAtICdBUFBTX1VQU1RSRUFNX1VSTD1odHRwOi8vYXBwLXNlcnZpY2U6NDAwMicKICAgICAgLSAnV09SS0VSX1VQU1RSRUFNX1VSTD1odHRwOi8vd29ya2VyLXNlcnZpY2U6NDAwMycKICAgICAgLSAnTUlOSU9fVVBTVFJFQU1fVVJMPWh0dHA6Ly9taW5pby1zZXJ2aWNlOjkwMDAnCiAgICAgIC0gJ0NPVUNIREJfVVBTVFJFQU1fVVJMPWh0dHA6Ly9jb3VjaGRiLXNlcnZpY2U6NTk4NCcKICAgICAgLSBSRVNPTFZFUj0xMjcuMC4wLjExCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1pbmlvLXNlcnZpY2UKICAgICAgLSB3b3JrZXItc2VydmljZQogICAgICAtIGFwcC1zZXJ2aWNlCiAgICAgIC0gY291Y2hkYi1zZXJ2aWNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6MTAwMDAvJwogICAgICBpbnRlcnZhbDogMTVzCiAgICAgIHRpbWVvdXQ6IDE1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgY291Y2hkYi1zZXJ2aWNlOgogICAgaW1hZ2U6IGJ1ZGliYXNlL2RhdGFiYXNlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBDT1VDSERCX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX0NPVUNIREIKICAgICAgLSBDT1VDSERCX1VTRVI9JFNFUlZJQ0VfVVNFUl9DT1VDSERCCiAgICAgIC0gVEFSR0VUQlVJTEQ9ZG9ja2VyLWNvbXBvc2UKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1OTg0LycKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgdm9sdW1lczoKICAgICAgLSAnY291Y2hkYjNfZGF0YTovZGF0YScKICByZWRpcy1zZXJ2aWNlOgogICAgaW1hZ2U6IHJlZGlzCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tcmVxdWlyZXBhc3MgIiRTRVJWSUNFX1BBU1NXT1JEX1JFRElTIicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzX2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAkU0VSVklDRV9QQVNTV09SRF9SRURJUwogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogMTVzCiAgICAgIHRpbWVvdXQ6IDE1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCg==",
+        "compose": "c2VydmljZXM6CiAgYXBwLXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UuZG9ja2VyLnNjYXJmLnNoL2J1ZGliYXNlL2FwcHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFTEZfSE9TVEVEPTEKICAgICAgLSAnQ09VQ0hfREJfVVJMPWh0dHA6Ly8kU0VSVklDRV9VU0VSX0NPVUNIREI6JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQkBjb3VjaGRiLXNlcnZpY2U6NTk4NCcKICAgICAgLSAnV09SS0VSX1VSTD1odHRwOi8vd29ya2VyLXNlcnZpY2U6NDAwMycKICAgICAgLSAnTUlOSU9fVVJMPWh0dHA6Ly9taW5pby1zZXJ2aWNlOjkwMDAnCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdCVURJQkFTRV9FTlZJUk9OTUVOVD0ke0JVRElCQVNFX0VOVklST05NRU5UOi1QUk9EVUNUSU9OfScKICAgICAgLSBQT1JUPTQwMDIKICAgICAgLSBBUElfRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFQVBJCiAgICAgIC0gRU5DUllQVElPTl9LRVk9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFCiAgICAgIC0gSldUX1NFQ1JFVD0kU0VSVklDRV9CQVNFNjRfNjRfQlVESUJBU0VKV1QKICAgICAgLSBMT0dfTEVWRUw9aW5mbwogICAgICAtICdFTkFCTEVfQU5BTFlUSUNTPSR7RU5BQkxFX0FOQUxZVElDUzotdHJ1ZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpcy1zZXJ2aWNlOjYzNzknCiAgICAgIC0gUkVESVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMKICAgICAgLSBCQl9BRE1JTl9VU0VSX0VNQUlMPQogICAgICAtIEJCX0FETUlOX1VTRVJfUEFTU1dPUkQ9CiAgICBkZXBlbmRzX29uOgogICAgICAtIHdvcmtlci1zZXJ2aWNlCiAgICAgIC0gcmVkaXMtc2VydmljZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICctcU8tJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6NDAwMi9oZWFsdGgnCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICB3b3JrZXItc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS5kb2NrZXIuc2NhcmYuc2gvYnVkaWJhc2Uvd29ya2VyCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRUxGX0hPU1RFRD0xCiAgICAgIC0gUE9SVD00MDAzCiAgICAgIC0gQ0xVU1RFUl9QT1JUPTEwMDAwCiAgICAgIC0gQVBJX0VOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF82NF9CVURJQkFTRUFQSQogICAgICAtIEpXVF9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0XzY0X0JVRElCQVNFSldUCiAgICAgIC0gTUlOSU9fQUNDRVNTX0tFWT0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtICdNSU5JT19VUkw9aHR0cDovL21pbmlvLXNlcnZpY2U6OTAwMCcKICAgICAgLSAnQVBQU19VUkw9aHR0cDovL2FwcC1zZXJ2aWNlOjQwMDInCiAgICAgIC0gQ09VQ0hfREJfVVNFUk5BTUU9JFNFUlZJQ0VfVVNFUl9DT1VDSERCCiAgICAgIC0gQ09VQ0hfREJfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfQ09VQ0hEQgogICAgICAtICdDT1VDSF9EQl9VUkw9aHR0cDovLyRTRVJWSUNFX1VTRVJfQ09VQ0hEQjokU0VSVklDRV9QQVNTV09SRF9DT1VDSERCQGNvdWNoZGItc2VydmljZTo1OTg0JwogICAgICAtIElOVEVSTkFMX0FQSV9LRVk9JFNFUlZJQ0VfQkFTRTY0XzEyOF9CVURJQkFTRQogICAgICAtICdSRURJU19VUkw9cmVkaXMtc2VydmljZTo2Mzc5JwogICAgICAtIFJFRElTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JFRElTCiAgICBkZXBlbmRzX29uOgogICAgICAtIHJlZGlzLXNlcnZpY2UKICAgICAgLSBtaW5pby1zZXJ2aWNlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJy1xTy0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo0MDAzL2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG1pbmlvLXNlcnZpY2U6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvX2RhdGE6L2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgLSBNSU5JT19CUk9XU0VSPW9mZgogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHByb3h5LXNlcnZpY2U6CiAgICBpbWFnZTogYnVkaWJhc2UvcHJveHkKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9CVURJQkFTRV8xMDAwMAogICAgICAtIFBST1hZX1JBVEVfTElNSVRfV0VCSE9PS1NfUEVSX1NFQ09ORD0xMAogICAgICAtIFBST1hZX1JBVEVfTElNSVRfQVBJX1BFUl9TRUNPTkQ9MjAKICAgICAgLSAnQVBQU19VUFNUUkVBTV9VUkw9aHR0cDovL2FwcC1zZXJ2aWNlOjQwMDInCiAgICAgIC0gJ1dPUktFUl9VUFNUUkVBTV9VUkw9aHR0cDovL3dvcmtlci1zZXJ2aWNlOjQwMDMnCiAgICAgIC0gJ01JTklPX1VQU1RSRUFNX1VSTD1odHRwOi8vbWluaW8tc2VydmljZTo5MDAwJwogICAgICAtICdDT1VDSERCX1VQU1RSRUFNX1VSTD1odHRwOi8vY291Y2hkYi1zZXJ2aWNlOjU5ODQnCiAgICAgIC0gUkVTT0xWRVI9MTI3LjAuMC4xMQogICAgZGVwZW5kc19vbjoKICAgICAgLSBtaW5pby1zZXJ2aWNlCiAgICAgIC0gd29ya2VyLXNlcnZpY2UKICAgICAgLSBhcHAtc2VydmljZQogICAgICAtIGNvdWNoZGItc2VydmljZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjEwMDAwLycKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGNvdWNoZGItc2VydmljZToKICAgIGltYWdlOiBidWRpYmFzZS9kYXRhYmFzZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQ09VQ0hEQl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9DT1VDSERCCiAgICAgIC0gQ09VQ0hEQl9VU0VSPSRTRVJWSUNFX1VTRVJfQ09VQ0hEQgogICAgICAtIFRBUkdFVEJVSUxEPWRvY2tlci1jb21wb3NlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6NTk4NC8nCiAgICAgIGludGVydmFsOiAxNXMKICAgICAgdGltZW91dDogMTVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2NvdWNoZGIzX2RhdGE6L2RhdGEnCiAgcmVkaXMtc2VydmljZToKICAgIGltYWdlOiByZWRpcwogICAgY29tbWFuZDogJ3JlZGlzLXNlcnZlciAtLXJlcXVpcmVwYXNzICIkU0VSVklDRV9QQVNTV09SRF9SRURJUyInCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc19kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJFNFUlZJQ0VfUEFTU1dPUkRfUkVESVMKICAgICAgICAtIHBpbmcKICAgICAgaW50ZXJ2YWw6IDE1cwogICAgICB0aW1lb3V0OiAxNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDEwcwo=",
         "tags": [
             "budibase",
             "low-code",
@@ -460,7 +460,7 @@
     "buzz": {
         "documentation": "https://github.com/block/buzz?utm_source=coolify.io",
         "slogan": "Self-hostable workspace where humans and AI agents collaborate on a Nostr relay you own.",
-        "compose": "c2VydmljZXM6CiAgYnV6ejoKICAgIGltYWdlOiAnZ2hjci5pby9ibG9jay9idXp6OiR7QlVaWl9UQUc6LW1haW59JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0JVWlpfMzAwMAogICAgICAtICdCVVpaX0JJTkRfQUREUj0wLjAuMC4wOjMwMDAnCiAgICAgIC0gQlVaWl9IRUFMVEhfUE9SVD04MDgwCiAgICAgIC0gQlVaWl9NRVRSSUNTX1BPUlQ9OTEwMgogICAgICAtICdSRUxBWV9VUkw9d3NzOi8vJHtTRVJWSUNFX0ZRRE5fQlVaWn0nCiAgICAgIC0gJ0JVWlpfTUVESUFfQkFTRV9VUkw9JHtTRVJWSUNFX0ZRRE5fQlVaWn0vbWVkaWEnCiAgICAgIC0gJ0JVWlpfTUVESUFfU0VSVkVSX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9CVVpafScKICAgICAgLSAnQlVaWl9DT1JTX09SSUdJTlM9JHtTRVJWSUNFX0ZRRE5fQlVaWn0sdGF1cmk6Ly9sb2NhbGhvc3QsaHR0cDovL3RhdXJpLmxvY2FsaG9zdCcKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1idXp6fScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQlVaWl9TM19FTkRQT0lOVD1odHRwOi8vbWluaW86OTAwMCcKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgICAtIEJVWlpfR0lUX1JFUE9fUEFUSD0vZGF0YS9naXQKICAgICAgLSAnQlVaWl9SRUxBWV9QUklWQVRFX0tFWT0ke1NFUlZJQ0VfSEVYXzY0X1JFTEFZS0VZfScKICAgICAgLSAnQlVaWl9HSVRfSE9PS19ITUFDX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X0dJVEhNQUN9JwogICAgICAtICdCVVpaX0FVVE9fTUlHUkFURT0ke0JVWlpfQVVUT19NSUdSQVRFOi10cnVlfScKICAgICAgLSAnQlVaWl9HSVRfQ09ORk9STUFOQ0VfUFJPQkU9JHtCVVpaX0dJVF9DT05GT1JNQU5DRV9QUk9CRTotdHJ1ZX0nCiAgICAgIC0gJ0JVWlpfUkVRVUlSRV9BVVRIX1RPS0VOPSR7QlVaWl9SRVFVSVJFX0FVVEhfVE9LRU46LXRydWV9JwogICAgICAtICdCVVpaX1JFUVVJUkVfUkVMQVlfTUVNQkVSU0hJUD0ke0JVWlpfUkVRVUlSRV9SRUxBWV9NRU1CRVJTSElQOi1mYWxzZX0nCiAgICAgIC0gJ0JVWlpfQUxMT1dfTklQX09BX0FVVEg9JHtCVVpaX0FMTE9XX05JUF9PQV9BVVRIOi10cnVlfScKICAgICAgLSAnUkVMQVlfT1dORVJfUFVCS0VZPSR7UkVMQVlfT1dORVJfUFVCS0VZfScKICAgICAgLSAnUlVTVF9MT0c9JHtSVVNUX0xPRzotYnV6el9yZWxheT1pbmZvLGJ1enpfZGI9aW5mbyxidXp6X2F1dGg9aW5mbyxidXp6X3B1YnN1Yj1pbmZvLHRvd2VyX2h0dHA9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdidXp6LWdpdC1kYXRhOi9kYXRhL2dpdCcKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvLWluaXQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIGh0dHA6Ly8xMjcuMC4wLjE6ODA4MC9fcmVhZGluZXNzID4vZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNDVzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYnV6en0nCiAgICAgIC0gUEdEQVRBPS92YXIvbGliL3Bvc3RncmVzcWwvZGF0YS9wZ2RhdGEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2J1enotcG9zdGdyZXMtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTIKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLWFwcGVuZG9ubHknCiAgICAgIC0gJ3llcycKICAgICAgLSAnLS1yZXF1aXJlcGFzcycKICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLSAnYnV6ei1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgLWEgIiQke1JFRElTX1BBU1NXT1JEfSIgcGluZyB8IGdyZXAgLXEgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBtaW5pbzoKICAgIGltYWdlOiAnbWluaW8vbWluaW86UkVMRUFTRS4yMDI1LTA5LTA3VDE2LTEzLTA5WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNSU5JT19ST09UX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdNSU5JT19ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICB2b2x1bWVzOgogICAgICAtICdidXp6LW1pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6OTAwMC9taW5pby9oZWFsdGgvbGl2ZScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAnbWluaW8vbWM6UkVMRUFTRS4yMDI1LTA4LTEzVDA4LTM1LTQxWicKICAgIGRlcGVuZHNfb246CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICAgIC0gJy1ldWMnCiAgICAgIC0gIm1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCBcIiQke0JVWlpfUzNfQUNDRVNTX0tFWX1cIiBcIiQke0JVWlpfUzNfU0VDUkVUX0tFWX1cIlxubWMgbWIgLS1pZ25vcmUtZXhpc3RpbmcgXCJsb2NhbC8kJHtCVVpaX1MzX0JVQ0tFVH1cIlxubWMgYW5vbnltb3VzIHNldCBub25lIFwibG9jYWwvJCR7QlVaWl9TM19CVUNLRVR9XCIiCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUK",
+        "compose": "c2VydmljZXM6CiAgYnV6ejoKICAgIGltYWdlOiAnZ2hjci5pby9ibG9jay9idXp6OiR7QlVaWl9UQUc6LW1haW59JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0JVWlpfMzAwMAogICAgICAtICdCVVpaX0JJTkRfQUREUj0wLjAuMC4wOjMwMDAnCiAgICAgIC0gQlVaWl9IRUFMVEhfUE9SVD04MDgwCiAgICAgIC0gQlVaWl9NRVRSSUNTX1BPUlQ9OTEwMgogICAgICAtICdSRUxBWV9VUkw9d3NzOi8vJHtTRVJWSUNFX0ZRRE5fQlVaWn0nCiAgICAgIC0gJ0JVWlpfTUVESUFfQkFTRV9VUkw9JHtTRVJWSUNFX0ZRRE5fQlVaWn0vbWVkaWEnCiAgICAgIC0gJ0JVWlpfTUVESUFfU0VSVkVSX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9CVVpafScKICAgICAgLSAnQlVaWl9DT1JTX09SSUdJTlM9JHtTRVJWSUNFX0ZRRE5fQlVaWn0sdGF1cmk6Ly9sb2NhbGhvc3QsaHR0cDovL3RhdXJpLmxvY2FsaG9zdCcKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1idXp6fScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnQlVaWl9TM19FTkRQT0lOVD1odHRwOi8vbWluaW86OTAwMCcKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgICAtIEJVWlpfR0lUX1JFUE9fUEFUSD0vZGF0YS9naXQKICAgICAgLSAnQlVaWl9SRUxBWV9QUklWQVRFX0tFWT0ke1NFUlZJQ0VfSEVYXzY0X1JFTEFZS0VZfScKICAgICAgLSAnQlVaWl9HSVRfSE9PS19ITUFDX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X0dJVEhNQUN9JwogICAgICAtICdCVVpaX0FVVE9fTUlHUkFURT0ke0JVWlpfQVVUT19NSUdSQVRFOi10cnVlfScKICAgICAgLSAnQlVaWl9HSVRfQ09ORk9STUFOQ0VfUFJPQkU9JHtCVVpaX0dJVF9DT05GT1JNQU5DRV9QUk9CRTotdHJ1ZX0nCiAgICAgIC0gJ0JVWlpfUkVRVUlSRV9BVVRIX1RPS0VOPSR7QlVaWl9SRVFVSVJFX0FVVEhfVE9LRU46LXRydWV9JwogICAgICAtICdCVVpaX1JFUVVJUkVfUkVMQVlfTUVNQkVSU0hJUD0ke0JVWlpfUkVRVUlSRV9SRUxBWV9NRU1CRVJTSElQOi1mYWxzZX0nCiAgICAgIC0gJ0JVWlpfQUxMT1dfTklQX09BX0FVVEg9JHtCVVpaX0FMTE9XX05JUF9PQV9BVVRIOi10cnVlfScKICAgICAgLSAnUkVMQVlfT1dORVJfUFVCS0VZPSR7UkVMQVlfT1dORVJfUFVCS0VZfScKICAgICAgLSAnUlVTVF9MT0c9JHtSVVNUX0xPRzotYnV6el9yZWxheT1pbmZvLGJ1enpfZGI9aW5mbyxidXp6X2F1dGg9aW5mbyxidXp6X3B1YnN1Yj1pbmZvLHRvd2VyX2h0dHA9aW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdidXp6LWdpdC1kYXRhOi9kYXRhL2dpdCcKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvLWluaXQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnY3VybCAtZnNTIGh0dHA6Ly8xMjcuMC4wLjE6ODA4MC9fcmVhZGluZXNzID4vZGV2L251bGwgfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNDVzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotYnV6en0nCiAgICAgIC0gUEdEQVRBPS92YXIvbGliL3Bvc3RncmVzcWwvZGF0YS9wZ2RhdGEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2J1enotcG9zdGdyZXMtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTIKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLWFwcGVuZG9ubHknCiAgICAgIC0gJ3llcycKICAgICAgLSAnLS1yZXF1aXJlcGFzcycKICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEX1JFRElTfScKICAgIGVudmlyb25tZW50OgogICAgICAtICdSRURJU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUkVESVN9JwogICAgdm9sdW1lczoKICAgICAgLSAnYnV6ei1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdyZWRpcy1jbGkgLWEgIiQke1JFRElTX1BBU1NXT1JEfSIgcGluZyB8IGdyZXAgLXEgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDEyCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMKICBtaW5pbzoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2J1enotbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIG1pbmlvLWluaXQ6CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGRlcGVuZHNfb246CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnQlVaWl9TM19BQ0NFU1NfS0VZPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQlVaWl9TM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gJ0JVWlpfUzNfQlVDS0VUPSR7QlVaWl9TM19CVUNLRVQ6LWJ1enotbWVkaWF9JwogICAgZW50cnlwb2ludDoKICAgICAgLSAvYmluL3NoCiAgICAgIC0gJy1ldWMnCiAgICAgIC0gIm1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCBcIiQke0JVWlpfUzNfQUNDRVNTX0tFWX1cIiBcIiQke0JVWlpfUzNfU0VDUkVUX0tFWX1cIlxubWMgbWIgLS1pZ25vcmUtZXhpc3RpbmcgXCJsb2NhbC8kJHtCVVpaX1MzX0JVQ0tFVH1cIlxubWMgYW5vbnltb3VzIHNldCBub25lIFwibG9jYWwvJCR7QlVaWl9TM19CVUNLRVR9XCIiCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUK",
         "tags": [
             "buzz",
             "chat",
@@ -1376,7 +1376,7 @@
     "ente-photos-with-s3": {
         "documentation": "https://help.ente.io/self-hosting/installation/compose?utm_source=coolify.io",
         "slogan": "Ente Photos is a fully open source, End to End Encrypted alternative to Google Photos and Apple Photos.",
-        "compose": "c2VydmljZXM6CiAgbXVzZXVtOgogICAgaW1hZ2U6ICdnaGNyLmlvL2VudGUtaW8vc2VydmVyOjYxM2M2YTk2MzkwZDdhNjI0Y2YzMGI5NDY5NTU3MDVkNjMyNDIzY2MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTVVTRVVNXzgwODAKICAgICAgLSBFTlRFX0RCX0hPU1Q9cG9zdGdyZXMKICAgICAgLSBFTlRFX0RCX1BPUlQ9NTQzMgogICAgICAtICdFTlRFX0RCX05BTUU9JHtQT1NUR1JFU19EQjotZW50ZV9kYn0nCiAgICAgIC0gJ0VOVEVfREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ0VOVEVfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnRU5URV9IVFRQX1VTRV9UTFM9JHtFTlRFX0hUVFBfVVNFX1RMUzotZmFsc2V9JwogICAgICAtIEVOVEVfUzNfQVJFX0xPQ0FMX0JVQ0tFVFM9ZmFsc2UKICAgICAgLSBFTlRFX1MzX1VTRV9QQVRIX1NUWUxFX1VSTFM9dHJ1ZQogICAgICAtICdFTlRFX1MzX0IyX0VVX0NFTl9LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdFTlRFX1MzX0IyX0VVX0NFTl9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnRU5URV9TM19CMl9FVV9DRU5fRU5EUE9JTlQ9JHtTRVJWSUNFX0ZRRE5fTUlOSU9fOTAwMH0nCiAgICAgIC0gRU5URV9TM19CMl9FVV9DRU5fUkVHSU9OPWV1LWNlbnRyYWwtMgogICAgICAtIEVOVEVfUzNfQjJfRVVfQ0VOX0JVQ0tFVD1iMi1ldS1jZW4KICAgICAgLSAnRU5URV9LRVlfRU5DUllQVElPTj0ke1NFUlZJQ0VfUkVBTEJBU0U2NF9FTkNSWVBUSU9OfScKICAgICAgLSAnRU5URV9LRVlfSEFTSD0ke1NFUlZJQ0VfUkVBTEJBU0U2NF82NF9IQVNIfScKICAgICAgLSAnRU5URV9KV1RfU0VDUkVUPSR7U0VSVklDRV9SRUFMQkFTRTY0X0pXVH0nCiAgICAgIC0gJ0VOVEVfSU5URVJOQUxfQURNSU49JHtFTlRFX0lOVEVSTkFMX0FETUlOOi0xNTgwNTU5OTYyMzg2NDM4fScKICAgICAgLSAnRU5URV9JTlRFUk5BTF9ESVNBQkxFX1JFR0lTVFJBVElPTj0ke0VOVEVfSU5URVJOQUxfRElTQUJMRV9SRUdJU1RSQVRJT046LWZhbHNlfScKICAgICAgLSAnRU5URV9TTVRQX0hPU1Q9JHtFTlRFX1NNVFBfSE9TVDotc210cC5nbWFpbC5jb219JwogICAgICAtICdFTlRFX1NNVFBfUE9SVD0ke0VOVEVfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdFTlRFX1NNVFBfVVNFUk5BTUU9JHtFTlRFX1NNVFBfVVNFUk5BTUV9JwogICAgICAtICdFTlRFX1NNVFBfUEFTU1dPUkQ9JHtFTlRFX1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdFTlRFX1NNVFBfRU1BSUw9JHtFTlRFX1NNVFBfRU1BSUx9JwogICAgICAtICdFTlRFX1NNVFBfU0VOREVSX05BTUU9JHtFTlRFX1NNVFBfU0VOREVSX05BTUV9JwogICAgICAtICdFTlRFX1NNVFBfRU5DUllQVElPTj0ke0VOVEVfU01UUF9FTkNSWVBUSU9OOi10bHN9JwogICAgdm9sdW1lczoKICAgICAgLSAnbXVzZXVtLWRhdGE6L2RhdGEnCiAgICAgIC0gJ211c2V1bS1jb25maWc6L2NvbmZpZycKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC9waW5nJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgd2ViOgogICAgaW1hZ2U6ICdnaGNyLmlvL2VudGUtaW8vd2ViOmNhMDMxNjVmNWU3ZjJhNTAxMDVlNmU0MDAxOWMxN2FlNmNkZDkzNGYnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fV0VCXzMwMDAKICAgICAgLSAnRU5URV9BUElfT1JJR0lOPSR7U0VSVklDRV9GUUROX01VU0VVTX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy0tZmFpbCcKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjMwMDAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfSAtZCAke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgbWluaW86CiAgICBpbWFnZTogJ2doY3IuaW8vY29vbGxhYnNpby9taW5pbzpSRUxFQVNFLjIwMjUtMTAtMTVUMTctMjktNTVaJwogICAgY29tbWFuZDogJ3NlcnZlciAvZGF0YSAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gTUlOSU9fU0VSVkVSX1VSTD0kTUlOSU9fU0VSVkVSX1VSTAogICAgICAtIE1JTklPX0JST1dTRVJfUkVESVJFQ1RfVVJMPSRNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTAogICAgICAtIE1JTklPX1JPT1RfVVNFUj0kU0VSVklDRV9VU0VSX01JTklPCiAgICAgIC0gTUlOSU9fUk9PVF9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtaW5pby1pbml0OgogICAgaW1hZ2U6ICdtaW5pby9tYzpSRUxFQVNFLjIwMjUtMDgtMTNUMDgtMzUtNDFaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIHJlc3RhcnQ6IG9uLWZhaWx1cmUKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnTUlOSU9fQ09SU19VUkxTPSRTRVJWSUNFX0ZRRE5fTVVTRVVNLCRTRVJWSUNFX0ZRRE5fV0VCJwogICAgZW50cnlwb2ludDogIi9iaW4vc2ggLWMgXCJcbiAgZWNobyBcXFwiTUlOSU9fQ09SU19VUkxTOiBcXCQke01JTklPX0NPUlNfVVJMU31cXFwiO1xuICBzbGVlcCA1O1xuICB1bnRpbCBtYyBhbGlhcyBzZXQgbWluaW8gaHR0cDovL21pbmlvOjkwMDAgXFwkJHtNSU5JT19ST09UX1VTRVJ9IFxcJCR7TUlOSU9fUk9PVF9QQVNTV09SRH07IGRvXG4gICAgZWNobyAnV2FpdGluZyBmb3IgTWluSU8uLi4nO1xuICAgIHNsZWVwIDI7XG4gIGRvbmU7XG4gIG1jIGFkbWluIGNvbmZpZyBzZXQgbWluaW8gYXBpIGNvcnNfYWxsb3dfb3JpZ2luPSckTUlOSU9fQ09SU19VUkxTJyB8fCB0cnVlO1xuICBtYyBtYiBtaW5pby9iMi1ldS1jZW4gLS1pZ25vcmUtZXhpc3Rpbmc7XG4gIG1jIG1iIG1pbmlvL3dhc2FiaS1ldS1jZW50cmFsLTItdjMgLS1pZ25vcmUtZXhpc3Rpbmc7XG4gIG1jIG1iIG1pbmlvL3Njdy1ldS1mci12MyAtLWlnbm9yZS1leGlzdGluZztcbiAgZWNobyAnTWluSU8gYnVja2V0cyBhbmQgQ09SUyBjb25maWd1cmVkJztcblwiIgo=",
+        "compose": "c2VydmljZXM6CiAgbXVzZXVtOgogICAgaW1hZ2U6ICdnaGNyLmlvL2VudGUtaW8vc2VydmVyOjYxM2M2YTk2MzkwZDdhNjI0Y2YzMGI5NDY5NTU3MDVkNjMyNDIzY2MnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTVVTRVVNXzgwODAKICAgICAgLSBFTlRFX0RCX0hPU1Q9cG9zdGdyZXMKICAgICAgLSBFTlRFX0RCX1BPUlQ9NTQzMgogICAgICAtICdFTlRFX0RCX05BTUU9JHtQT1NUR1JFU19EQjotZW50ZV9kYn0nCiAgICAgIC0gJ0VOVEVfREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ0VOVEVfREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnRU5URV9IVFRQX1VTRV9UTFM9JHtFTlRFX0hUVFBfVVNFX1RMUzotZmFsc2V9JwogICAgICAtIEVOVEVfUzNfQVJFX0xPQ0FMX0JVQ0tFVFM9ZmFsc2UKICAgICAgLSBFTlRFX1MzX1VTRV9QQVRIX1NUWUxFX1VSTFM9dHJ1ZQogICAgICAtICdFTlRFX1MzX0IyX0VVX0NFTl9LRVk9JHtTRVJWSUNFX1VTRVJfTUlOSU99JwogICAgICAtICdFTlRFX1MzX0IyX0VVX0NFTl9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnRU5URV9TM19CMl9FVV9DRU5fRU5EUE9JTlQ9JHtTRVJWSUNFX0ZRRE5fTUlOSU9fOTAwMH0nCiAgICAgIC0gRU5URV9TM19CMl9FVV9DRU5fUkVHSU9OPWV1LWNlbnRyYWwtMgogICAgICAtIEVOVEVfUzNfQjJfRVVfQ0VOX0JVQ0tFVD1iMi1ldS1jZW4KICAgICAgLSAnRU5URV9LRVlfRU5DUllQVElPTj0ke1NFUlZJQ0VfUkVBTEJBU0U2NF9FTkNSWVBUSU9OfScKICAgICAgLSAnRU5URV9LRVlfSEFTSD0ke1NFUlZJQ0VfUkVBTEJBU0U2NF82NF9IQVNIfScKICAgICAgLSAnRU5URV9KV1RfU0VDUkVUPSR7U0VSVklDRV9SRUFMQkFTRTY0X0pXVH0nCiAgICAgIC0gJ0VOVEVfSU5URVJOQUxfQURNSU49JHtFTlRFX0lOVEVSTkFMX0FETUlOOi0xNTgwNTU5OTYyMzg2NDM4fScKICAgICAgLSAnRU5URV9JTlRFUk5BTF9ESVNBQkxFX1JFR0lTVFJBVElPTj0ke0VOVEVfSU5URVJOQUxfRElTQUJMRV9SRUdJU1RSQVRJT046LWZhbHNlfScKICAgICAgLSAnRU5URV9TTVRQX0hPU1Q9JHtFTlRFX1NNVFBfSE9TVDotc210cC5nbWFpbC5jb219JwogICAgICAtICdFTlRFX1NNVFBfUE9SVD0ke0VOVEVfU01UUF9QT1JUOi01ODd9JwogICAgICAtICdFTlRFX1NNVFBfVVNFUk5BTUU9JHtFTlRFX1NNVFBfVVNFUk5BTUV9JwogICAgICAtICdFTlRFX1NNVFBfUEFTU1dPUkQ9JHtFTlRFX1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdFTlRFX1NNVFBfRU1BSUw9JHtFTlRFX1NNVFBfRU1BSUx9JwogICAgICAtICdFTlRFX1NNVFBfU0VOREVSX05BTUU9JHtFTlRFX1NNVFBfU0VOREVSX05BTUV9JwogICAgICAtICdFTlRFX1NNVFBfRU5DUllQVElPTj0ke0VOVEVfU01UUF9FTkNSWVBUSU9OOi10bHN9JwogICAgdm9sdW1lczoKICAgICAgLSAnbXVzZXVtLWRhdGE6L2RhdGEnCiAgICAgIC0gJ211c2V1bS1jb25maWc6L2NvbmZpZycKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC9waW5nJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCiAgd2ViOgogICAgaW1hZ2U6ICdnaGNyLmlvL2VudGUtaW8vd2ViOmNhMDMxNjVmNWU3ZjJhNTAxMDVlNmU0MDAxOWMxN2FlNmNkZDkzNGYnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fV0VCXzMwMDAKICAgICAgLSAnRU5URV9BUElfT1JJR0lOPSR7U0VSVklDRV9GUUROX01VU0VVTX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy0tZmFpbCcKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjMwMDAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfSAtZCAke1BPU1RHUkVTX0RCOi1lbnRlX2RifScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgbWluaW86CiAgICBpbWFnZTogJ3Bnc3R5L3NpbG86UkVMRUFTRS4yMDI2LTEwLTE1VDAwLTAwLTAwWicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1NFUlZFUl9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTD0kTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkwKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIHJlc3RhcnQ6IG9uLWZhaWx1cmUKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgICAgLSAnTUlOSU9fQ09SU19VUkxTPSRTRVJWSUNFX0ZRRE5fTVVTRVVNLCRTRVJWSUNFX0ZRRE5fV0VCJwogICAgZW50cnlwb2ludDogIi9iaW4vc2ggLWMgXCJcbiAgZWNobyBcXFwiTUlOSU9fQ09SU19VUkxTOiBcXCQke01JTklPX0NPUlNfVVJMU31cXFwiO1xuICBzbGVlcCA1O1xuICB1bnRpbCBtYyBhbGlhcyBzZXQgbWluaW8gaHR0cDovL21pbmlvOjkwMDAgXFwkJHtNSU5JT19ST09UX1VTRVJ9IFxcJCR7TUlOSU9fUk9PVF9QQVNTV09SRH07IGRvXG4gICAgZWNobyAnV2FpdGluZyBmb3IgTWluSU8uLi4nO1xuICAgIHNsZWVwIDI7XG4gIGRvbmU7XG4gIG1jIGFkbWluIGNvbmZpZyBzZXQgbWluaW8gYXBpIGNvcnNfYWxsb3dfb3JpZ2luPSckTUlOSU9fQ09SU19VUkxTJyB8fCB0cnVlO1xuICBtYyBtYiBtaW5pby9iMi1ldS1jZW4gLS1pZ25vcmUtZXhpc3Rpbmc7XG4gIG1jIG1iIG1pbmlvL3dhc2FiaS1ldS1jZW50cmFsLTItdjMgLS1pZ25vcmUtZXhpc3Rpbmc7XG4gIG1jIG1iIG1pbmlvL3Njdy1ldS1mci12MyAtLWlnbm9yZS1leGlzdGluZztcbiAgZWNobyAnTWluSU8gYnVja2V0cyBhbmQgQ09SUyBjb25maWd1cmVkJztcblwiIgo=",
         "tags": [
             "photos",
             "gallery",
@@ -1684,7 +1684,7 @@
     "forgejo-with-mariadb": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9bXlzcWwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7TVlTUUxfREFUQUJBU0UtZm9yZ2Vqb30nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1VTRVI9JFNFUlZJQ0VfVVNFUl9NWVNRTAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19QQVNTV0Q9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcyMjIyMjoyMicKICAgIGRlcGVuZHNfb246CiAgICAgIG1hcmlhZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFfScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9QT1JUPSR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9bXlzcWwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1tYXJpYWRiCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7TVlTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBwb3J0czoKICAgICAgLSAnJHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn06MjInCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLW1hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
         "tags": [
             "version control",
             "collaboration",
@@ -1702,7 +1702,7 @@
     "forgejo-with-mysql": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9bXlzcWwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1teXNxbAogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke01ZU1FMX0RBVEFCQVNFLWZvcmdlam99JwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBwb3J0czoKICAgICAgLSAnMjIyMjI6MjInCiAgICBkZXBlbmRzX29uOgogICAgICBteXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBteXNxbDoKICAgIGltYWdlOiAnbXlzcWw6OCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRX0nCiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9QT1JUPSR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9bXlzcWwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1teXNxbAogICAgICAtICdGT1JHRUpPX19kYXRhYmFzZV9fTkFNRT0ke01ZU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fVVNFUj0kU0VSVklDRV9VU0VSX01ZU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9NWVNRTAogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgZGVwZW5kc19vbjoKICAgICAgbXlzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbXlzcWw6CiAgICBpbWFnZTogJ215c3FsOjgnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "version control",
             "collaboration",
@@ -1720,7 +1720,7 @@
     "forgejo-with-postgresql": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9cG9zdGdyZXMKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1wb3N0Z3Jlc3FsCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7UE9TVEdSRVNRTF9EQVRBQkFTRS1mb3JnZWpvfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUwKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcyMjIyMjoyMicKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzcWw6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgcG9zdGdyZXNxbDoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9QT1JUPSR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX0RCX1RZUEU9cG9zdGdyZXMKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fSE9TVD1wb3N0Z3Jlc3FsCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7UE9TVEdSRVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1BBU1NXRD0kU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBwb3J0czoKICAgICAgLSAnJHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn06MjInCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHBvc3RncmVzcWw6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTUUx9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "version control",
             "collaboration",
@@ -1735,10 +1735,97 @@
         "template_last_updated_at": "2026-08-10T11:35:20+02:00",
         "port": "3000"
     },
+    "forgejo-with-runner-with-mariadb": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M6LWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fREJfVFlQRT1teXNxbAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19IT1NUPW1hcmlhZGIKICAgICAgLSAnRk9SR0VKT19fZGF0YWJhc2VfX05BTUU9JHtNWVNRTF9EQVRBQkFTRTotZm9yZ2Vqb30nCiAgICAgIC0gRk9SR0VKT19fZGF0YWJhc2VfX1VTRVI9JFNFUlZJQ0VfVVNFUl9NWVNRTAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19QQVNTV0Q9JFNFUlZJQ0VfUEFTU1dPUkRfTVlTUUwKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtICdSVU5ORVJfU0hBUkVEX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1JVTk5FUn0nCiAgICAgIC0gRk9SR0VKT19fc2VjdXJpdHlfX0lOU1RBTExfTE9DSz10cnVlCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fVVNFUj0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnRk9SR0VKT19BRE1JTl9FTUFJTD0ke0ZPUkdFSk9fQURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSBGT1JHRUpPX19yZXBvc2l0b3J5X19FTkFCTEVfUFVTSF9DUkVBVEVfVVNFUj10cnVlCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fREVGQVVMVF9QVVNIX0NSRUFURV9QUklWQVRFPWZhbHNlCiAgICAgIC0gJ0ZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUkVQT19VTklUUz1yZXBvLmNvZGUscmVwby5hY3Rpb25zJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mcyBodHRwOi8vMTI3LjAuMC4xOjMwMDAgPiAvZGV2L251bGwgJiYgdGVzdCAtZiAvdG1wL3J1bm5lci1yZWdpc3RlcmVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMwCiAgICBjb21tYW5kOiAnYmFzaCAtYyAnJyAvdXNyL2Jpbi9zNi1zdnNjYW4gL2V0Yy9zNiAmIHVudGlsIHN1IC1jICJmb3JnZWpvIGZvcmdlam8tY2xpIGFjdGlvbnMgcmVnaXN0ZXIgLS1rZWVwLWxhYmVscyAtLXNlY3JldCAkJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSIgZ2l0IDsgZG8gc2xlZXAgNSA7IGRvbmUgOyBzdSAtYyAiZm9yZ2VqbyBhZG1pbiB1c2VyIGNyZWF0ZSAtLWFkbWluIC0tdXNlcm5hbWUgXCIkJEZPUkdFSk9fQURNSU5fVVNFUlwiIC0tcGFzc3dvcmQgXCIkJEZPUkdFSk9fQURNSU5fUEFTU1dPUkRcIiAtLWVtYWlsIFwiJCRGT1JHRUpPX0FETUlOX0VNQUlMXCIgLS1tdXN0LWNoYW5nZS1wYXNzd29yZD1mYWxzZSIgZ2l0IHx8IHRydWUgOyB0b3VjaCAvdG1wL3J1bm5lci1yZWdpc3RlcmVkIDsgd2FpdCAnJycKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1tYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTFJPT1R9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgZG9ja2VyLWluLWRvY2tlcjoKICAgIGltYWdlOiAnZG9ja2VyOmRpbmQnCiAgICBob3N0bmFtZTogZG9ja2VyCiAgICBwcml2aWxlZ2VkOiB0cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZG9ja2VyCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAndW5peDovLy92YXIvcnVuL2RvY2tlci5zb2NrJwogICAgICAgIC0gaW5mbwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gRE9DS0VSX1RMU19DRVJURElSPS9jZXJ0cwogICAgICAtIERPQ0tFUl9IT1NUPWRvY2tlci1pbi1kb2NrZXIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGlkLWNlcnRzOi9jZXJ0cycKICBydW5uZXItcmVnaXN0ZXI6CiAgICBpbWFnZTogJ2RhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXI6MTMuMi4wJwogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUlVOTkVSX1NIQVJFRF9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SVU5ORVJ9JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1ydW5uZXItZGF0YTovZGF0YScKICAgIHVzZXI6ICcwOjAnCiAgICBjb21tYW5kOiAnYmFzaCAtZWMgJycgc2VjcmV0PSQke1JVTk5FUl9TSEFSRURfU0VDUkVUOjA6NDB9IDsgdXVpZD0kJChwcmludGYgJXMgIiQke3NlY3JldDowOjE2fSIgfCBvZCAtQW4gLXR4MSB8IHRyIC1kICIgXG4iIHwgc2VkIC1FICJzLyguezh9KSguezR9KSguezR9KSguezR9KSguezEyfSkvXDEtXDItXDMtXDQtXDUvIikgOyBmb3JnZWpvLXJ1bm5lciBnZW5lcmF0ZS1jb25maWcgPiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfCAgbGFiZWxzOiBcW1xdfCAgbGFiZWxzOiBbXCJkb2NrZXI6ZG9ja2VyOi8vbm9kZToyMi1ib29rd29ybVwiLCBcInVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vY2F0dGhlaGFja2VyL3VidW50dTphY3QtMjIuMDRcIiwgXCJ1YnVudHUtMjIuMDQ6ZG9ja2VyOi8vY2F0dGhlaGFja2VyL3VidW50dTphY3QtMjIuMDRcIl18IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfG5ldHdvcms6IC4qfG5ldHdvcms6IGhvc3R8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfF4gIGVudnM6JCR8ICBlbnZzOlxuICAgIERPQ0tFUl9IT1NUOiB0Y3A6Ly9kb2NrZXI6MjM3NlxuICAgIERPQ0tFUl9UTFNfVkVSSUZZOiAxXG4gICAgRE9DS0VSX0NFUlRfUEFUSDogL2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8XiAgb3B0aW9uczp8ICBvcHRpb25zOiAtdiAvY2VydHMvY2xpZW50Oi9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfCAgdmFsaWRfdm9sdW1lczogXFtcXSQkfCAgdmFsaWRfdm9sdW1lczpcbiAgICAtIC9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfCAgY29ubmVjdGlvbnM6fCAgY29ubmVjdGlvbnM6XG4gICAgZGVmYXVsdDpcbiAgICAgIHVybDogaHR0cDovL2Zvcmdlam86MzAwMFxuICAgICAgdXVpZDogJCR1dWlkXG4gICAgICB0b2tlbjogJCRzZWNyZXR8IiBjb25maWcueW1sIDsgY2hvd24gLVIgMTAwMDoxMDAwIC9kYXRhICcnJwogIHJ1bm5lcjoKICAgIGltYWdlOiAnZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL3J1bm5lcjoxMy4yLjAnCiAgICBkZXBlbmRzX29uOgogICAgICBmb3JnZWpvOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIGRvY2tlci1pbi1kb2NrZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcnVubmVyLXJlZ2lzdGVyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnRE9DS0VSX0hPU1Q9dGNwOi8vZG9ja2VyOjIzNzYnCiAgICAgIC0gRE9DS0VSX0NFUlRfUEFUSD0vY2VydHMvY2xpZW50CiAgICAgIC0gRE9DS0VSX1RMU19WRVJJRlk9MQogICAgdXNlcjogJzEwMDA6MTAwMCcKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcnVubmVyLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tZGlkLWNlcnRzOi9jZXJ0cycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwZ3JlcAogICAgICAgIC0gZm9yZ2Vqby1ydW5uZXIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTAKICAgIGNvbW1hbmQ6ICdmb3JnZWpvLXJ1bm5lciAtLWNvbmZpZyBjb25maWcueW1sIGRhZW1vbicK",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "mariadb",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
+    "forgejo-with-runner-with-mysql": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M6LWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fREJfVFlQRT1teXNxbAogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19IT1NUPW15c3FsCiAgICAgIC0gJ0ZPUkdFSk9fX2RhdGFiYXNlX19OQU1FPSR7TVlTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19VU0VSPSRTRVJWSUNFX1VTRVJfTVlTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX01ZU1FMCiAgICAgIC0gVVNFUl9VSUQ9MTAwMAogICAgICAtIFVTRVJfR0lEPTEwMDAKICAgICAgLSAnUlVOTkVSX1NIQVJFRF9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9SVU5ORVJ9JwogICAgICAtIEZPUkdFSk9fX3NlY3VyaXR5X19JTlNUQUxMX0xPQ0s9dHJ1ZQogICAgICAtICdGT1JHRUpPX0FETUlOX1VTRVI9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdGT1JHRUpPX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fRU1BSUw9JHtGT1JHRUpPX0FETUlOX0VNQUlMOi1hZG1pbkBleGFtcGxlLmNvbX0nCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fRU5BQkxFX1BVU0hfQ1JFQVRFX1VTRVI9dHJ1ZQogICAgICAtIEZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUFVTSF9DUkVBVEVfUFJJVkFURT1mYWxzZQogICAgICAtICdGT1JHRUpPX19yZXBvc2l0b3J5X19ERUZBVUxUX1JFUE9fVU5JVFM9cmVwby5jb2RlLHJlcG8uYWN0aW9ucycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby10aW1lem9uZTovZXRjL3RpbWV6b25lOnJvJwogICAgICAtICdmb3JnZWpvLWxvY2FsdGltZTovZXRjL2xvY2FsdGltZTpybycKICAgIHBvcnRzOgogICAgICAtICcke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfToyMicKICAgIGRlcGVuZHNfb246CiAgICAgIG15c3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2N1cmwgLWZzIGh0dHA6Ly8xMjcuMC4wLjE6MzAwMCA+IC9kZXYvbnVsbCAmJiB0ZXN0IC1mIC90bXAvcnVubmVyLXJlZ2lzdGVyZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMzAKICAgIGNvbW1hbmQ6ICdiYXNoIC1jICcnIC91c3IvYmluL3M2LXN2c2NhbiAvZXRjL3M2ICYgdW50aWwgc3UgLWMgImZvcmdlam8gZm9yZ2Vqby1jbGkgYWN0aW9ucyByZWdpc3RlciAtLWtlZXAtbGFiZWxzIC0tc2VjcmV0ICQke1JVTk5FUl9TSEFSRURfU0VDUkVUOjA6NDB9IiBnaXQgOyBkbyBzbGVlcCA1IDsgZG9uZSA7IHN1IC1jICJmb3JnZWpvIGFkbWluIHVzZXIgY3JlYXRlIC0tYWRtaW4gLS11c2VybmFtZSBcIiQkRk9SR0VKT19BRE1JTl9VU0VSXCIgLS1wYXNzd29yZCBcIiQkRk9SR0VKT19BRE1JTl9QQVNTV09SRFwiIC0tZW1haWwgXCIkJEZPUkdFSk9fQURNSU5fRU1BSUxcIiAtLW11c3QtY2hhbmdlLXBhc3N3b3JkPWZhbHNlIiBnaXQgfHwgdHJ1ZSA7IHRvdWNoIC90bXAvcnVubmVyLXJlZ2lzdGVyZWQgOyB3YWl0ICcnJwogIG15c3FsOgogICAgaW1hZ2U6ICdteXNxbDo4JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIGRvY2tlci1pbi1kb2NrZXI6CiAgICBpbWFnZTogJ2RvY2tlcjpkaW5kJwogICAgaG9zdG5hbWU6IGRvY2tlcgogICAgcHJpdmlsZWdlZDogdHJ1ZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGRvY2tlcgogICAgICAgIC0gJy1IJwogICAgICAgIC0gJ3VuaXg6Ly8vdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgICAtIGluZm8KICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTAKICAgIGVudmlyb25tZW50OgogICAgICAtIERPQ0tFUl9UTFNfQ0VSVERJUj0vY2VydHMKICAgICAgLSBET0NLRVJfSE9TVD1kb2NrZXItaW4tZG9ja2VyCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRpZC1jZXJ0czovY2VydHMnCiAgcnVubmVyLXJlZ2lzdGVyOgogICAgaW1hZ2U6ICdkYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyOjEzLjIuMCcKICAgIHJlc3RhcnQ6ICdubycKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JVTk5FUl9TSEFSRURfU0VDUkVUPSR7U0VSVklDRV9IRVhfNjRfUlVOTkVSfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcnVubmVyLWRhdGE6L2RhdGEnCiAgICB1c2VyOiAnMDowJwogICAgY29tbWFuZDogJ2Jhc2ggLWVjICcnIHNlY3JldD0kJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSA7IHV1aWQ9JCQocHJpbnRmICVzICIkJHtzZWNyZXQ6MDoxNn0iIHwgb2QgLUFuIC10eDEgfCB0ciAtZCAiIFxuIiB8IHNlZCAtRSAicy8oLns4fSkoLns0fSkoLns0fSkoLns0fSkoLnsxMn0pL1wxLVwyLVwzLVw0LVw1LyIpIDsgZm9yZ2Vqby1ydW5uZXIgZ2VuZXJhdGUtY29uZmlnID4gY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIGxhYmVsczogXFtcXXwgIGxhYmVsczogW1wiZG9ja2VyOmRvY2tlcjovL25vZGU6MjItYm9va3dvcm1cIiwgXCJ1YnVudHUtbGF0ZXN0OmRvY2tlcjovL2NhdHRoZWhhY2tlci91YnVudHU6YWN0LTIyLjA0XCIsIFwidWJ1bnR1LTIyLjA0OmRvY2tlcjovL2NhdHRoZWhhY2tlci91YnVudHU6YWN0LTIyLjA0XCJdfCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xuZXR3b3JrOiAuKnxuZXR3b3JrOiBob3N0fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xeICBlbnZzOiQkfCAgZW52czpcbiAgICBET0NLRVJfSE9TVDogdGNwOi8vZG9ja2VyOjIzNzZcbiAgICBET0NLRVJfVExTX1ZFUklGWTogMVxuICAgIERPQ0tFUl9DRVJUX1BBVEg6IC9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfF4gIG9wdGlvbnM6fCAgb3B0aW9uczogLXYgL2NlcnRzL2NsaWVudDovY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIHZhbGlkX3ZvbHVtZXM6IFxbXF0kJHwgIHZhbGlkX3ZvbHVtZXM6XG4gICAgLSAvY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIGNvbm5lY3Rpb25zOnwgIGNvbm5lY3Rpb25zOlxuICAgIGRlZmF1bHQ6XG4gICAgICB1cmw6IGh0dHA6Ly9mb3JnZWpvOjMwMDBcbiAgICAgIHV1aWQ6ICQkdXVpZFxuICAgICAgdG9rZW46ICQkc2VjcmV0fCIgY29uZmlnLnltbCA7IGNob3duIC1SIDEwMDA6MTAwMCAvZGF0YSAnJycKICBydW5uZXI6CiAgICBpbWFnZTogJ2RhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXI6MTMuMi4wJwogICAgZGVwZW5kc19vbjoKICAgICAgZm9yZ2VqbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBkb2NrZXItaW4tZG9ja2VyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJ1bm5lci1yZWdpc3RlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RPQ0tFUl9IT1NUPXRjcDovL2RvY2tlcjoyMzc2JwogICAgICAtIERPQ0tFUl9DRVJUX1BBVEg9L2NlcnRzL2NsaWVudAogICAgICAtIERPQ0tFUl9UTFNfVkVSSUZZPTEKICAgIHVzZXI6ICcxMDAwOjEwMDAnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXJ1bm5lci1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLWRpZC1jZXJ0czovY2VydHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdyZXAKICAgICAgICAtIGZvcmdlam8tcnVubmVyCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBjb21tYW5kOiAnZm9yZ2Vqby1ydW5uZXIgLS1jb25maWcgY29uZmlnLnltbCBkYWVtb24nCg==",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "mysql",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
+    "forgejo-with-runner-with-postgresql": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M6LWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fREJfVFlQRT1wb3N0Z3JlcwogICAgICAtIEZPUkdFSk9fX2RhdGFiYXNlX19IT1NUPXBvc3RncmVzcWwKICAgICAgLSAnRk9SR0VKT19fZGF0YWJhc2VfX05BTUU9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mb3JnZWpvfScKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTUUwKICAgICAgLSBGT1JHRUpPX19kYXRhYmFzZV9fUEFTU1dEPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUwKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtICdSVU5ORVJfU0hBUkVEX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1JVTk5FUn0nCiAgICAgIC0gRk9SR0VKT19fc2VjdXJpdHlfX0lOU1RBTExfTE9DSz10cnVlCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fVVNFUj0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnRk9SR0VKT19BRE1JTl9FTUFJTD0ke0ZPUkdFSk9fQURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSBGT1JHRUpPX19yZXBvc2l0b3J5X19FTkFCTEVfUFVTSF9DUkVBVEVfVVNFUj10cnVlCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fREVGQVVMVF9QVVNIX0NSRUFURV9QUklWQVRFPWZhbHNlCiAgICAgIC0gJ0ZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUkVQT19VTklUUz1yZXBvLmNvZGUscmVwby5hY3Rpb25zJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXNxbDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mcyBodHRwOi8vMTI3LjAuMC4xOjMwMDAgPiAvZGV2L251bGwgJiYgdGVzdCAtZiAvdG1wL3J1bm5lci1yZWdpc3RlcmVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMwCiAgICBjb21tYW5kOiAnYmFzaCAtYyAnJyAvdXNyL2Jpbi9zNi1zdnNjYW4gL2V0Yy9zNiAmIHVudGlsIHN1IC1jICJmb3JnZWpvIGZvcmdlam8tY2xpIGFjdGlvbnMgcmVnaXN0ZXIgLS1rZWVwLWxhYmVscyAtLXNlY3JldCAkJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSIgZ2l0IDsgZG8gc2xlZXAgNSA7IGRvbmUgOyBzdSAtYyAiZm9yZ2VqbyBhZG1pbiB1c2VyIGNyZWF0ZSAtLWFkbWluIC0tdXNlcm5hbWUgXCIkJEZPUkdFSk9fQURNSU5fVVNFUlwiIC0tcGFzc3dvcmQgXCIkJEZPUkdFSk9fQURNSU5fUEFTU1dPUkRcIiAtLWVtYWlsIFwiJCRGT1JHRUpPX0FETUlOX0VNQUlMXCIgLS1tdXN0LWNoYW5nZS1wYXNzd29yZD1mYWxzZSIgZ2l0IHx8IHRydWUgOyB0b3VjaCAvdG1wL3J1bm5lci1yZWdpc3RlcmVkIDsgd2FpdCAnJycKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUx9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTUUxfREFUQUJBU0U6LWZvcmdlam99JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIGRvY2tlci1pbi1kb2NrZXI6CiAgICBpbWFnZTogJ2RvY2tlcjpkaW5kJwogICAgaG9zdG5hbWU6IGRvY2tlcgogICAgcHJpdmlsZWdlZDogdHJ1ZQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGRvY2tlcgogICAgICAgIC0gJy1IJwogICAgICAgIC0gJ3VuaXg6Ly8vdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgICAtIGluZm8KICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMTAKICAgIGVudmlyb25tZW50OgogICAgICAtIERPQ0tFUl9UTFNfQ0VSVERJUj0vY2VydHMKICAgICAgLSBET0NLRVJfSE9TVD1kb2NrZXItaW4tZG9ja2VyCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRpZC1jZXJ0czovY2VydHMnCiAgcnVubmVyLXJlZ2lzdGVyOgogICAgaW1hZ2U6ICdkYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyOjEzLjIuMCcKICAgIHJlc3RhcnQ6ICdubycKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JVTk5FUl9TSEFSRURfU0VDUkVUPSR7U0VSVklDRV9IRVhfNjRfUlVOTkVSfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcmdlam8tcnVubmVyLWRhdGE6L2RhdGEnCiAgICB1c2VyOiAnMDowJwogICAgY29tbWFuZDogJ2Jhc2ggLWVjICcnIHNlY3JldD0kJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSA7IHV1aWQ9JCQocHJpbnRmICVzICIkJHtzZWNyZXQ6MDoxNn0iIHwgb2QgLUFuIC10eDEgfCB0ciAtZCAiIFxuIiB8IHNlZCAtRSAicy8oLns4fSkoLns0fSkoLns0fSkoLns0fSkoLnsxMn0pL1wxLVwyLVwzLVw0LVw1LyIpIDsgZm9yZ2Vqby1ydW5uZXIgZ2VuZXJhdGUtY29uZmlnID4gY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIGxhYmVsczogXFtcXXwgIGxhYmVsczogW1wiZG9ja2VyOmRvY2tlcjovL25vZGU6MjItYm9va3dvcm1cIiwgXCJ1YnVudHUtbGF0ZXN0OmRvY2tlcjovL2NhdHRoZWhhY2tlci91YnVudHU6YWN0LTIyLjA0XCIsIFwidWJ1bnR1LTIyLjA0OmRvY2tlcjovL2NhdHRoZWhhY2tlci91YnVudHU6YWN0LTIyLjA0XCJdfCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xuZXR3b3JrOiAuKnxuZXR3b3JrOiBob3N0fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xeICBlbnZzOiQkfCAgZW52czpcbiAgICBET0NLRVJfSE9TVDogdGNwOi8vZG9ja2VyOjIzNzZcbiAgICBET0NLRVJfVExTX1ZFUklGWTogMVxuICAgIERPQ0tFUl9DRVJUX1BBVEg6IC9jZXJ0cy9jbGllbnR8IiBjb25maWcueW1sIDsgc2VkIC1pIC1lICJzfF4gIG9wdGlvbnM6fCAgb3B0aW9uczogLXYgL2NlcnRzL2NsaWVudDovY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIHZhbGlkX3ZvbHVtZXM6IFxbXF0kJHwgIHZhbGlkX3ZvbHVtZXM6XG4gICAgLSAvY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3wgIGNvbm5lY3Rpb25zOnwgIGNvbm5lY3Rpb25zOlxuICAgIGRlZmF1bHQ6XG4gICAgICB1cmw6IGh0dHA6Ly9mb3JnZWpvOjMwMDBcbiAgICAgIHV1aWQ6ICQkdXVpZFxuICAgICAgdG9rZW46ICQkc2VjcmV0fCIgY29uZmlnLnltbCA7IGNob3duIC1SIDEwMDA6MTAwMCAvZGF0YSAnJycKICBydW5uZXI6CiAgICBpbWFnZTogJ2RhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXI6MTMuMi4wJwogICAgZGVwZW5kc19vbjoKICAgICAgZm9yZ2VqbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBkb2NrZXItaW4tZG9ja2VyOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJ1bm5lci1yZWdpc3RlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RPQ0tFUl9IT1NUPXRjcDovL2RvY2tlcjoyMzc2JwogICAgICAtIERPQ0tFUl9DRVJUX1BBVEg9L2NlcnRzL2NsaWVudAogICAgICAtIERPQ0tFUl9UTFNfVkVSSUZZPTEKICAgIHVzZXI6ICcxMDAwOjEwMDAnCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXJ1bm5lci1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLWRpZC1jZXJ0czovY2VydHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdyZXAKICAgICAgICAtIGZvcmdlam8tcnVubmVyCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBjb21tYW5kOiAnZm9yZ2Vqby1ydW5uZXIgLS1jb25maWcgY29uZmlnLnltbCBkYWVtb24nCg==",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "postgresql",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
+    "forgejo-with-runner": {
+        "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
+        "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1M6LWZhbHNlfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ET01BSU49JHtTRVJWSUNFX0ZRRE5fRk9SR0VKT30nCiAgICAgIC0gJ0ZPUkdFSk9fX3NlcnZlcl9fU1NIX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfUE9SVD0ke0ZPUkdFSk9fU1NIX1BPUlQ6LTIyMjIyfScKICAgICAgLSBVU0VSX1VJRD0xMDAwCiAgICAgIC0gVVNFUl9HSUQ9MTAwMAogICAgICAtICdSVU5ORVJfU0hBUkVEX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1JVTk5FUn0nCiAgICAgIC0gRk9SR0VKT19fc2VjdXJpdHlfX0lOU1RBTExfTE9DSz10cnVlCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fVVNFUj0ke1NFUlZJQ0VfVVNFUl9BRE1JTn0nCiAgICAgIC0gJ0ZPUkdFSk9fQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnRk9SR0VKT19BRE1JTl9FTUFJTD0ke0ZPUkdFSk9fQURNSU5fRU1BSUw6LWFkbWluQGV4YW1wbGUuY29tfScKICAgICAgLSBGT1JHRUpPX19yZXBvc2l0b3J5X19FTkFCTEVfUFVTSF9DUkVBVEVfVVNFUj10cnVlCiAgICAgIC0gRk9SR0VKT19fcmVwb3NpdG9yeV9fREVGQVVMVF9QVVNIX0NSRUFURV9QUklWQVRFPWZhbHNlCiAgICAgIC0gJ0ZPUkdFSk9fX3JlcG9zaXRvcnlfX0RFRkFVTFRfUkVQT19VTklUUz1yZXBvLmNvZGUscmVwby5hY3Rpb25zJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kYXRhOi9kYXRhJwogICAgICAtICdmb3JnZWpvLXRpbWV6b25lOi9ldGMvdGltZXpvbmU6cm8nCiAgICAgIC0gJ2Zvcmdlam8tbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgcG9ydHM6CiAgICAgIC0gJyR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9OjIyJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdjdXJsIC1mcyBodHRwOi8vMTI3LjAuMC4xOjMwMDAgPiAvZGV2L251bGwgJiYgdGVzdCAtZiAvdG1wL3J1bm5lci1yZWdpc3RlcmVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMwCiAgICBjb21tYW5kOiAnYmFzaCAtYyAnJyAvdXNyL2Jpbi9zNi1zdnNjYW4gL2V0Yy9zNiAmIHVudGlsIHN1IC1jICJmb3JnZWpvIGZvcmdlam8tY2xpIGFjdGlvbnMgcmVnaXN0ZXIgLS1rZWVwLWxhYmVscyAtLXNlY3JldCAkJHtSVU5ORVJfU0hBUkVEX1NFQ1JFVDowOjQwfSIgZ2l0IDsgZG8gc2xlZXAgNSA7IGRvbmUgOyBzdSAtYyAiZm9yZ2VqbyBhZG1pbiB1c2VyIGNyZWF0ZSAtLWFkbWluIC0tdXNlcm5hbWUgXCIkJEZPUkdFSk9fQURNSU5fVVNFUlwiIC0tcGFzc3dvcmQgXCIkJEZPUkdFSk9fQURNSU5fUEFTU1dPUkRcIiAtLWVtYWlsIFwiJCRGT1JHRUpPX0FETUlOX0VNQUlMXCIgLS1tdXN0LWNoYW5nZS1wYXNzd29yZD1mYWxzZSIgZ2l0IHx8IHRydWUgOyB0b3VjaCAvdG1wL3J1bm5lci1yZWdpc3RlcmVkIDsgd2FpdCAnJycKICBkb2NrZXItaW4tZG9ja2VyOgogICAgaW1hZ2U6ICdkb2NrZXI6ZGluZCcKICAgIGhvc3RuYW1lOiBkb2NrZXIKICAgIHByaXZpbGVnZWQ6IHRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBkb2NrZXIKICAgICAgICAtICctSCcKICAgICAgICAtICd1bml4Oi8vL3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICAgICAgLSBpbmZvCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBET0NLRVJfVExTX0NFUlRESVI9L2NlcnRzCiAgICAgIC0gRE9DS0VSX0hPU1Q9ZG9ja2VyLWluLWRvY2tlcgogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1kaWQtY2VydHM6L2NlcnRzJwogIHJ1bm5lci1yZWdpc3RlcjoKICAgIGltYWdlOiAnZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL3J1bm5lcjoxMy4yLjAnCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGVudmlyb25tZW50OgogICAgICAtICdSVU5ORVJfU0hBUkVEX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1JVTk5FUn0nCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLXJ1bm5lci1kYXRhOi9kYXRhJwogICAgdXNlcjogJzA6MCcKICAgIGNvbW1hbmQ6ICdiYXNoIC1lYyAnJyBzZWNyZXQ9JCR7UlVOTkVSX1NIQVJFRF9TRUNSRVQ6MDo0MH0gOyB1dWlkPSQkKHByaW50ZiAlcyAiJCR7c2VjcmV0OjA6MTZ9IiB8IG9kIC1BbiAtdHgxIHwgdHIgLWQgIiBcbiIgfCBzZWQgLUUgInMvKC57OH0pKC57NH0pKC57NH0pKC57NH0pKC57MTJ9KS9cMS1cMi1cMy1cNC1cNS8iKSA7IGZvcmdlam8tcnVubmVyIGdlbmVyYXRlLWNvbmZpZyA+IGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICBsYWJlbHM6IFxbXF18ICBsYWJlbHM6IFtcImRvY2tlcjpkb2NrZXI6Ly9ub2RlOjIyLWJvb2t3b3JtXCIsIFwidWJ1bnR1LWxhdGVzdDpkb2NrZXI6Ly9jYXR0aGVoYWNrZXIvdWJ1bnR1OmFjdC0yMi4wNFwiLCBcInVidW50dS0yMi4wNDpkb2NrZXI6Ly9jYXR0aGVoYWNrZXIvdWJ1bnR1OmFjdC0yMi4wNFwiXXwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8bmV0d29yazogLip8bmV0d29yazogaG9zdHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8XiAgZW52czokJHwgIGVudnM6XG4gICAgRE9DS0VSX0hPU1Q6IHRjcDovL2RvY2tlcjoyMzc2XG4gICAgRE9DS0VSX1RMU19WRVJJRlk6IDFcbiAgICBET0NLRVJfQ0VSVF9QQVRIOiAvY2VydHMvY2xpZW50fCIgY29uZmlnLnltbCA7IHNlZCAtaSAtZSAic3xeICBvcHRpb25zOnwgIG9wdGlvbnM6IC12IC9jZXJ0cy9jbGllbnQ6L2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICB2YWxpZF92b2x1bWVzOiBcW1xdJCR8ICB2YWxpZF92b2x1bWVzOlxuICAgIC0gL2NlcnRzL2NsaWVudHwiIGNvbmZpZy55bWwgOyBzZWQgLWkgLWUgInN8ICBjb25uZWN0aW9uczp8ICBjb25uZWN0aW9uczpcbiAgICBkZWZhdWx0OlxuICAgICAgdXJsOiBodHRwOi8vZm9yZ2VqbzozMDAwXG4gICAgICB1dWlkOiAkJHV1aWRcbiAgICAgIHRva2VuOiAkJHNlY3JldHwiIGNvbmZpZy55bWwgOyBjaG93biAtUiAxMDAwOjEwMDAgL2RhdGEgJycnCiAgcnVubmVyOgogICAgaW1hZ2U6ICdkYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyOjEzLjIuMCcKICAgIGRlcGVuZHNfb246CiAgICAgIGZvcmdlam86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgZG9ja2VyLWluLWRvY2tlcjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBydW5uZXItcmVnaXN0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdET0NLRVJfSE9TVD10Y3A6Ly9kb2NrZXI6MjM3NicKICAgICAgLSBET0NLRVJfQ0VSVF9QQVRIPS9jZXJ0cy9jbGllbnQKICAgICAgLSBET0NLRVJfVExTX1ZFUklGWT0xCiAgICB1c2VyOiAnMTAwMDoxMDAwJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9yZ2Vqby1ydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnZm9yZ2Vqby1kaWQtY2VydHM6L2NlcnRzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBncmVwCiAgICAgICAgLSBmb3JnZWpvLXJ1bm5lcgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgY29tbWFuZDogJ2Zvcmdlam8tcnVubmVyIC0tY29uZmlnIGNvbmZpZy55bWwgZGFlbW9uJwo=",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "hosting",
+            "lightweight",
+            "runner",
+            "actions",
+            "cicd",
+            "ci"
+        ],
+        "category": "git",
+        "logo": "svgs/forgejo.svg",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-08-10T11:35:20+02:00",
+        "port": "3000"
+    },
     "forgejo": {
         "documentation": "https://forgejo.org/docs?utm_source=coolify.io",
         "slogan": "Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.",
-        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICBwb3J0czoKICAgICAgLSAnMjIyMjI6MjInCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
+        "compose": "c2VydmljZXM6CiAgZm9yZ2VqbzoKICAgIGltYWdlOiAnY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2VqbzoxNScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GT1JHRUpPXzMwMDAKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19ST09UX1VSTD0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TPSR7Rk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dFRF9ET01BSU5TfScKICAgICAgLSAnRk9SR0VKT19fbWlncmF0aW9uc19fQUxMT1dfTE9DQUxORVRXT1JLUz0ke0ZPUkdFSk9fX21pZ3JhdGlvbnNfX0FMTE9XX0xPQ0FMTkVUV09SS1MtZmFsc2V9JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX0RPTUFJTj0ke1NFUlZJQ0VfRlFETl9GT1JHRUpPfScKICAgICAgLSAnRk9SR0VKT19fc2VydmVyX19TU0hfRE9NQUlOPSR7U0VSVklDRV9GUUROX0ZPUkdFSk99JwogICAgICAtICdGT1JHRUpPX19zZXJ2ZXJfX1NTSF9QT1JUPSR7Rk9SR0VKT19TU0hfUE9SVDotMjIyMjJ9JwogICAgICAtIFVTRVJfVUlEPTEwMDAKICAgICAgLSBVU0VSX0dJRD0xMDAwCiAgICBwb3J0czoKICAgICAgLSAnJHtGT1JHRUpPX1NTSF9QT1JUOi0yMjIyMn06MjInCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JnZWpvLWRhdGE6L2RhdGEnCiAgICAgIC0gJ2Zvcmdlam8tdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZm9yZ2Vqby1sb2NhbHRpbWU6L2V0Yy9sb2NhbHRpbWU6cm8nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "version control",
             "collaboration",
@@ -1755,7 +1842,7 @@
     "formbricks": {
         "documentation": "https://formbricks.com/docs/self-hosting/setup/docker?utm_source=coolify.io",
         "slogan": "Open Source Survey Platform",
-        "compose": "c2VydmljZXM6CiAgZm9ybWJyaWNrczoKICAgIGltYWdlOiAnZ2hjci5pby9mb3JtYnJpY2tzL2Zvcm1icmlja3M6NC41LjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fRk9STUJSSUNLU18zMDAwCiAgICAgIC0gV0VCQVBQX1VSTD0kU0VSVklDRV9GUUROX0ZPUk1CUklDS1MKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUxAcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNRTF9EQVRBQkFTRTotZm9ybWJyaWNrc30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSBORVhUQVVUSF9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0X05FWFRBVVRICiAgICAgIC0gTkVYVEFVVEhfVVJMPSRTRVJWSUNFX0ZRRE5fRk9STUJSSUNLUwogICAgICAtIEVOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OCiAgICAgIC0gQ1JPTl9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0X0NST04KICAgICAgLSAnRU5URVJQUklTRV9MSUNFTlNFX0tFWT0ke0VOVEVSUFJJU0VfTElDRU5TRV9LRVl9JwogICAgICAtICdNQUlMX0ZST009JHtNQUlMX0ZST006LXRlc3RAZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1Q6LXRlc3QuZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ1NNVFBfVVNFUj0ke1NNVFBfVVNFUjotdGVzdH0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEOi10ZXN0fScKICAgICAgLSAnU01UUF9TRUNVUkVfRU5BQkxFRD0ke1NNVFBfU0VDVVJFX0VOQUJMRUQ6LTB9JwogICAgICAtICdTTVRQX1JFSkVDVF9VTkFVVEhPUklaRURfVExTPSR7U01UUF9SRUpFQ1RfVU5BVVRIT1JJWkVEX1RMUzotMX0nCiAgICAgIC0gJ1NIT1JUX1VSTF9CQVNFPSR7U0hPUlRfVVJMX0JBU0V9JwogICAgICAtICdFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ9JHtFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ6LTF9JwogICAgICAtICdQQVNTV09SRF9SRVNFVF9ESVNBQkxFRD0ke1BBU1NXT1JEX1JFU0VUX0RJU0FCTEVEOi0xfScKICAgICAgLSAnRU1BSUxfQVVUSF9ESVNBQkxFRD0ke0VNQUlMX0FVVEhfRElTQUJMRUQ6LTB9JwogICAgICAtICdJTlZJVEVfRElTQUJMRUQ9JHtJTlZJVEVfRElTQUJMRUQ6LTB9JwogICAgICAtICdBU1NFVF9QUkVGSVhfVVJMPSR7QVNTRVRfUFJFRklYX1VSTH0nCiAgICAgIC0gJ1VOU1BMQVNIX0FDQ0VTU19LRVk9JHtVTlNQTEFTSF9BQ0NFU1NfS0VZfScKICAgICAgLSAnR0lUSFVCX0lEPSR7R0lUSFVCX0lEfScKICAgICAgLSAnR0lUSFVCX1NFQ1JFVD0ke0dJVEhVQl9TRUNSRVR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX0lEPSR7R09PR0xFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfU0VDUkVUPSR7R09PR0xFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRUFEX0NMSUVOVF9JRD0ke0FaVVJFQURfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVBRF9DTElFTlRfU0VDUkVUPSR7QVpVUkVBRF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVBRF9URU5BTlRfSUQ9JHtBWlVSRUFEX1RFTkFOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX0lEPSR7T0lEQ19DTElFTlRfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9TRUNSRVQ9JHtPSURDX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdPSURDX0lTU1VFUj0ke09JRENfSVNTVUVSfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0lHTklOR19BTEdPUklUSE09JHtPSURDX1NJR05JTkdfQUxHT1JJVEhNfScKICAgICAgLSAnTk9USU9OX09BVVRIX0NMSUVOVF9JRD0ke05PVElPTl9PQVVUSF9DTElFTlRfSUR9JwogICAgICAtICdOT1RJT05fT0FVVEhfQ0xJRU5UX1NFQ1JFVD0ke05PVElPTl9PQVVUSF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX1NIRUVUU19DTElFTlRfSUQ9JHtHT09HTEVfU0hFRVRTX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfUkVESVJFQ1RfVVJMPSR7R09PR0xFX1NIRUVUU19SRURJUkVDVF9VUkx9JwogICAgICAtICdBSVJUQUJMRV9DTElFTlRfSUQ9JHtBSVJUQUJMRV9DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ1BSSVZBQ1lfVVJMPSR7UFJJVkFDWV9VUkx9JwogICAgICAtICdURVJNU19VUkw9JHtURVJNU19VUkx9JwogICAgICAtICdJTVBSSU5UX1VSTD0ke0lNUFJJTlRfVVJMfScKICAgICAgLSAnUkFURV9MSU1JVElOR19ESVNBQkxFRD0ke1JBVEVfTElNSVRJTkdfRElTQUJMRUQ6LTB9JwogICAgICAtICdPUEVOVEVMRU1FVFJZX0xJU1RFTkVSX1VSTD0ke09QRU5URUxFTUVUUllfTElTVEVORVJfVVJMfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vdmFsa2V5OjYzNzknCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX0lEPSR7REVGQVVMVF9PUkdBTklaQVRJT05fSUR9JwogICAgICAtICdERUZBVUxUX09SR0FOSVpBVElPTl9ST0xFPSR7REVGQVVMVF9PUkdBTklaQVRJT05fUk9MRTotb3duZXJ9JwogICAgICAtIFMzX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtICdTM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gUzNfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFMzX0JVQ0tFVF9OQU1FPWZvcm1icmlja3MKICAgICAgLSBTM19FTkRQT0lOVF9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBTM19GT1JDRV9QQVRIX1NUWUxFPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcm1icmlja3MtdXBsb2FkczovYXBwcy93ZWIvdXBsb2Fkcy8nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHZhbGtleToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwZ3ZlY3Rvci9wZ3ZlY3RvcjpwZzE2JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mb3JtYnJpY2tzfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2YWxrZXk6CiAgICBpbWFnZTogJ3ZhbGtleS92YWxrZXk6OC1hbHBpbmUnCiAgICBjb21tYW5kOiAndmFsa2V5LXNlcnZlciAtLWFwcGVuZG9ubHkgeWVzJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy12YWxrZXk6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3ZhbGtleS1jbGkgcGluZyB8IGdyZXAgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAzcwogIG1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1NFUlZFUl9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTD0kTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkwKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcm1icmlja3MtbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtaW5pby1pbml0OgogICAgaW1hZ2U6ICdtaW5pby9tYzpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDogInNoIC1jIFwiXG4gIG1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCAke1NFUlZJQ0VfVVNFUl9NSU5JT30gJHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfSAmJlxuICBtYyBtYiAtcCBsb2NhbC9mb3JtYnJpY2tzIHx8IHRydWUgJiZcbiAgbWMgYW5vbnltb3VzIHNldCBwcml2YXRlIGxvY2FsL2Zvcm1icmlja3NcblwiXG4iCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUK",
+        "compose": "c2VydmljZXM6CiAgZm9ybWJyaWNrczoKICAgIGltYWdlOiAnZ2hjci5pby9mb3JtYnJpY2tzL2Zvcm1icmlja3M6NC41LjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fRk9STUJSSUNLU18zMDAwCiAgICAgIC0gV0VCQVBQX1VSTD0kU0VSVklDRV9GUUROX0ZPUk1CUklDS1MKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFU1FMOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTUUxAcG9zdGdyZXNxbDo1NDMyLyR7UE9TVEdSRVNRTF9EQVRBQkFTRTotZm9ybWJyaWNrc30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSBORVhUQVVUSF9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0X05FWFRBVVRICiAgICAgIC0gTkVYVEFVVEhfVVJMPSRTRVJWSUNFX0ZRRE5fRk9STUJSSUNLUwogICAgICAtIEVOQ1JZUFRJT05fS0VZPSRTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OCiAgICAgIC0gQ1JPTl9TRUNSRVQ9JFNFUlZJQ0VfQkFTRTY0X0NST04KICAgICAgLSAnRU5URVJQUklTRV9MSUNFTlNFX0tFWT0ke0VOVEVSUFJJU0VfTElDRU5TRV9LRVl9JwogICAgICAtICdNQUlMX0ZST009JHtNQUlMX0ZST006LXRlc3RAZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1Q6LXRlc3QuZXhhbXBsZS5jb219JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ1NNVFBfVVNFUj0ke1NNVFBfVVNFUjotdGVzdH0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEOi10ZXN0fScKICAgICAgLSAnU01UUF9TRUNVUkVfRU5BQkxFRD0ke1NNVFBfU0VDVVJFX0VOQUJMRUQ6LTB9JwogICAgICAtICdTTVRQX1JFSkVDVF9VTkFVVEhPUklaRURfVExTPSR7U01UUF9SRUpFQ1RfVU5BVVRIT1JJWkVEX1RMUzotMX0nCiAgICAgIC0gJ1NIT1JUX1VSTF9CQVNFPSR7U0hPUlRfVVJMX0JBU0V9JwogICAgICAtICdFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ9JHtFTUFJTF9WRVJJRklDQVRJT05fRElTQUJMRUQ6LTF9JwogICAgICAtICdQQVNTV09SRF9SRVNFVF9ESVNBQkxFRD0ke1BBU1NXT1JEX1JFU0VUX0RJU0FCTEVEOi0xfScKICAgICAgLSAnRU1BSUxfQVVUSF9ESVNBQkxFRD0ke0VNQUlMX0FVVEhfRElTQUJMRUQ6LTB9JwogICAgICAtICdJTlZJVEVfRElTQUJMRUQ9JHtJTlZJVEVfRElTQUJMRUQ6LTB9JwogICAgICAtICdBU1NFVF9QUkVGSVhfVVJMPSR7QVNTRVRfUFJFRklYX1VSTH0nCiAgICAgIC0gJ1VOU1BMQVNIX0FDQ0VTU19LRVk9JHtVTlNQTEFTSF9BQ0NFU1NfS0VZfScKICAgICAgLSAnR0lUSFVCX0lEPSR7R0lUSFVCX0lEfScKICAgICAgLSAnR0lUSFVCX1NFQ1JFVD0ke0dJVEhVQl9TRUNSRVR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX0lEPSR7R09PR0xFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfU0VDUkVUPSR7R09PR0xFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRUFEX0NMSUVOVF9JRD0ke0FaVVJFQURfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVBRF9DTElFTlRfU0VDUkVUPSR7QVpVUkVBRF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVBRF9URU5BTlRfSUQ9JHtBWlVSRUFEX1RFTkFOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX0lEPSR7T0lEQ19DTElFTlRfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9TRUNSRVQ9JHtPSURDX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdPSURDX0lTU1VFUj0ke09JRENfSVNTVUVSfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0lHTklOR19BTEdPUklUSE09JHtPSURDX1NJR05JTkdfQUxHT1JJVEhNfScKICAgICAgLSAnTk9USU9OX09BVVRIX0NMSUVOVF9JRD0ke05PVElPTl9PQVVUSF9DTElFTlRfSUR9JwogICAgICAtICdOT1RJT05fT0FVVEhfQ0xJRU5UX1NFQ1JFVD0ke05PVElPTl9PQVVUSF9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX1NIRUVUU19DTElFTlRfSUQ9JHtHT09HTEVfU0hFRVRTX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9TSEVFVFNfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9TSEVFVFNfUkVESVJFQ1RfVVJMPSR7R09PR0xFX1NIRUVUU19SRURJUkVDVF9VUkx9JwogICAgICAtICdBSVJUQUJMRV9DTElFTlRfSUQ9JHtBSVJUQUJMRV9DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ1BSSVZBQ1lfVVJMPSR7UFJJVkFDWV9VUkx9JwogICAgICAtICdURVJNU19VUkw9JHtURVJNU19VUkx9JwogICAgICAtICdJTVBSSU5UX1VSTD0ke0lNUFJJTlRfVVJMfScKICAgICAgLSAnUkFURV9MSU1JVElOR19ESVNBQkxFRD0ke1JBVEVfTElNSVRJTkdfRElTQUJMRUQ6LTB9JwogICAgICAtICdPUEVOVEVMRU1FVFJZX0xJU1RFTkVSX1VSTD0ke09QRU5URUxFTUVUUllfTElTVEVORVJfVVJMfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vdmFsa2V5OjYzNzknCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX0lEPSR7REVGQVVMVF9PUkdBTklaQVRJT05fSUR9JwogICAgICAtICdERUZBVUxUX09SR0FOSVpBVElPTl9ST0xFPSR7REVGQVVMVF9PUkdBTklaQVRJT05fUk9MRTotb3duZXJ9JwogICAgICAtIFMzX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtICdTM19TRUNSRVRfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gUzNfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFMzX0JVQ0tFVF9OQU1FPWZvcm1icmlja3MKICAgICAgLSBTM19FTkRQT0lOVF9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBTM19GT1JDRV9QQVRIX1NUWUxFPTEKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Zvcm1icmlja3MtdXBsb2FkczovYXBwcy93ZWIvdXBsb2Fkcy8nCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3Jlc3FsOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHZhbGtleToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwb3N0Z3Jlc3FsOgogICAgaW1hZ2U6ICdwZ3ZlY3Rvci9wZ3ZlY3RvcjpwZzE2JwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVNRTH0nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU1FMfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU1FMX0RBVEFCQVNFOi1mb3JtYnJpY2tzfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2YWxrZXk6CiAgICBpbWFnZTogJ3ZhbGtleS92YWxrZXk6OC1hbHBpbmUnCiAgICBjb21tYW5kOiAndmFsa2V5LXNlcnZlciAtLWFwcGVuZG9ubHkgeWVzJwogICAgdm9sdW1lczoKICAgICAgLSAnZm9ybWJyaWNrcy12YWxrZXk6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3ZhbGtleS1jbGkgcGluZyB8IGdyZXAgUE9ORycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiAzcwogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNSU5JT19TRVJWRVJfVVJMPSRNSU5JT19TRVJWRVJfVVJMCiAgICAgIC0gTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkw9JE1JTklPX0JST1dTRVJfUkVESVJFQ1RfVVJMCiAgICAgIC0gTUlOSU9fUk9PVF9VU0VSPSRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgLSBNSU5JT19ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICB2b2x1bWVzOgogICAgICAtICdmb3JtYnJpY2tzLW1pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6ICJzaCAtYyBcIlxuICBtYyBhbGlhcyBzZXQgbG9jYWwgaHR0cDovL21pbmlvOjkwMDAgJHtTRVJWSUNFX1VTRVJfTUlOSU99ICR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30gJiZcbiAgbWMgbWIgLXAgbG9jYWwvZm9ybWJyaWNrcyB8fCB0cnVlICYmXG4gIG1jIGFub255bW91cyBzZXQgcHJpdmF0ZSBsb2NhbC9mb3JtYnJpY2tzXG5cIlxuIgogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCg==",
         "tags": [
             "form",
             "builder",
@@ -2260,7 +2347,7 @@
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
         "slogan": "Hatchet allows you to run background tasks at scale with a high-throughput, low-latency computing service built on an open-source, fault-tolerant queue.",
-        "compose": "c2VydmljZXM6CiAgaGF0Y2hldC1kYXNoYm9hcmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LWRhc2hib2FyZDpsYXRlc3QnCiAgICBjb21tYW5kOiAnc2ggLi9lbnRyeXBvaW50LnNoIC0tY29uZmlnIC9oYXRjaGV0L2NvbmZpZycKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJFBPU1RHUkVTX0RCJwogICAgICAtIFNFUlZJQ0VfRlFETl9IQVRDSEVUXzgwCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByYWJiaXRtcToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzZXR1cC1jb25maWc6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgbWlncmF0aW9uOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICB2b2x1bWVzOgogICAgICAtICdoYXRjaGV0LWNlcnRzOi9oYXRjaGV0L2NlcnRzJwogICAgICAtICdoYXRjaGV0LWNvbmZpZzovaGF0Y2hldC9jb25maWcnCiAgaGF0Y2hldC1lbmdpbmU6CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LWVuZ2luZTpsYXRlc3QnCiAgICBjb21tYW5kOiAnL2hhdGNoZXQvaGF0Y2hldC1lbmdpbmUgLS1jb25maWcgL2hhdGNoZXQvY29uZmlnJwogICAgcmVzdGFydDogb24tZmFpbHVyZQogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcmFiYml0bXE6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc2V0dXAtY29uZmlnOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICAgIG1pZ3JhdGlvbjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8kUE9TVEdSRVNfREInCiAgICAgIC0gJ1NFUlZFUl9HUlBDX0JJTkRfQUREUkVTUz0ke1NFUlZFUl9HUlBDX0JJTkRfQUREUkVTUzotMC4wLjAuMH0nCiAgICAgIC0gJ1NFUlZFUl9HUlBDX0lOU0VDVVJFPSR7U0VSVkVSX0dSUENfSU5TRUNVUkU6LXR9JwogICAgdm9sdW1lczoKICAgICAgLSAnaGF0Y2hldC1jZXJ0czovaGF0Y2hldC9jZXJ0cycKICAgICAgLSAnaGF0Y2hldC1jb25maWc6L2hhdGNoZXQvY29uZmlnJwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdwb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmFiYml0bXE6CiAgICBpbWFnZTogJ3JhYmJpdG1xOjMtbWFuYWdlbWVudCcKICAgIGhvc3RuYW1lOiByYWJiaXRtcQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1JBQkJJVE1RXzE1NjcyCiAgICAgIC0gUkFCQklUTVFfREVGQVVMVF9VU0VSPSRTRVJWSUNFX1VTRVJfUkFCQklUTVEKICAgICAgLSBSQUJCSVRNUV9ERUZBVUxUX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVEKICAgICAgLSAnUE9SVD0ke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBwaW5nJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDEwCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcS1kYXRhOi92YXIvbGliL3JhYmJpdG1xLycKICBtaWdyYXRpb246CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LW1pZ3JhdGU6bGF0ZXN0JwogICAgY29tbWFuZDogL2hhdGNoZXQvaGF0Y2hldC1taWdyYXRlCiAgICByZXN0YXJ0OiAnbm8nCiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJFBPU1RHUkVTX0RCJwogICAgZGVwZW5kc19vbjoKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBzZXR1cC1jb25maWc6CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LWFkbWluOmxhdGVzdCcKICAgIGNvbW1hbmQ6ICcvaGF0Y2hldC9oYXRjaGV0LWFkbWluIHF1aWNrc3RhcnQgLS1za2lwIGNlcnRzIC0tZ2VuZXJhdGVkLWNvbmZpZy1kaXIgL2hhdGNoZXQvY29uZmlnIC0tb3ZlcndyaXRlPWZhbHNlJwogICAgcmVzdGFydDogJ25vJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8kUE9TVEdSRVNfREInCiAgICAgIC0gJ1NFUlZFUl9UQVNLUVVFVUVfUkFCQklUTVFfVVJMPWFtcXA6Ly8kU0VSVklDRV9VU0VSX1JBQkJJVE1ROiRTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RQHJhYmJpdG1xOjU2NzIvJwogICAgICAtICdTRVJWRVJfQVVUSF9DT09LSUVfRE9NQUlOPSR7U0VSVkVSX0FVVEhfQ09PS0lFX0RPTUFJTjotbG9jYWxob3N0OjgwODB9JwogICAgICAtICdTRVJWRVJfQVVUSF9DT09LSUVfSU5TRUNVUkU9JHtTRVJWRVJfQVVUSF9DT09LSUVfSU5TRUNVUkU6LXR9JwogICAgICAtICdTRVJWRVJfR1JQQ19CSU5EX0FERFJFU1M9JHtTRVJWRVJfR1JQQ19CSU5EX0FERFJFU1M6LTAuMC4wLjB9JwogICAgICAtICdTRVJWRVJfR1JQQ19JTlNFQ1VSRT0ke1NFUlZFUl9HUlBDX0lOU0VDVVJFOi10fScKICAgICAgLSAnU0VSVkVSX0dSUENfQlJPQURDQVNUX0FERFJFU1M9JHtTRVJWRVJfR1JQQ19CUk9BRENBU1RfQUREUkVTUzotbG9jYWxob3N0OjcwNzd9JwogICAgICAtIFNFUlZFUl9ERUZBVUxUX0VOR0lORV9WRVJTSU9OPVYxCiAgICAgIC0gJ1NFUlZFUl9JTlRFUk5BTF9DTElFTlRfSU5URVJOQUxfR1JQQ19CUk9BRENBU1RfQUREUkVTUz0ke1NFUlZFUl9JTlRFUk5BTF9DTElFTlRfSU5URVJOQUxfR1JQQ19CUk9BRENBU1RfQUREUkVTUzotaGF0Y2hldC1lbmdpbmU6NzA3N30nCiAgICB2b2x1bWVzOgogICAgICAtICdoYXRjaGV0X2NlcnRzOi9oYXRjaGV0L2NlcnRzJwogICAgICAtICdoYXRjaGV0X2NvbmZpZzovaGF0Y2hldC9jb25maWcnCiAgICBkZXBlbmRzX29uOgogICAgICBtaWdyYXRpb246CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgcmFiYml0bXE6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkK",
+        "compose": "c2VydmljZXM6CiAgaGF0Y2hldC1kYXNoYm9hcmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vaGF0Y2hldC1kZXYvaGF0Y2hldC9oYXRjaGV0LWRhc2hib2FyZDpsYXRlc3QnCiAgICBjb21tYW5kOiAnc2ggLi9lbnRyeXBvaW50LnNoIC0tY29uZmlnIC9oYXRjaGV0L2NvbmZpZycKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICAgIC0gU0VSVklDRV9GUUROX0hBVENIRVRfODAKICAgICAgLSAnU0VSVkVSX0FVVEhfU0VUX0VNQUlMX1ZFUklGSUVEPSR7U0VSVkVSX0FVVEhfU0VUX0VNQUlMX1ZFUklGSUVEOi10cnVlfScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJhYmJpdG1xOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHNldHVwLWNvbmZpZzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfY29tcGxldGVkX3N1Y2Nlc3NmdWxseQogICAgICBtaWdyYXRpb246CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hhdGNoZXQtY2VydHM6L2hhdGNoZXQvY2VydHMnCiAgICAgIC0gJ2hhdGNoZXQtY29uZmlnOi9oYXRjaGV0L2NvbmZpZycKICBoYXRjaGV0LWVuZ2luZToKICAgIGltYWdlOiAnZ2hjci5pby9oYXRjaGV0LWRldi9oYXRjaGV0L2hhdGNoZXQtZW5naW5lOmxhdGVzdCcKICAgIGNvbW1hbmQ6ICcvaGF0Y2hldC9oYXRjaGV0LWVuZ2luZSAtLWNvbmZpZyAvaGF0Y2hldC9jb25maWcnCiAgICByZXN0YXJ0OiBvbi1mYWlsdXJlCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByYWJiaXRtcToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzZXR1cC1jb25maWc6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgbWlncmF0aW9uOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9jb21wbGV0ZWRfc3VjY2Vzc2Z1bGx5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0Bwb3N0Z3Jlczo1NDMyLyR7UE9TVEdSRVNfREI6LWhhdGNoZXR9JwogICAgICAtICdTRVJWRVJfR1JQQ19CSU5EX0FERFJFU1M9JHtTRVJWRVJfR1JQQ19CSU5EX0FERFJFU1M6LTAuMC4wLjB9JwogICAgICAtICdTRVJWRVJfR1JQQ19JTlNFQ1VSRT0ke1NFUlZFUl9HUlBDX0lOU0VDVVJFOi10fScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hhdGNoZXQtY2VydHM6L2hhdGNoZXQvY2VydHMnCiAgICAgIC0gJ2hhdGNoZXQtY29uZmlnOi9oYXRjaGV0L2NvbmZpZycKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFBPU1RHUkVTX1VTRVI9JFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICAtIFBPU1RHUkVTX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LWhhdGNoZXR9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJhYmJpdG1xOgogICAgaW1hZ2U6ICdyYWJiaXRtcTozLW1hbmFnZW1lbnQnCiAgICBob3N0bmFtZTogcmFiYml0bXEKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9SQUJCSVRNUV8xNTY3MgogICAgICAtIFJBQkJJVE1RX0RFRkFVTFRfVVNFUj0kU0VSVklDRV9VU0VSX1JBQkJJVE1RCiAgICAgIC0gUkFCQklUTVFfREVGQVVMVF9QQVNTPSRTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RCiAgICAgIC0gJ1BPUlQ9JHtSQUJCSVRNUV9QT1JUOi01NjcyfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncmFiYml0bXEtZGlhZ25vc3RpY3MgLXEgY2hlY2tfcG9ydF9jb25uZWN0aXZpdHknCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMjAKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JhYmJpdG1xLWRhdGE6L3Zhci9saWIvcmFiYml0bXEvJwogIG1pZ3JhdGlvbjoKICAgIGltYWdlOiAnZ2hjci5pby9oYXRjaGV0LWRldi9oYXRjaGV0L2hhdGNoZXQtbWlncmF0ZTpsYXRlc3QnCiAgICBjb21tYW5kOiAvaGF0Y2hldC9oYXRjaGV0LW1pZ3JhdGUKICAgIHJlc3RhcnQ6ICdubycKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1oYXRjaGV0fScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgc2V0dXAtY29uZmlnOgogICAgaW1hZ2U6ICdnaGNyLmlvL2hhdGNoZXQtZGV2L2hhdGNoZXQvaGF0Y2hldC1hZG1pbjpsYXRlc3QnCiAgICBjb21tYW5kOiAnL2hhdGNoZXQvaGF0Y2hldC1hZG1pbiBxdWlja3N0YXJ0IC0tc2tpcCBjZXJ0cyAtLWdlbmVyYXRlZC1jb25maWctZGlyIC9oYXRjaGV0L2NvbmZpZyAtLW92ZXJ3cml0ZT1mYWxzZScKICAgIHJlc3RhcnQ6ICdubycKICAgIGVudmlyb25tZW50OgogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXM6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQjotaGF0Y2hldH0nCiAgICAgIC0gJ1NFUlZFUl9UQVNLUVVFVUVfUkFCQklUTVFfVVJMPWFtcXA6Ly8kU0VSVklDRV9VU0VSX1JBQkJJVE1ROiRTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RQHJhYmJpdG1xOjU2NzIvJwogICAgICAtICdTRVJWRVJfQVVUSF9DT09LSUVfRE9NQUlOPSR7U0VSVkVSX0FVVEhfQ09PS0lFX0RPTUFJTjotbG9jYWxob3N0OjgwODB9JwogICAgICAtICdTRVJWRVJfQVVUSF9DT09LSUVfSU5TRUNVUkU9JHtTRVJWRVJfQVVUSF9DT09LSUVfSU5TRUNVUkU6LXR9JwogICAgICAtICdTRVJWRVJfR1JQQ19CSU5EX0FERFJFU1M9JHtTRVJWRVJfR1JQQ19CSU5EX0FERFJFU1M6LTAuMC4wLjB9JwogICAgICAtICdTRVJWRVJfR1JQQ19JTlNFQ1VSRT0ke1NFUlZFUl9HUlBDX0lOU0VDVVJFOi10fScKICAgICAgLSAnU0VSVkVSX0dSUENfQlJPQURDQVNUX0FERFJFU1M9JHtTRVJWRVJfR1JQQ19CUk9BRENBU1RfQUREUkVTUzotbG9jYWxob3N0OjcwNzd9JwogICAgICAtIFNFUlZFUl9ERUZBVUxUX0VOR0lORV9WRVJTSU9OPVYxCiAgICAgIC0gJ1NFUlZFUl9JTlRFUk5BTF9DTElFTlRfSU5URVJOQUxfR1JQQ19CUk9BRENBU1RfQUREUkVTUz0ke1NFUlZFUl9JTlRFUk5BTF9DTElFTlRfSU5URVJOQUxfR1JQQ19CUk9BRENBU1RfQUREUkVTUzotaGF0Y2hldC1lbmdpbmU6NzA3N30nCiAgICB2b2x1bWVzOgogICAgICAtICdoYXRjaGV0LWNlcnRzOi9oYXRjaGV0L2NlcnRzJwogICAgICAtICdoYXRjaGV0LWNvbmZpZzovaGF0Y2hldC9jb25maWcnCiAgICBkZXBlbmRzX29uOgogICAgICBtaWdyYXRpb246CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgICAgcmFiYml0bXE6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgcG9zdGdyZXM6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkK",
         "tags": [
             "ai-agents",
             "background-tasks",
@@ -2270,7 +2357,7 @@
         "category": "automation",
         "logo": "svgs/hatchet.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
         "port": "80"
     },
     "healthchecks": {
@@ -4280,7 +4367,7 @@
     "penpot-with-s3": {
         "documentation": "https://help.penpot.app/technical-guide/getting-started/#install-with-docker?utm_source=coolify.io",
         "slogan": "Penpot is the first Open Source design and prototyping platform for product teams.",
-        "compose": "c2VydmljZXM6CiAgZnJvbnRlbmQ6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9mcm9udGVuZDoyLjExLjEnCiAgICBkZXBlbmRzX29uOgogICAgICBwZW5wb3QtYmFja2VuZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwZW5wb3QtZXhwb3J0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GUk9OVEVORF84MDgwCiAgICAgIC0gJ1BFTlBPVF9GTEFHUz0ke1BFTlBPVF9CQUNLRU5EX0ZMQUdTOi1lbmFibGUtbG9naW4td2l0aC1wYXNzd29yZH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHBlbnBvdC1iYWNrZW5kOgogICAgaW1hZ2U6ICdwZW5wb3RhcHAvYmFja2VuZDoyLjExLjEnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwZW5wb3QtdmFsa2V5OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvLWluaXQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQRU5QT1RfRkxBR1M9JHtQRU5QT1RfQkFDS0VORF9GTEFHUzotZW5hYmxlLWxvZ2luLXdpdGgtcGFzc3dvcmR9JwogICAgICAtIFBFTlBPVF9IVFRQX1NFUlZFUl9QT1JUPTYwNjAKICAgICAgLSAnUEVOUE9UX1NFQ1JFVF9LRVk9JHtTRVJWSUNFX1JFQUxCQVNFNjRfNjRfUEVOUE9UfScKICAgICAgLSAnUEVOUE9UX1BVQkxJQ19VUkk9JHtTRVJWSUNFX0ZRRE5fRlJPTlRFTkRfODA4MH0nCiAgICAgIC0gJ1BFTlBPVF9CQUNLRU5EX1VSST1odHRwOi8vcGVucG90LWJhY2tlbmQnCiAgICAgIC0gJ1BFTlBPVF9FWFBPUlRFUl9VUkk9aHR0cDovL3BlbnBvdC1leHBvcnRlcicKICAgICAgLSAnUEVOUE9UX0RBVEFCQVNFX1VSST1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXMvJHtQT1NUR1JFU19EQjotcGVucG90fScKICAgICAgLSAnUEVOUE9UX0RBVEFCQVNFX1VTRVJOQU1FPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUEVOUE9UX0RBVEFCQVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BFTlBPVF9SRURJU19VUkk9cmVkaXM6Ly9wZW5wb3QtdmFsa2V5LzAnCiAgICAgIC0gJ1BFTlBPVF9URUxFTUVUUllfRU5BQkxFRD0ke1BFTlBPVF9URUxFTUVUUllfRU5BQkxFRDotZmFsc2V9JwogICAgICAtIFBFTlBPVF9PQkpFQ1RTX1NUT1JBR0VfQkFDS0VORD1zMwogICAgICAtIFBFTlBPVF9PQkpFQ1RTX1NUT1JBR0VfUzNfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFBFTlBPVF9PQkpFQ1RTX1NUT1JBR0VfUzNfQlVDS0VUPXBlbnBvdAogICAgICAtICdQRU5QT1RfT0JKRUNUU19TVE9SQUdFX1MzX0VORFBPSU5UPWh0dHA6Ly9taW5pbzo5MDAwJwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ0FXU19TRUNSRVRfQUNDRVNTX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdQRU5QT1RfU01UUF9ERUZBVUxUX0ZST009JHtQRU5QT1RfU01UUF9ERUZBVUxUX0ZST006LW5vLXJlcGx5QGV4YW1wbGUuY29tfScKICAgICAgLSAnUEVOUE9UX1NNVFBfREVGQVVMVF9SRVBMWV9UTz0ke1BFTlBPVF9TTVRQX0RFRkFVTFRfUkVQTFlfVE86LW5vLXJlcGx5QGV4YW1wbGUuY29tfScKICAgICAgLSAnUEVOUE9UX1NNVFBfSE9TVD0ke1BFTlBPVF9TTVRQX0hPU1Q6LW1haWxwaXR9JwogICAgICAtICdQRU5QT1RfU01UUF9QT1JUPSR7UEVOUE9UX1NNVFBfUE9SVDotMTAyNX0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX1VTRVJOQU1FPSR7UEVOUE9UX1NNVFBfVVNFUk5BTUU6LXBlbnBvdH0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX1BBU1NXT1JEPSR7UEVOUE9UX1NNVFBfUEFTU1dPUkQ6LXBlbnBvdH0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX1RMUz0ke1BFTlBPVF9TTVRQX1RMUzotZmFsc2V9JwogICAgICAtICdQRU5QT1RfU01UUF9TU0w9JHtQRU5QT1RfU01UUF9TU0w6LWZhbHNlfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAicmVxdWlyZSgnaHR0cCcpLmdldCh7aG9zdDonMTI3LjAuMC4xJywgcG9ydDo2MDYwLCBwYXRoOicvcmVhZHl6J30sIHJlcyA9PiBwcm9jZXNzLmV4aXQocmVzLnN0YXR1c0NvZGU9PT0yMDAgPyAwIDogMSkpLm9uKCdlcnJvcicsICgpID0+IHByb2Nlc3MuZXhpdCgxKSk7IgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxNQogIHBlbnBvdC1leHBvcnRlcjoKICAgIGltYWdlOiAncGVucG90YXBwL2V4cG9ydGVyOjIuMTEuMScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQRU5QT1RfUFVCTElDX1VSST0ke1NFUlZJQ0VfRlFETl9GUk9OVEVORF84MDgwfScKICAgICAgLSAnUEVOUE9UX1JFRElTX1VSST1yZWRpczovL3BlbnBvdC12YWxrZXkvMCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo2MDYxL3JlYWR5eicKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgdm9sdW1lczoKICAgICAgLSAnbWluaW8tZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBtaW5pby1pbml0OgogICAgaW1hZ2U6ICdtaW5pby9tYzpsYXRlc3QnCiAgICBkZXBlbmRzX29uOgogICAgICBtaW5pbzoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW50cnlwb2ludDogInNoIC1jIFwiXG4gIG1jIGFsaWFzIHNldCBsb2NhbCBodHRwOi8vbWluaW86OTAwMCAke1NFUlZJQ0VfVVNFUl9NSU5JT30gJHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfSAmJlxuICBtYyBtYiAtcCBsb2NhbC9wZW5wb3QgfHwgdHJ1ZSAmJlxuICBtYyBhbm9ueW1vdXMgc2V0IHByaXZhdGUgbG9jYWwvcGVucG90XG5cIlxuIgogICAgcmVzdGFydDogJ25vJwogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE1JwogICAgdm9sdW1lczoKICAgICAgLSAncGVucG90LXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQT1NUR1JFU19JTklUREJfQVJHUz0tLWRhdGEtY2hlY2tzdW1zCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wZW5wb3R9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBlbnBvdC12YWxrZXk6CiAgICBpbWFnZTogJ3ZhbGtleS92YWxrZXk6OC4xJwogICAgdm9sdW1lczoKICAgICAgLSAncGVucG90LXZhbGtleS1kYXRhOi9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1ZBTEtFWV9FWFRSQV9GTEFHUz0tLW1heG1lbW9yeSAxMjhtYiAtLW1heG1lbW9yeS1wb2xpY3kgdm9sYXRpbGUtbGZ1JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd2YWxrZXktY2xpIHBpbmcgfCBncmVwIFBPTkcnCiAgICAgIGludGVydmFsOiAxcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogM3MKICBtYWlscGl0OgogICAgaW1hZ2U6ICdheGxsZW50L21haWxwaXQ6djEuMjgnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTUFJTFBJVF84MDI1CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL21haWxwaXQKICAgICAgICAtIHJlYWR5egogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "c2VydmljZXM6CiAgZnJvbnRlbmQ6CiAgICBpbWFnZTogJ3BlbnBvdGFwcC9mcm9udGVuZDoyLjExLjEnCiAgICBkZXBlbmRzX29uOgogICAgICBwZW5wb3QtYmFja2VuZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwZW5wb3QtZXhwb3J0ZXI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9GUk9OVEVORF84MDgwCiAgICAgIC0gJ1BFTlBPVF9GTEFHUz0ke1BFTlBPVF9CQUNLRU5EX0ZMQUdTOi1lbmFibGUtbG9naW4td2l0aC1wYXNzd29yZH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIHBlbnBvdC1iYWNrZW5kOgogICAgaW1hZ2U6ICdwZW5wb3RhcHAvYmFja2VuZDoyLjExLjEnCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBwZW5wb3QtdmFsa2V5OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1pbmlvLWluaXQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2NvbXBsZXRlZF9zdWNjZXNzZnVsbHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQRU5QT1RfRkxBR1M9JHtQRU5QT1RfQkFDS0VORF9GTEFHUzotZW5hYmxlLWxvZ2luLXdpdGgtcGFzc3dvcmR9JwogICAgICAtIFBFTlBPVF9IVFRQX1NFUlZFUl9QT1JUPTYwNjAKICAgICAgLSAnUEVOUE9UX1NFQ1JFVF9LRVk9JHtTRVJWSUNFX1JFQUxCQVNFNjRfNjRfUEVOUE9UfScKICAgICAgLSAnUEVOUE9UX1BVQkxJQ19VUkk9JHtTRVJWSUNFX0ZRRE5fRlJPTlRFTkRfODA4MH0nCiAgICAgIC0gJ1BFTlBPVF9CQUNLRU5EX1VSST1odHRwOi8vcGVucG90LWJhY2tlbmQnCiAgICAgIC0gJ1BFTlBPVF9FWFBPUlRFUl9VUkk9aHR0cDovL3BlbnBvdC1leHBvcnRlcicKICAgICAgLSAnUEVOUE9UX0RBVEFCQVNFX1VSST1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXMvJHtQT1NUR1JFU19EQjotcGVucG90fScKICAgICAgLSAnUEVOUE9UX0RBVEFCQVNFX1VTRVJOQU1FPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUEVOUE9UX0RBVEFCQVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BFTlBPVF9SRURJU19VUkk9cmVkaXM6Ly9wZW5wb3QtdmFsa2V5LzAnCiAgICAgIC0gJ1BFTlBPVF9URUxFTUVUUllfRU5BQkxFRD0ke1BFTlBPVF9URUxFTUVUUllfRU5BQkxFRDotZmFsc2V9JwogICAgICAtIFBFTlBPVF9PQkpFQ1RTX1NUT1JBR0VfQkFDS0VORD1zMwogICAgICAtIFBFTlBPVF9PQkpFQ1RTX1NUT1JBR0VfUzNfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFBFTlBPVF9PQkpFQ1RTX1NUT1JBR0VfUzNfQlVDS0VUPXBlbnBvdAogICAgICAtICdQRU5QT1RfT0JKRUNUU19TVE9SQUdFX1MzX0VORFBPSU5UPWh0dHA6Ly9taW5pbzo5MDAwJwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ0FXU19TRUNSRVRfQUNDRVNTX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgICAtICdQRU5QT1RfU01UUF9ERUZBVUxUX0ZST009JHtQRU5QT1RfU01UUF9ERUZBVUxUX0ZST006LW5vLXJlcGx5QGV4YW1wbGUuY29tfScKICAgICAgLSAnUEVOUE9UX1NNVFBfREVGQVVMVF9SRVBMWV9UTz0ke1BFTlBPVF9TTVRQX0RFRkFVTFRfUkVQTFlfVE86LW5vLXJlcGx5QGV4YW1wbGUuY29tfScKICAgICAgLSAnUEVOUE9UX1NNVFBfSE9TVD0ke1BFTlBPVF9TTVRQX0hPU1Q6LW1haWxwaXR9JwogICAgICAtICdQRU5QT1RfU01UUF9QT1JUPSR7UEVOUE9UX1NNVFBfUE9SVDotMTAyNX0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX1VTRVJOQU1FPSR7UEVOUE9UX1NNVFBfVVNFUk5BTUU6LXBlbnBvdH0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX1BBU1NXT1JEPSR7UEVOUE9UX1NNVFBfUEFTU1dPUkQ6LXBlbnBvdH0nCiAgICAgIC0gJ1BFTlBPVF9TTVRQX1RMUz0ke1BFTlBPVF9TTVRQX1RMUzotZmFsc2V9JwogICAgICAtICdQRU5QT1RfU01UUF9TU0w9JHtQRU5QT1RfU01UUF9TU0w6LWZhbHNlfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAicmVxdWlyZSgnaHR0cCcpLmdldCh7aG9zdDonMTI3LjAuMC4xJywgcG9ydDo2MDYwLCBwYXRoOicvcmVhZHl6J30sIHJlcyA9PiBwcm9jZXNzLmV4aXQocmVzLnN0YXR1c0NvZGU9PT0yMDAgPyAwIDogMSkpLm9uKCdlcnJvcicsICgpID0+IHByb2Nlc3MuZXhpdCgxKSk7IgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxNQogIHBlbnBvdC1leHBvcnRlcjoKICAgIGltYWdlOiAncGVucG90YXBwL2V4cG9ydGVyOjIuMTEuMScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQRU5QT1RfUFVCTElDX1VSST0ke1NFUlZJQ0VfRlFETl9GUk9OVEVORF84MDgwfScKICAgICAgLSAnUEVOUE9UX1JFRElTX1VSST1yZWRpczovL3BlbnBvdC12YWxrZXkvMCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo2MDYxL3JlYWR5eicKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01JTklPX1JPT1RfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NSU5JT30nCiAgICAgIC0gJ01JTklPX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01JTklPfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgbWluaW8taW5pdDoKICAgIGltYWdlOiAncGdzdHkvc2lsbzpSRUxFQVNFLjIwMjYtMTAtMTVUMDAtMDAtMDBaJwogICAgZGVwZW5kc19vbjoKICAgICAgbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6ICJzaCAtYyBcIlxuICBtYyBhbGlhcyBzZXQgbG9jYWwgaHR0cDovL21pbmlvOjkwMDAgJHtTRVJWSUNFX1VTRVJfTUlOSU99ICR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30gJiZcbiAgbWMgbWIgLXAgbG9jYWwvcGVucG90IHx8IHRydWUgJiZcbiAgbWMgYW5vbnltb3VzIHNldCBwcml2YXRlIGxvY2FsL3BlbnBvdFxuXCJcbiIKICAgIHJlc3RhcnQ6ICdubycKICAgIGV4Y2x1ZGVfZnJvbV9oYzogdHJ1ZQogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BlbnBvdC1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSU5JVERCX0FSR1M9LS1kYXRhLWNoZWNrc3VtcwogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcGVucG90fScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwZW5wb3QtdmFsa2V5OgogICAgaW1hZ2U6ICd2YWxrZXkvdmFsa2V5OjguMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3BlbnBvdC12YWxrZXktZGF0YTovZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdWQUxLRVlfRVhUUkFfRkxBR1M9LS1tYXhtZW1vcnkgMTI4bWIgLS1tYXhtZW1vcnktcG9saWN5IHZvbGF0aWxlLWxmdScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAndmFsa2V5LWNsaSBwaW5nIHwgZ3JlcCBQT05HJwogICAgICBpbnRlcnZhbDogMXMKICAgICAgdGltZW91dDogM3MKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDNzCiAgbWFpbHBpdDoKICAgIGltYWdlOiAnYXhsbGVudC9tYWlscGl0OnYxLjI4JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX01BSUxQSVRfODAyNQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIC9tYWlscGl0CiAgICAgICAgLSByZWFkeXoKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "penpot",
             "design",
@@ -4374,7 +4461,7 @@
     "plane": {
         "documentation": "https://docs.plane.so/self-hosting/methods/docker-compose?utm_source=coolify.io",
         "slogan": "The open source project management tool",
-        "compose": "eC1kYi1lbnY6CiAgUEdIT1NUOiBwbGFuZS1kYgogIFBHREFUQUJBU0U6IHBsYW5lCiAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogIFBPU1RHUkVTX0RCOiBwbGFuZQogIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQp4LXJlZGlzLWVudjoKICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99Jwp4LW1pbmlvLWVudjoKICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwp4LWF3cy1zMy1lbnY6CiAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9Jwp4LXByb3h5LWVudjoKICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX0ZRRE5fUExBTkV9JwogIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICBTSVRFX0FERFJFU1M6ICcke1NJVEVfQUREUkVTUzotOjgwfScKeC1tcS1lbnY6CiAgUkFCQklUTVFfSE9TVDogcGxhbmUtbXEKICBSQUJCSVRNUV9QT1JUOiAnJHtSQUJCSVRNUV9QT1JUOi01NjcyfScKICBSQUJCSVRNUV9ERUZBVUxUX1VTRVI6ICcke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUTotcGxhbmV9JwogIFJBQkJJVE1RX0RFRkFVTFRfUEFTUzogJyR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUTotcGxhbmV9JwogIFJBQkJJVE1RX0RFRkFVTFRfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCiAgUkFCQklUTVFfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCngtbGl2ZS1lbnY6CiAgQVBJX0JBU0VfVVJMOiAnJHtBUElfQkFTRV9VUkw6LWh0dHA6Ly9hcGk6ODAwMH0nCiAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAp4LWFwcC1lbnY6CiAgQVBQX1JFTEVBU0U6ICcke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogIFdFQl9VUkw6ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgREVCVUc6ICcke0RFQlVHOi0wfScKICBDT1JTX0FMTE9XRURfT1JJR0lOUzogJyR7Q09SU19BTExPV0VEX09SSUdJTlM6LWh0dHA6Ly9sb2NhbGhvc3R9JwogIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogIFVTRV9NSU5JTzogJyR7VVNFX01JTklPOi0xfScKICBEQVRBQkFTRV9VUkw6ICdwb3N0Z3Jlc3FsOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0BwbGFuZS1kYi9wbGFuZScKICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICBBTVFQX1VSTDogJ2FtcXA6Ly8ke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUX06JHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RfUBwbGFuZS1tcToke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9L3BsYW5lJwogIEFQSV9LRVlfUkFURV9MSU1JVDogJyR7QVBJX0tFWV9SQVRFX0xJTUlUOi02MC9taW51dGV9JwogIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCnNlcnZpY2VzOgogIHByb3h5OgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtcHJveHk6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QTEFORQogICAgICAtICdBUFBfRE9NQUlOPSR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgLSAnU0lURV9BRERSRVNTPTo4MCcKICAgICAgLSAnRklMRV9TSVpFX0xJTUlUPSR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgLSAnQlVDS0VUX05BTUU9JHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogICAgdm9sdW1lczoKICAgICAgLSAncHJveHlfY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3Byb3h5X2RhdGE6L2RhdGEnCiAgICBkZXBlbmRzX29uOgogICAgICAtIHdlYgogICAgICAtIGFwaQogICAgICAtIHNwYWNlCiAgICAgIC0gYWRtaW4KICAgICAgLSBsaXZlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICB3ZWI6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1mcm9udGVuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSB3b3JrZXIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnd2dldCAtcU8tIGh0dHA6Ly9gaG9zdG5hbWVgOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBzcGFjZToKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLXNwYWNlOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHdvcmtlcgogICAgICAtIHdlYgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBhZG1pbjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWFkbWluOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHdlYgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBsaXZlOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtbGl2ZToke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQSV9CQVNFX1VSTDogJyR7QVBJX0JBU0VfVVJMOi1odHRwOi8vYXBpOjgwMDB9JwogICAgICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBpCiAgICAgIC0gd2ViCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZWNobwogICAgICAgIC0gJ2hleSB3aGF0cyB1cCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGFwaToKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWJhY2tlbmQ6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGNvbW1hbmQ6IC4vYmluL2RvY2tlci1lbnRyeXBvaW50LWFwaS5zaAogICAgdm9sdW1lczoKICAgICAgLSAnbG9nc19hcGk6L2NvZGUvcGxhbmUvbG9ncycKICAgIGVudmlyb25tZW50OgogICAgICBBUFBfUkVMRUFTRTogJyR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICAgIFdFQl9VUkw6ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgd29ya2VyOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYmFja2VuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgY29tbWFuZDogLi9iaW4vZG9ja2VyLWVudHJ5cG9pbnQtd29ya2VyLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX3dvcmtlcjovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgREVCVUc6ICcke0RFQlVHOi0wfScKICAgICAgQ09SU19BTExPV0VEX09SSUdJTlM6ICcke0NPUlNfQUxMT1dFRF9PUklHSU5TOi1odHRwOi8vbG9jYWxob3N0fScKICAgICAgR1VOSUNPUk5fV09SS0VSUzogJyR7R1VOSUNPUk5fV09SS0VSUzotMX0nCiAgICAgIFVTRV9NSU5JTzogJyR7VVNFX01JTklPOi0xfScKICAgICAgREFUQUJBU0VfVVJMOiAncG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcGxhbmUtZGIvcGxhbmUnCiAgICAgIFNFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X1NFQ1JFVEtFWQogICAgICBBTVFQX1VSTDogJ2FtcXA6Ly8ke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUX06JHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RfUBwbGFuZS1tcToke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9L3BsYW5lJwogICAgICBBUElfS0VZX1JBVEVfTElNSVQ6ICcke0FQSV9LRVlfUkFURV9MSU1JVDotNjAvbWludXRlfScKICAgICAgTUlOSU9fRU5EUE9JTlRfU1NMOiAnJHtNSU5JT19FTkRQT0lOVF9TU0w6LTB9JwogICAgICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCiAgICAgIFBHSE9TVDogcGxhbmUtZGIKICAgICAgUEdEQVRBQkFTRTogcGxhbmUKICAgICAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICBQT1NUR1JFU19QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfREI6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICAgICAgUEdEQVRBOiAvdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEKICAgICAgUkVESVNfSE9TVDogJyR7UkVESVNfSE9TVDotcGxhbmUtcmVkaXN9JwogICAgICBSRURJU19QT1JUOiAnJHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99JwogICAgICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgTUlOSU9fUk9PVF9QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICAgICAgQVdTX0FDQ0VTU19LRVlfSUQ6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgICAgIEFXU19TM19CVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgQVBQX0RPTUFJTjogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICAgICAgLSBwbGFuZS1tcQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBiZWF0LXdvcmtlcjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWJhY2tlbmQ6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGNvbW1hbmQ6IC4vYmluL2RvY2tlci1lbnRyeXBvaW50LWJlYXQuc2gKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2xvZ3NfYmVhdC13b3JrZXI6L2NvZGUvcGxhbmUvbG9ncycKICAgIGVudmlyb25tZW50OgogICAgICBBUFBfUkVMRUFTRTogJyR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICAgIFdFQl9VUkw6ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbWlncmF0b3I6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1iYWNrZW5kOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICByZXN0YXJ0OiAnbm8nCiAgICBjb21tYW5kOiAuL2Jpbi9kb2NrZXItZW50cnlwb2ludC1taWdyYXRvci5zaAogICAgdm9sdW1lczoKICAgICAgLSAnbG9nc19taWdyYXRvcjovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgREVCVUc6ICcke0RFQlVHOi0wfScKICAgICAgQ09SU19BTExPV0VEX09SSUdJTlM6ICcke0NPUlNfQUxMT1dFRF9PUklHSU5TOi1odHRwOi8vbG9jYWxob3N0fScKICAgICAgR1VOSUNPUk5fV09SS0VSUzogJyR7R1VOSUNPUk5fV09SS0VSUzotMX0nCiAgICAgIFVTRV9NSU5JTzogJyR7VVNFX01JTklPOi0xfScKICAgICAgREFUQUJBU0VfVVJMOiAncG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcGxhbmUtZGIvcGxhbmUnCiAgICAgIFNFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X1NFQ1JFVEtFWQogICAgICBBTVFQX1VSTDogJ2FtcXA6Ly8ke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUX06JHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RfUBwbGFuZS1tcToke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9L3BsYW5lJwogICAgICBBUElfS0VZX1JBVEVfTElNSVQ6ICcke0FQSV9LRVlfUkFURV9MSU1JVDotNjAvbWludXRlfScKICAgICAgTUlOSU9fRU5EUE9JTlRfU1NMOiAnJHtNSU5JT19FTkRQT0lOVF9TU0w6LTB9JwogICAgICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCiAgICAgIFBHSE9TVDogcGxhbmUtZGIKICAgICAgUEdEQVRBQkFTRTogcGxhbmUKICAgICAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICBQT1NUR1JFU19QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfREI6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICAgICAgUEdEQVRBOiAvdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEKICAgICAgUkVESVNfSE9TVDogJyR7UkVESVNfSE9TVDotcGxhbmUtcmVkaXN9JwogICAgICBSRURJU19QT1JUOiAnJHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99JwogICAgICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgTUlOSU9fUk9PVF9QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICAgICAgQVdTX0FDQ0VTU19LRVlfSUQ6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgICAgIEFXU19TM19CVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgQVBQX0RPTUFJTjogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICBwbGFuZS1kYjoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUuNy1hbHBpbmUnCiAgICBjb21tYW5kOiAicG9zdGdyZXMgLWMgJ21heF9jb25uZWN0aW9ucz0xMDAwJyIKICAgIGVudmlyb25tZW50OgogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdwZ2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBsYW5lLXJlZGlzOgogICAgaW1hZ2U6ICd2YWxrZXkvdmFsa2V5OjcuMi4xMS1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwbGFuZS1tcToKICAgIGltYWdlOiAncmFiYml0bXE6My4xMy42LW1hbmFnZW1lbnQtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIFJBQkJJVE1RX0hPU1Q6IHBsYW5lLW1xCiAgICAgIFJBQkJJVE1RX1BPUlQ6ICcke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1VTRVI6ICcke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUTotcGxhbmV9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1BBU1M6ICcke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVE6LXBsYW5lfScKICAgICAgUkFCQklUTVFfREVGQVVMVF9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKICAgICAgUkFCQklUTVFfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcV9kYXRhOi92YXIvbGliL3JhYmJpdG1xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBwaW5nJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAzCiAgcGxhbmUtbWluaW86CiAgICBpbWFnZTogJ2doY3IuaW8vY29vbGxhYnNpby9taW5pbzpSRUxFQVNFLjIwMjUtMTAtMTVUMTctMjktNTVaJwogICAgY29tbWFuZDogJ3NlcnZlciAvZXhwb3J0IC0tY29uc29sZS1hZGRyZXNzICI6OTA5MCInCiAgICBlbnZpcm9ubWVudDoKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICB2b2x1bWVzOgogICAgICAtICd1cGxvYWRzOi9leHBvcnQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "eC1kYi1lbnY6CiAgUEdIT1NUOiBwbGFuZS1kYgogIFBHREFUQUJBU0U6IHBsYW5lCiAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogIFBPU1RHUkVTX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFUwogIFBPU1RHUkVTX0RCOiBwbGFuZQogIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICBQR0RBVEE6IC92YXIvbGliL3Bvc3RncmVzcWwvZGF0YQp4LXJlZGlzLWVudjoKICBSRURJU19IT1NUOiAnJHtSRURJU19IT1NUOi1wbGFuZS1yZWRpc30nCiAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99Jwp4LW1pbmlvLWVudjoKICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICBNSU5JT19ST09UX1BBU1NXT1JEOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwp4LWF3cy1zMy1lbnY6CiAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICBBV1NfQUNDRVNTX0tFWV9JRDogJFNFUlZJQ0VfVVNFUl9NSU5JTwogIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgQVdTX1MzX0JVQ0tFVF9OQU1FOiAnJHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9Jwp4LXByb3h5LWVudjoKICBBUFBfRE9NQUlOOiAnJHtTRVJWSUNFX0ZRRE5fUExBTkV9JwogIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICBTSVRFX0FERFJFU1M6ICcke1NJVEVfQUREUkVTUzotOjgwfScKeC1tcS1lbnY6CiAgUkFCQklUTVFfSE9TVDogcGxhbmUtbXEKICBSQUJCSVRNUV9QT1JUOiAnJHtSQUJCSVRNUV9QT1JUOi01NjcyfScKICBSQUJCSVRNUV9ERUZBVUxUX1VTRVI6ICcke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUTotcGxhbmV9JwogIFJBQkJJVE1RX0RFRkFVTFRfUEFTUzogJyR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUTotcGxhbmV9JwogIFJBQkJJVE1RX0RFRkFVTFRfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCiAgUkFCQklUTVFfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCngtbGl2ZS1lbnY6CiAgQVBJX0JBU0VfVVJMOiAnJHtBUElfQkFTRV9VUkw6LWh0dHA6Ly9hcGk6ODAwMH0nCiAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAp4LWFwcC1lbnY6CiAgQVBQX1JFTEVBU0U6ICcke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogIFdFQl9VUkw6ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgREVCVUc6ICcke0RFQlVHOi0wfScKICBDT1JTX0FMTE9XRURfT1JJR0lOUzogJyR7Q09SU19BTExPV0VEX09SSUdJTlM6LWh0dHA6Ly9sb2NhbGhvc3R9JwogIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogIFVTRV9NSU5JTzogJyR7VVNFX01JTklPOi0xfScKICBEQVRBQkFTRV9VUkw6ICdwb3N0Z3Jlc3FsOi8vJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUzokU0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU0BwbGFuZS1kYi9wbGFuZScKICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICBBTVFQX1VSTDogJ2FtcXA6Ly8ke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUX06JHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RfUBwbGFuZS1tcToke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9L3BsYW5lJwogIEFQSV9LRVlfUkFURV9MSU1JVDogJyR7QVBJX0tFWV9SQVRFX0xJTUlUOi02MC9taW51dGV9JwogIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCnNlcnZpY2VzOgogIHByb3h5OgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtcHJveHk6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QTEFORQogICAgICAtICdBUFBfRE9NQUlOPSR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgLSAnU0lURV9BRERSRVNTPTo4MCcKICAgICAgLSAnRklMRV9TSVpFX0xJTUlUPSR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgLSAnQlVDS0VUX05BTUU9JHtBV1NfUzNfQlVDS0VUX05BTUU6LXVwbG9hZHN9JwogICAgdm9sdW1lczoKICAgICAgLSAncHJveHlfY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3Byb3h5X2RhdGE6L2RhdGEnCiAgICBkZXBlbmRzX29uOgogICAgICAtIHdlYgogICAgICAtIGFwaQogICAgICAtIHNwYWNlCiAgICAgIC0gYWRtaW4KICAgICAgLSBsaXZlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICB3ZWI6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1mcm9udGVuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSB3b3JrZXIKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnd2dldCAtcU8tIGh0dHA6Ly9gaG9zdG5hbWVgOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBzcGFjZToKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLXNwYWNlOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHdvcmtlcgogICAgICAtIHdlYgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBhZG1pbjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWFkbWluOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHdlYgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBsaXZlOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtbGl2ZToke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQSV9CQVNFX1VSTDogJyR7QVBJX0JBU0VfVVJMOi1odHRwOi8vYXBpOjgwMDB9JwogICAgICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gYXBpCiAgICAgIC0gd2ViCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gZWNobwogICAgICAgIC0gJ2hleSB3aGF0cyB1cCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGFwaToKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWJhY2tlbmQ6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGNvbW1hbmQ6IC4vYmluL2RvY2tlci1lbnRyeXBvaW50LWFwaS5zaAogICAgdm9sdW1lczoKICAgICAgLSAnbG9nc19hcGk6L2NvZGUvcGxhbmUvbG9ncycKICAgIGVudmlyb25tZW50OgogICAgICBBUFBfUkVMRUFTRTogJyR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICAgIFdFQl9VUkw6ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgd29ya2VyOgogICAgaW1hZ2U6ICdtYWtlcGxhbmUvcGxhbmUtYmFja2VuZDoke0FQUF9SRUxFQVNFOi12MS4zLjB9JwogICAgY29tbWFuZDogLi9iaW4vZG9ja2VyLWVudHJ5cG9pbnQtd29ya2VyLnNoCiAgICB2b2x1bWVzOgogICAgICAtICdsb2dzX3dvcmtlcjovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgREVCVUc6ICcke0RFQlVHOi0wfScKICAgICAgQ09SU19BTExPV0VEX09SSUdJTlM6ICcke0NPUlNfQUxMT1dFRF9PUklHSU5TOi1odHRwOi8vbG9jYWxob3N0fScKICAgICAgR1VOSUNPUk5fV09SS0VSUzogJyR7R1VOSUNPUk5fV09SS0VSUzotMX0nCiAgICAgIFVTRV9NSU5JTzogJyR7VVNFX01JTklPOi0xfScKICAgICAgREFUQUJBU0VfVVJMOiAncG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcGxhbmUtZGIvcGxhbmUnCiAgICAgIFNFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X1NFQ1JFVEtFWQogICAgICBBTVFQX1VSTDogJ2FtcXA6Ly8ke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUX06JHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RfUBwbGFuZS1tcToke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9L3BsYW5lJwogICAgICBBUElfS0VZX1JBVEVfTElNSVQ6ICcke0FQSV9LRVlfUkFURV9MSU1JVDotNjAvbWludXRlfScKICAgICAgTUlOSU9fRU5EUE9JTlRfU1NMOiAnJHtNSU5JT19FTkRQT0lOVF9TU0w6LTB9JwogICAgICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCiAgICAgIFBHSE9TVDogcGxhbmUtZGIKICAgICAgUEdEQVRBQkFTRTogcGxhbmUKICAgICAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICBQT1NUR1JFU19QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfREI6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICAgICAgUEdEQVRBOiAvdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEKICAgICAgUkVESVNfSE9TVDogJyR7UkVESVNfSE9TVDotcGxhbmUtcmVkaXN9JwogICAgICBSRURJU19QT1JUOiAnJHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99JwogICAgICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgTUlOSU9fUk9PVF9QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICAgICAgQVdTX0FDQ0VTU19LRVlfSUQ6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgICAgIEFXU19TM19CVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgQVBQX0RPTUFJTjogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIGFwaQogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICAgICAgLSBwbGFuZS1tcQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdoZXkgd2hhdHMgdXAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBiZWF0LXdvcmtlcjoKICAgIGltYWdlOiAnbWFrZXBsYW5lL3BsYW5lLWJhY2tlbmQ6JHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgIGNvbW1hbmQ6IC4vYmluL2RvY2tlci1lbnRyeXBvaW50LWJlYXQuc2gKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2xvZ3NfYmVhdC13b3JrZXI6L2NvZGUvcGxhbmUvbG9ncycKICAgIGVudmlyb25tZW50OgogICAgICBBUFBfUkVMRUFTRTogJyR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICAgIFdFQl9VUkw6ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIERFQlVHOiAnJHtERUJVRzotMH0nCiAgICAgIENPUlNfQUxMT1dFRF9PUklHSU5TOiAnJHtDT1JTX0FMTE9XRURfT1JJR0lOUzotaHR0cDovL2xvY2FsaG9zdH0nCiAgICAgIEdVTklDT1JOX1dPUktFUlM6ICcke0dVTklDT1JOX1dPUktFUlM6LTF9JwogICAgICBVU0VfTUlOSU86ICcke1VTRV9NSU5JTzotMX0nCiAgICAgIERBVEFCQVNFX1VSTDogJ3Bvc3RncmVzcWw6Ly8kU0VSVklDRV9VU0VSX1BPU1RHUkVTOiRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTQHBsYW5lLWRiL3BsYW5lJwogICAgICBTRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9TRUNSRVRLRVkKICAgICAgQU1RUF9VUkw6ICdhbXFwOi8vJHtTRVJWSUNFX1VTRVJfUkFCQklUTVF9OiR7U0VSVklDRV9QQVNTV09SRF9SQUJCSVRNUX1AcGxhbmUtbXE6JHtSQUJCSVRNUV9QT1JUOi01NjcyfS9wbGFuZScKICAgICAgQVBJX0tFWV9SQVRFX0xJTUlUOiAnJHtBUElfS0VZX1JBVEVfTElNSVQ6LTYwL21pbnV0ZX0nCiAgICAgIE1JTklPX0VORFBPSU5UX1NTTDogJyR7TUlOSU9fRU5EUE9JTlRfU1NMOi0wfScKICAgICAgTElWRV9TRVJWRVJfU0VDUkVUX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfNjRfTElWRVNFQ1JFVAogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICAgIFJFRElTX0hPU1Q6ICcke1JFRElTX0hPU1Q6LXBsYW5lLXJlZGlzfScKICAgICAgUkVESVNfUE9SVDogJyR7UkVESVNfUE9SVDotNjM3OX0nCiAgICAgIFJFRElTX1VSTDogJyR7UkVESVNfVVJMOi1yZWRpczovL3BsYW5lLXJlZGlzOjYzNzkvfScKICAgICAgTUlOSU9fUk9PVF9VU0VSOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIE1JTklPX1JPT1RfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICAgIEFXU19SRUdJT046ICcke0FXU19SRUdJT046LX0nCiAgICAgIEFXU19BQ0NFU1NfS0VZX0lEOiAkU0VSVklDRV9VU0VSX01JTklPCiAgICAgIEFXU19TRUNSRVRfQUNDRVNTX0tFWTogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1MzX0VORFBPSU5UX1VSTDogJyR7QVdTX1MzX0VORFBPSU5UX1VSTDotaHR0cDovL3BsYW5lLW1pbmlvOjkwMDB9JwogICAgICBBV1NfUzNfQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIEFQUF9ET01BSU46ICcke1NFUlZJQ0VfRlFETl9QTEFORX0nCiAgICAgIEZJTEVfU0laRV9MSU1JVDogJyR7RklMRV9TSVpFX0xJTUlUOi01MjQyODgwfScKICAgICAgQlVDS0VUX05BTUU6ICcke0FXU19TM19CVUNLRVRfTkFNRTotdXBsb2Fkc30nCiAgICAgIFNJVEVfQUREUkVTUzogJyR7U0lURV9BRERSRVNTOi06ODB9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBhcGkKICAgICAgLSBwbGFuZS1kYgogICAgICAtIHBsYW5lLXJlZGlzCiAgICAgIC0gcGxhbmUtbXEKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBlY2hvCiAgICAgICAgLSAnaGV5IHdoYXRzIHVwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbWlncmF0b3I6CiAgICBpbWFnZTogJ21ha2VwbGFuZS9wbGFuZS1iYWNrZW5kOiR7QVBQX1JFTEVBU0U6LXYxLjMuMH0nCiAgICByZXN0YXJ0OiAnbm8nCiAgICBjb21tYW5kOiAuL2Jpbi9kb2NrZXItZW50cnlwb2ludC1taWdyYXRvci5zaAogICAgdm9sdW1lczoKICAgICAgLSAnbG9nc19taWdyYXRvcjovY29kZS9wbGFuZS9sb2dzJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIEFQUF9SRUxFQVNFOiAnJHtBUFBfUkVMRUFTRTotdjEuMy4wfScKICAgICAgV0VCX1VSTDogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgREVCVUc6ICcke0RFQlVHOi0wfScKICAgICAgQ09SU19BTExPV0VEX09SSUdJTlM6ICcke0NPUlNfQUxMT1dFRF9PUklHSU5TOi1odHRwOi8vbG9jYWxob3N0fScKICAgICAgR1VOSUNPUk5fV09SS0VSUzogJyR7R1VOSUNPUk5fV09SS0VSUzotMX0nCiAgICAgIFVTRV9NSU5JTzogJyR7VVNFX01JTklPOi0xfScKICAgICAgREFUQUJBU0VfVVJMOiAncG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcGxhbmUtZGIvcGxhbmUnCiAgICAgIFNFQ1JFVF9LRVk6ICRTRVJWSUNFX1BBU1NXT1JEXzY0X1NFQ1JFVEtFWQogICAgICBBTVFQX1VSTDogJ2FtcXA6Ly8ke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUX06JHtTRVJWSUNFX1BBU1NXT1JEX1JBQkJJVE1RfUBwbGFuZS1tcToke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9L3BsYW5lJwogICAgICBBUElfS0VZX1JBVEVfTElNSVQ6ICcke0FQSV9LRVlfUkFURV9MSU1JVDotNjAvbWludXRlfScKICAgICAgTUlOSU9fRU5EUE9JTlRfU1NMOiAnJHtNSU5JT19FTkRQT0lOVF9TU0w6LTB9JwogICAgICBMSVZFX1NFUlZFUl9TRUNSRVRfS0VZOiAkU0VSVklDRV9QQVNTV09SRF82NF9MSVZFU0VDUkVUCiAgICAgIFBHSE9TVDogcGxhbmUtZGIKICAgICAgUEdEQVRBQkFTRTogcGxhbmUKICAgICAgUE9TVEdSRVNfVVNFUjogJFNFUlZJQ0VfVVNFUl9QT1NUR1JFUwogICAgICBQT1NUR1JFU19QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfREI6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1BPUlQ6IDU0MzIKICAgICAgUEdEQVRBOiAvdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEKICAgICAgUkVESVNfSE9TVDogJyR7UkVESVNfSE9TVDotcGxhbmUtcmVkaXN9JwogICAgICBSRURJU19QT1JUOiAnJHtSRURJU19QT1JUOi02Mzc5fScKICAgICAgUkVESVNfVVJMOiAnJHtSRURJU19VUkw6LXJlZGlzOi8vcGxhbmUtcmVkaXM6NjM3OS99JwogICAgICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgTUlOSU9fUk9PVF9QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgICAgQVdTX1JFR0lPTjogJyR7QVdTX1JFR0lPTjotfScKICAgICAgQVdTX0FDQ0VTU19LRVlfSUQ6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOiAkU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICBBV1NfUzNfRU5EUE9JTlRfVVJMOiAnJHtBV1NfUzNfRU5EUE9JTlRfVVJMOi1odHRwOi8vcGxhbmUtbWluaW86OTAwMH0nCiAgICAgIEFXU19TM19CVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgQVBQX0RPTUFJTjogJyR7U0VSVklDRV9GUUROX1BMQU5FfScKICAgICAgRklMRV9TSVpFX0xJTUlUOiAnJHtGSUxFX1NJWkVfTElNSVQ6LTUyNDI4ODB9JwogICAgICBCVUNLRVRfTkFNRTogJyR7QVdTX1MzX0JVQ0tFVF9OQU1FOi11cGxvYWRzfScKICAgICAgU0lURV9BRERSRVNTOiAnJHtTSVRFX0FERFJFU1M6LTo4MH0nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHBsYW5lLWRiCiAgICAgIC0gcGxhbmUtcmVkaXMKICBwbGFuZS1kYjoKICAgIGltYWdlOiAncG9zdGdyZXM6MTUuNy1hbHBpbmUnCiAgICBjb21tYW5kOiAicG9zdGdyZXMgLWMgJ21heF9jb25uZWN0aW9ucz0xMDAwJyIKICAgIGVudmlyb25tZW50OgogICAgICBQR0hPU1Q6IHBsYW5lLWRiCiAgICAgIFBHREFUQUJBU0U6IHBsYW5lCiAgICAgIFBPU1RHUkVTX1VTRVI6ICRTRVJWSUNFX1VTRVJfUE9TVEdSRVMKICAgICAgUE9TVEdSRVNfUEFTU1dPUkQ6ICRTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTCiAgICAgIFBPU1RHUkVTX0RCOiBwbGFuZQogICAgICBQT1NUR1JFU19QT1JUOiA1NDMyCiAgICAgIFBHREFUQTogL3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdwZ2RhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHBsYW5lLXJlZGlzOgogICAgaW1hZ2U6ICd2YWxrZXkvdmFsa2V5OjcuMi4xMS1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICBwbGFuZS1tcToKICAgIGltYWdlOiAncmFiYml0bXE6My4xMy42LW1hbmFnZW1lbnQtYWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIFJBQkJJVE1RX0hPU1Q6IHBsYW5lLW1xCiAgICAgIFJBQkJJVE1RX1BPUlQ6ICcke1JBQkJJVE1RX1BPUlQ6LTU2NzJ9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1VTRVI6ICcke1NFUlZJQ0VfVVNFUl9SQUJCSVRNUTotcGxhbmV9JwogICAgICBSQUJCSVRNUV9ERUZBVUxUX1BBU1M6ICcke1NFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVE6LXBsYW5lfScKICAgICAgUkFCQklUTVFfREVGQVVMVF9WSE9TVDogJyR7UkFCQklUTVFfVkhPU1Q6LXBsYW5lfScKICAgICAgUkFCQklUTVFfVkhPU1Q6ICcke1JBQkJJVE1RX1ZIT1NUOi1wbGFuZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdyYWJiaXRtcV9kYXRhOi92YXIvbGliL3JhYmJpdG1xJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdyYWJiaXRtcS1kaWFnbm9zdGljcyAtcSBjaGVja19wb3J0X2Nvbm5lY3Rpdml0eScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDYwcwogIHBsYW5lLW1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9leHBvcnQgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDkwIicKICAgIGVudmlyb25tZW50OgogICAgICBNSU5JT19ST09UX1VTRVI6ICRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgTUlOSU9fUk9PVF9QQVNTV09SRDogJFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ3VwbG9hZHM6L2V4cG9ydCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBtYwogICAgICAgIC0gcmVhZHkKICAgICAgICAtIGxvY2FsCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
         "tags": [
             "plane",
             "project-management",
@@ -4391,7 +4478,7 @@
         "category": "productivity",
         "logo": "svgs/plane.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-24T00:12:17+05:30",
+        "template_last_updated_at": "2026-10-15T22:51:15+02:00",
         "port": "80"
     },
     "plex": {
@@ -4671,7 +4758,7 @@
     "rabbitmq": {
         "documentation": "https://www.rabbitmq.com/documentation.html?utm_source=coolify.io",
         "slogan": "With tens of thousands of users, RabbitMQ is one of the most popular open source message brokers.",
-        "compose": "c2VydmljZXM6CiAgcmFiYml0bXE6CiAgICBpbWFnZTogJ3JhYmJpdG1xOjMtbWFuYWdlbWVudCcKICAgIGhvc3RuYW1lOiByYWJiaXRtcQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1JBQkJJVE1RXzE1NjcyCiAgICAgIC0gUkFCQklUTVFfREVGQVVMVF9VU0VSPSRTRVJWSUNFX1VTRVJfUkFCQklUTVEKICAgICAgLSBSQUJCSVRNUV9ERUZBVUxUX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVEKICAgICAgLSAnUE9SVD0ke1BPUlQ6LTU2NzJ9JwogICAgcG9ydHM6CiAgICAgIC0gJyR7UE9SVH06NTY3MicKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncmFiYml0bXEtZGlhZ25vc3RpY3MgLXEgcGluZycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDMwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAncmFiYml0bXEtZGF0YTovdmFyL2xpYi9yYWJiaXRtcS8nCg==",
+        "compose": "c2VydmljZXM6CiAgcmFiYml0bXE6CiAgICBpbWFnZTogJ3JhYmJpdG1xOjMtbWFuYWdlbWVudCcKICAgIGhvc3RuYW1lOiByYWJiaXRtcQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1JBQkJJVE1RXzE1NjcyCiAgICAgIC0gUkFCQklUTVFfREVGQVVMVF9VU0VSPSRTRVJWSUNFX1VTRVJfUkFCQklUTVEKICAgICAgLSBSQUJCSVRNUV9ERUZBVUxUX1BBU1M9JFNFUlZJQ0VfUEFTU1dPUkRfUkFCQklUTVEKICAgICAgLSAnUE9SVD0ke1BPUlQ6LTU2NzJ9JwogICAgcG9ydHM6CiAgICAgIC0gJyR7UE9SVH06NTY3MicKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncmFiYml0bXEtZGlhZ25vc3RpY3MgLXEgY2hlY2tfcG9ydF9jb25uZWN0aXZpdHknCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMjAKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JhYmJpdG1xLWRhdGE6L3Zhci9saWIvcmFiYml0bXEvJwo=",
         "tags": [
             "message broker",
             "message queue",
@@ -4723,7 +4810,7 @@
     "reactive-resume": {
         "documentation": "https://rxresu.me/?utm_source=coolify.io",
         "slogan": "A one-of-a-kind resume builder that keeps your privacy in mind.",
-        "compose": "c2VydmljZXM6CiAgcmVhY3RpdmUtcmVzdW1lOgogICAgaW1hZ2U6ICdhbXJ1dGhwaWxsYWkvcmVhY3RpdmUtcmVzdW1lOnY0LjMuNycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9SRUFDVElWRVJFU1VNRV8zMDAwCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9GUUROX1JFQUNUSVZFUkVTVU1FCiAgICAgIC0gJ1NUT1JBR0VfVVJMPSR7U0VSVklDRV9GUUROX01JTklPfS9kZWZhdWx0JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gQUNDRVNTX1RPS0VOX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF9BQ0NFU1NUT0tFTgogICAgICAtIFJFRlJFU0hfVE9LRU5fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEX1JFRlJFU0hUT0tFTgogICAgICAtIENIUk9NRV9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9DSFJPTUVUT0tFTgogICAgICAtICdDSFJPTUVfVVJMPXdzOi8vY2hyb21lOjMwMDAvY2hyb21lJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9yZWRpczo2Mzc5JwogICAgICAtIFNUT1JBR0VfRU5EUE9JTlQ9bWluaW8KICAgICAgLSBTVE9SQUdFX1BPUlQ9OTAwMAogICAgICAtIFNUT1JBR0VfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFNUT1JBR0VfQlVDS0VUPWRlZmF1bHQKICAgICAgLSBTVE9SQUdFX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIFNUT1JBR0VfU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIFNUT1JBR0VfVVNFX1NTTD1mYWxzZQogICAgICAtICdESVNBQkxFX1NJR05VUFM9JHtTRVJWSUNFX0RJU0FCTEVfU0lHTlVQUzotZmFsc2V9JwogICAgICAtICdESVNBQkxFX0VNQUlMX0FVVEg9JHtTRVJWSUNFX0RJU0FCTEVfRU1BSUxfQVVUSDotZmFsc2V9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwb3N0Z3JlcwogICAgICAtIG1pbmlvCiAgICAgIC0gY2hyb21lCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbm9kZQogICAgICAgIC0gJy1lJwogICAgICAgIC0gInJlcXVpcmUoJ2h0dHAnKS5nZXQoJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcsIHJlcyA9PiBwcm9jZXNzLmV4aXQocmVzLnN0YXR1c0NvZGUgPT09IDIwMCA/IDAgOiAxKSkub24oJ2Vycm9yJywgKCkgPT4gcHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIG1pbmlvOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Nvb2xsYWJzaW8vbWluaW86UkVMRUFTRS4yMDI1LTEwLTE1VDE3LTI5LTU1WicKICAgIGNvbW1hbmQ6ICdzZXJ2ZXIgL2RhdGEgLS1jb25zb2xlLWFkZHJlc3MgIjo5MDAxIicKICAgIGVudmlyb25tZW50OgogICAgICAtIE1JTklPX1NFUlZFUl9VUkw9JE1JTklPX1NFUlZFUl9VUkwKICAgICAgLSBNSU5JT19CUk9XU0VSX1JFRElSRUNUX1VSTD0kTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkwKICAgICAgLSBNSU5JT19ST09UX1VTRVI9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIE1JTklPX1JPT1RfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUlOSU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21pbmlvLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbWMKICAgICAgICAtIHJlYWR5CiAgICAgICAgLSBsb2NhbAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgY2hyb21lOgogICAgaW1hZ2U6ICdnaGNyLmlvL2Jyb3dzZXJsZXNzL2Nocm9tZTpsYXRlc3QnCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIEhFQUxUSD10cnVlCiAgICAgIC0gVElNRU9VVD0xMDAwMAogICAgICAtIENPTkNVUlJFTlQ9MTAKICAgICAgLSBUT0tFTj0kU0VSVklDRV9QQVNTV09SRF9DSFJPTUVUT0tFTgogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAvJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDNzCiAgICAgIHJldHJpZXM6IDUKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOiByZWRpcy1zZXJ2ZXIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzX2RhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAK",
+        "compose": "c2VydmljZXM6CiAgcmVhY3RpdmUtcmVzdW1lOgogICAgaW1hZ2U6ICdhbXJ1dGhwaWxsYWkvcmVhY3RpdmUtcmVzdW1lOnY0LjMuNycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9SRUFDVElWRVJFU1VNRV8zMDAwCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9GUUROX1JFQUNUSVZFUkVTVU1FCiAgICAgIC0gJ1NUT1JBR0VfVVJMPSR7U0VSVklDRV9GUUROX01JTklPfS9kZWZhdWx0JwogICAgICAtICdEQVRBQkFTRV9VUkw9cG9zdGdyZXNxbDovLyRTRVJWSUNFX1VTRVJfUE9TVEdSRVM6JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVNAcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gQUNDRVNTX1RPS0VOX1NFQ1JFVD0kU0VSVklDRV9QQVNTV09SRF9BQ0NFU1NUT0tFTgogICAgICAtIFJFRlJFU0hfVE9LRU5fU0VDUkVUPSRTRVJWSUNFX1BBU1NXT1JEX1JFRlJFU0hUT0tFTgogICAgICAtIENIUk9NRV9UT0tFTj0kU0VSVklDRV9QQVNTV09SRF9DSFJPTUVUT0tFTgogICAgICAtICdDSFJPTUVfVVJMPXdzOi8vY2hyb21lOjMwMDAvY2hyb21lJwogICAgICAtICdSRURJU19VUkw9cmVkaXM6Ly9yZWRpczo2Mzc5JwogICAgICAtIFNUT1JBR0VfRU5EUE9JTlQ9bWluaW8KICAgICAgLSBTVE9SQUdFX1BPUlQ9OTAwMAogICAgICAtIFNUT1JBR0VfUkVHSU9OPXVzLWVhc3QtMQogICAgICAtIFNUT1JBR0VfQlVDS0VUPWRlZmF1bHQKICAgICAgLSBTVE9SQUdFX0FDQ0VTU19LRVk9JFNFUlZJQ0VfVVNFUl9NSU5JTwogICAgICAtIFNUT1JBR0VfU0VDUkVUX0tFWT0kU0VSVklDRV9QQVNTV09SRF9NSU5JTwogICAgICAtIFNUT1JBR0VfVVNFX1NTTD1mYWxzZQogICAgICAtICdESVNBQkxFX1NJR05VUFM9JHtTRVJWSUNFX0RJU0FCTEVfU0lHTlVQUzotZmFsc2V9JwogICAgICAtICdESVNBQkxFX0VNQUlMX0FVVEg9JHtTRVJWSUNFX0RJU0FCTEVfRU1BSUxfQVVUSDotZmFsc2V9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwb3N0Z3JlcwogICAgICAtIG1pbmlvCiAgICAgIC0gY2hyb21lCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbm9kZQogICAgICAgIC0gJy1lJwogICAgICAgIC0gInJlcXVpcmUoJ2h0dHAnKS5nZXQoJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMCcsIHJlcyA9PiBwcm9jZXNzLmV4aXQocmVzLnN0YXR1c0NvZGUgPT09IDIwMCA/IDAgOiAxKSkub24oJ2Vycm9yJywgKCkgPT4gcHJvY2Vzcy5leGl0KDEpKSIKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gUE9TVEdSRVNfVVNFUj0kU0VSVklDRV9VU0VSX1BPU1RHUkVTCiAgICAgIC0gUE9TVEdSRVNfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVMKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3Bvc3RncmVzLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIG1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBjb21tYW5kOiAnc2VydmVyIC9kYXRhIC0tY29uc29sZS1hZGRyZXNzICI6OTAwMSInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBNSU5JT19TRVJWRVJfVVJMPSRNSU5JT19TRVJWRVJfVVJMCiAgICAgIC0gTUlOSU9fQlJPV1NFUl9SRURJUkVDVF9VUkw9JE1JTklPX0JST1dTRVJfUkVESVJFQ1RfVVJMCiAgICAgIC0gTUlOSU9fUk9PVF9VU0VSPSRTRVJWSUNFX1VTRVJfTUlOSU8KICAgICAgLSBNSU5JT19ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01JTklPCiAgICB2b2x1bWVzOgogICAgICAtICdtaW5pby1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIGNocm9tZToKICAgIGltYWdlOiAnZ2hjci5pby9icm93c2VybGVzcy9jaHJvbWU6bGF0ZXN0JwogICAgcGxhdGZvcm06IGxpbnV4L2FtZDY0CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIRUFMVEg9dHJ1ZQogICAgICAtIFRJTUVPVVQ9MTAwMDAKICAgICAgLSBDT05DVVJSRU5UPTEwCiAgICAgIC0gVE9LRU49JFNFUlZJQ0VfUEFTU1dPUkRfQ0hST01FVE9LRU4KICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTozMDAwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjctYWxwaW5lJwogICAgY29tbWFuZDogcmVkaXMtc2VydmVyCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpc19kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "reactive-resume",
             "resume-builder",
@@ -4891,7 +4978,7 @@
     "seafile": {
         "documentation": "https://manual.seafile.com?utm_source=coolify.io",
         "slogan": "Open source cloud storage system for file sync, share and document collaboration",
-        "compose": "c2VydmljZXM6CiAgc2VhZmlsZToKICAgIGltYWdlOiAnc2VhZmlsZWx0ZC9zZWFmaWxlLW1jOjEyLjAtbGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZmlsZS1kYXRhOi9zaGFyZWQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU0VBRklMRV84MAogICAgICAtICdTRUFGSUxFX1NFUlZFUl9IT1NUTkFNRT0ke1NFUlZJQ0VfRlFETl9TRUFGSUxFfScKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSAnREJfUk9PVF9QQVNTV0Q9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdTRUFGSUxFX01ZU1FMX0RCX0NDTkVUX0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX0NDTkVUX0RCX05BTUU6LWNjbmV0X2RifScKICAgICAgLSAnU0VBRklMRV9NWVNRTF9EQl9TRUFGSUxFX0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX1NFQUZJTEVfREJfTkFNRTotc2VhZmlsZV9kYn0nCiAgICAgIC0gJ1NFQUZJTEVfTVlTUUxfREJfU0VBSFVCX0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX1NFQUhVQl9EQl9OQU1FOi1zZWFodWJfZGJ9JwogICAgICAtICdUSU1FX1pPTkU9JHtUSU1FX1pPTkU6LVVUQ30nCiAgICAgIC0gJ0lOSVRfU0VBRklMRV9BRE1JTl9FTUFJTD0ke0lOSVRfU0VBRklMRV9BRE1JTl9FTUFJTDotdGVzdEBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ0lOSVRfU0VBRklMRV9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtIFNFQUZJTEVfU0VSVkVSX1BST1RPQ09MPWh0dHBzCiAgICAgIC0gJ1NJVEVfUk9PVD0ke1NJVEVfUk9PVDotL30nCiAgICAgIC0gJ05PTl9ST09UPSR7Tk9OX1JPT1Q6LWZhbHNlfScKICAgICAgLSAnSldUX1BSSVZBVEVfS0VZPSR7U0VSVklDRV9QQVNTV09SRF82NF9KV1R9JwogICAgICAtICdTRUFGSUxFX0xPR19UT19TVERPVVQ9JHtTRUFGSUxFX0xPR19UT19TVERPVVQ6LXRydWV9JwogICAgICAtICdGSUxFX1NFUlZFUl9ST09UPSR7U0VSVklDRV9GUUROX1NFQUZJTEV9L3NlYWZodHRwJwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBtZW1jYWNoZWQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX3N0YXJ0ZWQKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MC9hcGkyL3BpbmcnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDUKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZmlsZV9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LXNlYWZpbGUtZGJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiA1CiAgbWVtY2FjaGVkOgogICAgaW1hZ2U6ICdtZW1jYWNoZWQ6bGF0ZXN0JwogICAgZW50cnlwb2ludDogJ21lbWNhY2hlZCAtbSAyNTYnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2Jhc2ggLWMgImVjaG8gdmVyc2lvbiB8IChleGVjIDM8Pi9kZXYvdGNwL2xvY2FsaG9zdC8xMTIxMTsgY2F0ID4mMzsgdGltZW91dCAwLjUgY2F0IDwmMzsgZXhlYyAzPCYtKSInCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDUK",
+        "compose": "c2VydmljZXM6CiAgc2VhZmlsZToKICAgIGltYWdlOiAnc2VhZmlsZWx0ZC9zZWFmaWxlLW1jOjEyLjAtbGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZmlsZS1kYXRhOi9zaGFyZWQnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU0VBRklMRV84MAogICAgICAtICdTRUFGSUxFX1NFUlZFUl9IT1NUTkFNRT0ke1NFUlZJQ0VfRlFETl9TRUFGSUxFfScKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSAnREJfUk9PVF9QQVNTV0Q9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMUk9PVH0nCiAgICAgIC0gJ0RCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtICdTRUFGSUxFX01ZU1FMX0RCX0NDTkVUX0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX0NDTkVUX0RCX05BTUU6LWNjbmV0X2RifScKICAgICAgLSAnU0VBRklMRV9NWVNRTF9EQl9TRUFGSUxFX0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX1NFQUZJTEVfREJfTkFNRTotc2VhZmlsZV9kYn0nCiAgICAgIC0gJ1NFQUZJTEVfTVlTUUxfREJfU0VBSFVCX0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX1NFQUhVQl9EQl9OQU1FOi1zZWFodWJfZGJ9JwogICAgICAtICdUSU1FX1pPTkU9JHtUSU1FX1pPTkU6LVVUQ30nCiAgICAgIC0gJ0lOSVRfU0VBRklMRV9BRE1JTl9FTUFJTD0ke0lOSVRfU0VBRklMRV9BRE1JTl9FTUFJTDotdGVzdEBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ0lOSVRfU0VBRklMRV9BRE1JTl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfQURNSU59JwogICAgICAtIFNFQUZJTEVfU0VSVkVSX1BST1RPQ09MPWh0dHBzCiAgICAgIC0gJ1NJVEVfUk9PVD0ke1NJVEVfUk9PVDotL30nCiAgICAgIC0gJ05PTl9ST09UPSR7Tk9OX1JPT1Q6LWZhbHNlfScKICAgICAgLSAnSldUX1BSSVZBVEVfS0VZPSR7U0VSVklDRV9QQVNTV09SRF82NF9KV1R9JwogICAgICAtICdTRUFGSUxFX0xPR19UT19TVERPVVQ9JHtTRUFGSUxFX0xPR19UT19TVERPVVQ6LXRydWV9JwogICAgICAtICdGSUxFX1NFUlZFUl9ST09UPSR7U0VSVklDRV9GUUROX1NFQUZJTEV9L3NlYWZodHRwJwogICAgICAtICdFTkFCTEVfU0VBRE9DPSR7RU5BQkxFX1NFQURPQzotdHJ1ZX0nCiAgICAgIC0gJ1NFQURPQ19TRVJWRVJfVVJMPSR7U0VSVklDRV9GUUROX1NFQURPQ30nCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIG1lbWNhY2hlZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL2FwaTIvcGluZycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogNQogIHNlYWRvYzoKICAgIGltYWdlOiAnc2VhZmlsZWx0ZC9zZG9jLXNlcnZlcjoxLjAtbGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZG9jLWRhdGE6L3NoYXJlZCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9TRUFET0NfODAKICAgICAgLSBEQl9IT1NUPW1hcmlhZGIKICAgICAgLSBEQl9QT1JUPTMzMDYKICAgICAgLSAnREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ0RCX05BTUU9JHtTRUFGSUxFX01ZU1FMX0RCX1NFQUhVQl9EQl9OQU1FOi1zZWFodWJfZGJ9JwogICAgICAtICdUSU1FX1pPTkU9JHtUSU1FX1pPTkU6LVVUQ30nCiAgICAgIC0gJ0pXVF9QUklWQVRFX0tFWT0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfSldUfScKICAgICAgLSAnTk9OX1JPT1Q9JHtOT05fUk9PVDotZmFsc2V9JwogICAgICAtICdTRUFIVUJfU0VSVklDRV9GUUROPWh0dHA6Ly9zZWFmaWxlJwogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3BpbmcnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDUKICBtYXJpYWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnc2VhZmlsZV9tYXJpYWRiX2RhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUxST09UfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LXNlYWZpbGUtZGJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiA1CiAgbWVtY2FjaGVkOgogICAgaW1hZ2U6ICdtZW1jYWNoZWQ6bGF0ZXN0JwogICAgZW50cnlwb2ludDogJ21lbWNhY2hlZCAtbSAyNTYnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ2Jhc2ggLWMgImVjaG8gdmVyc2lvbiB8IChleGVjIDM8Pi9kZXYvdGNwL2xvY2FsaG9zdC8xMTIxMTsgY2F0ID4mMzsgdGltZW91dCAwLjUgY2F0IDwmMzsgZXhlYyAzPCYtKSInCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDUK",
         "tags": [
             "file-manager",
             "file-sharing",
@@ -5290,7 +5377,7 @@
     "supabase": {
         "documentation": "https://supabase.io?utm_source=coolify.io",
         "slogan": "The open source Firebase alternative.",
-        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NVUEFCQVNFS09OR184MDAwCiAgICAgIC0gJ0tPTkdfUE9SVF9NQVBTPTQ0Mzo4MDAwJwogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIEtPTkdfREFUQUJBU0U9b2ZmCiAgICAgIC0gS09OR19ERUNMQVJBVElWRV9DT05GSUc9L3Vzci9sb2NhbC9rb25nL2tvbmcueW1sCiAgICAgIC0gJ0tPTkdfRE5TX09SREVSPUxBU1QsQSxDTkFNRScKICAgICAgLSBLT05HX0ROU19OT1RfRk9VTkRfVFRMPTEKICAgICAgLSAnS09OR19QTFVHSU5TPXJlcXVlc3QtdHJhbnNmb3JtZXIsY29ycyxrZXktYXV0aCxhY2wsYmFzaWMtYXV0aCxyZXF1ZXN0LXRlcm1pbmF0aW9uLGlwLXJlc3RyaWN0aW9uLHBvc3QtZnVuY3Rpb24nCiAgICAgIC0gS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJfU0laRT0xNjBrCiAgICAgIC0gJ0tPTkdfTkdJTlhfUFJPWFlfUFJPWFlfQlVGRkVSUz02NCAxNjBrJwogICAgICAtICdLT05HX1BST1hZX0FDQ0VTU19MT0c9L2Rldi9zdGRvdXQgY29tYmluZWQnCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk9JHtTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk6LX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFQ1JFVF9LRVk9JHtTVVBBQkFTRV9TRUNSRVRfS0VZOi19JwogICAgICAtICdBTk9OX0tFWV9BU1lNTUVUUklDPSR7QU5PTl9LRVlfQVNZTU1FVFJJQzotfScKICAgICAgLSAnU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDPSR7U0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdEQVNIQk9BUkRfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdEQVNIQk9BUkRfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVQ6LTYwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVDotMzYwMH0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HPSR7S09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9ob21lL2tvbmcva29uZy1lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9iYXNoXG4jIEN1c3RvbSBlbnRyeXBvaW50IGZvciBLb25nIHRoYXQgYnVpbGRzIEx1YSBleHByZXNzaW9ucyBmb3IgcmVxdWVzdC10cmFuc2Zvcm1lclxuIyBhbmQgcGVyZm9ybXMgZW52aXJvbm1lbnQgdmFyaWFibGUgc3Vic3RpdHV0aW9uIGluIHRoZSBkZWNsYXJhdGl2ZSBjb25maWcuXG5cbmlmIFsgLW4gXCIkU1VQQUJBU0VfU0VDUkVUX0tFWVwiIF0gJiYgWyAtbiBcIiRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcIiBdOyB0aGVuXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJ0JlYXJlciAkU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKGhlYWRlcnMuYXBpa2V5ID09ICckU1VQQUJBU0VfUFVCTElTSEFCTEVfS0VZJyBhbmQgJ0JlYXJlciAkQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKChxdWVyeV9wYXJhbXMuYXBpa2V5ID09ICckU1VQQUJBU0VfU0VDUkVUX0tFWScgYW5kICckU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnJEFOT05fS0VZX0FTWU1NRVRSSUMnKSBvciBxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5lbHNlXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciBoZWFkZXJzLmFwaWtleSlcIlxuICAgIGV4cG9ydCBMVUFfUlRfV1NfRVhQUj1cIlxcJChxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5maVxuXG5hd2sgJ3tcbiAgcmVzdWx0ID0gXCJcIlxuICByZXN0ID0gJDBcbiAgd2hpbGUgKG1hdGNoKHJlc3QsIC9cXCRbQS1aYS16X11bQS1aYS16XzAtOV0qLykpIHtcbiAgICB2YXJuYW1lID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIDEsIFJMRU5HVEggLSAxKVxuICAgIGlmICh2YXJuYW1lIGluIEVOVklST04pIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUIC0gMSkgRU5WSVJPTlt2YXJuYW1lXVxuICAgIH0gZWxzZSB7XG4gICAgICByZXN1bHQgPSByZXN1bHQgc3Vic3RyKHJlc3QsIDEsIFJTVEFSVCArIFJMRU5HVEggLSAxKVxuICAgIH1cbiAgICByZXN0ID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIFJMRU5HVEgpXG4gIH1cbiAgcHJpbnQgcmVzdWx0IHJlc3Rcbn0nIC9ob21lL2tvbmcvdGVtcC55bWwgPiBcIiRLT05HX0RFQ0xBUkFUSVZFX0NPTkZJR1wiXG5cbnNlZCAtaSAnL15bWzpzcGFjZTpdXSotIGtleTpbWzpzcGFjZTpdXSokL2QnIFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuZXhlYyAvZW50cnlwb2ludC5zaCBrb25nIGRvY2tlci1zdGFydFxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLnltbAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy90ZW1wLnltbAogICAgICAgIGNvbnRlbnQ6ICJfZm9ybWF0X3ZlcnNpb246ICcyLjEnXG5fdHJhbnNmb3JtOiB0cnVlXG5cbiMjI1xuIyMjIENvbnN1bWVycyAvIFVzZXJzXG4jIyNcbmNvbnN1bWVyczpcbiAgLSB1c2VybmFtZTogREFTSEJPQVJEXG4gIC0gdXNlcm5hbWU6IGFub25cbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9BTk9OX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcbiAgLSB1c2VybmFtZTogc2VydmljZV9yb2xlXG4gICAga2V5YXV0aF9jcmVkZW50aWFsczpcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VSVklDRV9LRVlcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VDUkVUX0tFWVxuXG4jIyNcbiMjIyBBY2Nlc3MgQ29udHJvbCBMaXN0XG4jIyNcbmFjbHM6XG4gIC0gY29uc3VtZXI6IGFub25cbiAgICBncm91cDogYW5vblxuICAtIGNvbnN1bWVyOiBzZXJ2aWNlX3JvbGVcbiAgICBncm91cDogYWRtaW5cblxuIyMjXG4jIyMgRGFzaGJvYXJkIGNyZWRlbnRpYWxzXG4jIyNcbmJhc2ljYXV0aF9jcmVkZW50aWFsczpcbi0gY29uc3VtZXI6IERBU0hCT0FSRFxuICB1c2VybmFtZTogJyREQVNIQk9BUkRfVVNFUk5BTUUnXG4gIHBhc3N3b3JkOiAnJERBU0hCT0FSRF9QQVNTV09SRCdcblxuXG4jIyNcbiMjIyBBUEkgUm91dGVzXG4jIyNcbnNlcnZpY2VzOlxuXG4gICMjIE9wZW4gQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvdmVyaWZ5XG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL3ZlcmlmeVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tY2FsbGJhY2tcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvY2FsbGJhY2tcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvY2FsbGJhY2tcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9hdXRob3JpemVcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1hdXRob3JpemVcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL2F1dGhvcml6ZVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tandrc1xuICAgIF9jb21tZW50OiAnQXV0aDogL2F1dGgvdjEvLndlbGwta25vd24vandrcy5qc29uIC0+IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vandrcy5qc29uJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgIHVybDogXCJodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L3Nzby9zYW1sL2Fjc1wiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9hY3NcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvbWV0YWRhdGFcIlxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLXNzby1tZXRhZGF0YVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9tZXRhZGF0YVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBTZWN1cmUgQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxXG4gICAgX2NvbW1lbnQ6ICdHb1RydWU6IC9hdXRoL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIFJFU1Qgcm91dGVzXG4gIC0gbmFtZTogcmVzdC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvcmVzdC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZXN0LXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3Jlc3QvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgICAgICByZXBsYWNlOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBHcmFwaFFMIHJvdXRlc1xuICAtIG5hbWU6IGdyYXBocWwtdjFcbiAgICBfY29tbWVudDogJ1Bvc3RnUkVTVDogL2dyYXBocWwvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9ycGMvZ3JhcGhxbFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZ3JhcGhxbC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9ncmFwaHFsL3YxXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkNvbnRlbnQtUHJvZmlsZTogZ3JhcGhxbF9wdWJsaWNcIlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUmVhbHRpbWUgcm91dGVzXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtd3NcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvKiAtPiB3czovL3JlYWx0aW1lOjQwMDAvc29ja2V0LyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvc29ja2V0XG4gICAgcHJvdG9jb2w6IHdzXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBxdWVyeXN0cmluZzpcbiAgICAgICAgICAgICAgLSBcImFwaWtleTogJExVQV9SVF9XU19FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvYXBpLyogLT4gaHR0cDovL3JlYWx0aW1lOjQwMDAvYXBpLyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvYXBpXG4gICAgcHJvdG9jb2w6IGh0dHBcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9yZWFsdGltZS92MS9hcGlcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU3RvcmFnZSBBUEkgZW5kcG9pbnRcbiAgIyMgTm8ga2V5LWF1dGggLSBTMyBwcm90b2NvbCByZXF1ZXN0cyBkb24ndCBjYXJyeSBhbiBhcGlrZXkgaGVhZGVyLlxuICAtIG5hbWU6IHN0b3JhZ2UtdjFcbiAgICBfY29tbWVudDogJ1N0b3JhZ2U6IC9zdG9yYWdlL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXN0b3JhZ2U6NTAwMC8qJ1xuICAgIGNvbm5lY3RfdGltZW91dDogJEtPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVRcbiAgICB3cml0ZV90aW1lb3V0OiAkS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVRcbiAgICByZWFkX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogc3RvcmFnZS12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9zdG9yYWdlL3YxL1xuICAgICAgICByZXF1ZXN0X2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVFVRVNUX0JVRkZFUklOR1xuICAgICAgICByZXNwb25zZV9idWZmZXJpbmc6ICRLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBwb3N0LWZ1bmN0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhY2Nlc3M6XG4gICAgICAgICAgICAtIHxcbiAgICAgICAgICAgICAgbG9jYWwgYXV0aCA9IGtvbmcucmVxdWVzdC5nZXRfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBpZiBhdXRoID09IG5pbCBvciBhdXRoID09IFwiXCIgb3IgYXV0aDpmaW5kKFwiXiVzKiRcIikgdGhlblxuICAgICAgICAgICAgICAgIGtvbmcuc2VydmljZS5yZXF1ZXN0LmNsZWFyX2hlYWRlcihcImF1dGhvcml6YXRpb25cIilcbiAgICAgICAgICAgICAgZW5kXG5cbiAgIyMgRWRnZSBGdW5jdGlvbnMgcm91dGVzXG4gIC0gbmFtZTogZnVuY3Rpb25zLXYxXG4gICAgX2NvbW1lbnQ6ICdFZGdlIEZ1bmN0aW9uczogL2Z1bmN0aW9ucy92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtZWRnZS1mdW5jdGlvbnM6OTAwMC9cbiAgICByZWFkX3RpbWVvdXQ6IDE1MDAwMFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZnVuY3Rpb25zLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2Z1bmN0aW9ucy92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgIyMgT0F1dGggMi4wIEF1dGhvcml6YXRpb24gU2VydmVyIE1ldGFkYXRhIChSRkMgODQxNClcbiAgLSBuYW1lOiB3ZWxsLWtub3duLW9hdXRoXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXIgLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlcidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBBbmFseXRpY3Mgcm91dGVzXG4gICMjIE5vdCB1c2VkIC0gU3R1ZGlvIGFuZCBWZWN0b3IgdGFsayBkaXJlY3RseSB0byBhbmFseXRpY3MgdmlhIERvY2tlciBuZXR3b3JraW5nLlxuICAjIC0gbmFtZTogYW5hbHl0aWNzLXYxXG4gICMgICBfY29tbWVudDogJ0FuYWx5dGljczogL2FuYWx5dGljcy92MS8qIC0+IGh0dHA6Ly9sb2dmbGFyZTo0MDAwLyonXG4gICMgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9cbiAgIyAgIHJvdXRlczpcbiAgIyAgICAgLSBuYW1lOiBhbmFseXRpY3MtdjEtYWxsXG4gICMgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAjICAgICAgIHBhdGhzOlxuICAjICAgICAgICAgLSAvYW5hbHl0aWNzL3YxL1xuXG4gICMjIFNlY3VyZSBEYXRhYmFzZSByb3V0ZXNcbiAgLSBuYW1lOiBtZXRhXG4gICAgX2NvbW1lbnQ6ICdwZy1tZXRhOiAvcGcvKiAtPiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWV0YS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9wZy9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cblxuICAjIyBCbG9jayBhY2Nlc3MgdG8gL2FwaS9tY3BcbiAgLSBuYW1lOiBtY3AtYmxvY2tlclxuICAgIF9jb21tZW50OiAnQmxvY2sgZGlyZWN0IGFjY2VzcyB0byAvYXBpL21jcCdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3AtYmxvY2tlci1yb3V0ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2FwaS9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG5cbiAgIyMgTUNQIGVuZHBvaW50IC0gbG9jYWwgYWNjZXNzXG4gIC0gbmFtZTogbWNwXG4gICAgX2NvbW1lbnQ6ICdNQ1A6IC9tY3AgLT4gaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3AgKGxvY2FsIGFjY2VzcyknXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWNwXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvbWNwXG4gICAgcGx1Z2luczpcbiAgICAgICMgQmxvY2sgYWNjZXNzIHRvIC9tY3AgYnkgZGVmYXVsdFxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG4gICAgICAjIEVuYWJsZSBsb2NhbCBhY2Nlc3MgKGRhbmdlciB6b25lISlcbiAgICAgICMgMS4gQ29tbWVudCBvdXQgdGhlICdyZXF1ZXN0LXRlcm1pbmF0aW9uJyBzZWN0aW9uIGFib3ZlXG4gICAgICAjIDIuIFVuY29tbWVudCB0aGUgZW50aXJlIHNlY3Rpb24gYmVsb3csIGluY2x1ZGluZyAnZGVueSdcbiAgICAgICMgMy4gQWRkIHlvdXIgbG9jYWwgSVBzIHRvIHRoZSAnYWxsb3cnIGxpc3RcbiAgICAgICMtIG5hbWU6IGNvcnNcbiAgICAgICMtIG5hbWU6IGlwLXJlc3RyaWN0aW9uXG4gICAgICAjICBjb25maWc6XG4gICAgICAjICAgIGFsbG93OlxuICAgICAgIyAgICAgIC0gMTI3LjAuMC4xXG4gICAgICAjICAgICAgLSA6OjFcbiAgICAgICMgICAgZGVueTogW11cblxuICAjIyBQcm90ZWN0ZWQgRGFzaGJvYXJkIC0gY2F0Y2ggYWxsIHJlbWFpbmluZyByb3V0ZXNcbiAgLSBuYW1lOiBkYXNoYm9hcmRcbiAgICBfY29tbWVudDogJ1N0dWRpbzogLyogLT4gaHR0cDovL3N0dWRpbzozMDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBkYXNoYm9hcmQtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBiYXNpYy1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiB0cnVlXG4iCiAgc3VwYWJhc2Utc3R1ZGlvOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdHVkaW86MjAyNi4wMy4xNi1zaGEtNTUyODgxNycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAiZmV0Y2goJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMC9hcGkvcGxhdGZvcm0vcHJvZmlsZScpLnRoZW4oKHIpID0+IHtpZiAoci5zdGF0dXMgIT09IDIwMCkgdGhyb3cgbmV3IEVycm9yKHIuc3RhdHVzKX0pIgogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIT1NUTkFNRT0wLjAuMC4wCiAgICAgIC0gJ1NUVURJT19QR19NRVRBX1VSTD1odHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwJwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19IT1NUPSR7UE9TVEdSRVNfSE9TVDotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnUEdSU1RfREJfU0NIRU1BUz0ke1BHUlNUX0RCX1NDSEVNQVM6LXB1YmxpYyxzdG9yYWdlLGdyYXBocWxfcHVibGljfScKICAgICAgLSAnUEdSU1RfREJfTUFYX1JPV1M9JHtQR1JTVF9EQl9NQVhfUk9XUzotMTAwMH0nCiAgICAgIC0gJ1BHUlNUX0RCX0VYVFJBX1NFQVJDSF9QQVRIPSR7UEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg6LXB1YmxpY30nCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX05BTUU9JHtTVFVESU9fREVGQVVMVF9PUkdBTklaQVRJT046LURlZmF1bHQgT3JnYW5pemF0aW9ufScKICAgICAgLSAnREVGQVVMVF9QUk9KRUNUX05BTUU9JHtTVFVESU9fREVGQVVMVF9QUk9KRUNUOi1EZWZhdWx0IFByb2plY3R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdTVVBBQkFTRV9BTk9OX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VBTk9OX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFUlZJQ0VfS0VZPSR7U0VSVklDRV9TVVBBQkFTRVNFUlZJQ0VfS0VZfScKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdQR19NRVRBX0NSWVBUT19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1BHTUVUQUNSWVBUT30nCiAgICAgIC0gJ0xPR0ZMQVJFX0FQSV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgICAtICdMT0dGTEFSRV9QUklWQVRFX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkVQUklWQVRFfScKICAgICAgLSAnTE9HRkxBUkVfVVJMPWh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMCcKICAgICAgLSAnTkVYVF9QVUJMSUNfU1VQQUJBU0VfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZWFsdGltZVwiKSdcbiAgICAgIHN0b3JhZ2U6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1zdG9yYWdlXCIpJ1xuICAgICAgZnVuY3Rpb25zOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtZWRnZS1mdW5jdGlvbnNcIiknXG4gICAgICBkYjogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWRiXCIpJ1xuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcm91dGVyLmtvbmdcbiAgICBzb3VyY2U6IHwtXG4gICAgICByZXEsIGVyciA9IHBhcnNlX25naW54X2xvZyguZXZlbnRfbWVzc2FnZSwgXCJjb21iaW5lZFwiKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC50aW1lc3RhbXAgPSByZXEudGltZXN0YW1wXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5yZWZlcmVyID0gcmVxLnJlZmVyZXJcbiAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5oZWFkZXJzLnVzZXJfYWdlbnQgPSByZXEuYWdlbnRcbiAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5oZWFkZXJzLmNmX2Nvbm5lY3RpbmdfaXAgPSByZXEuY2xpZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlc3BvbnNlLnN0YXR1c19jb2RlID0gcmVxLnN0YXR1c1xuICAgICAgICAgIHVybCwgc3BsaXRfZXJyID0gc3BsaXQocmVxLnJlcXVlc3QsIFwiIFwiKVxuICAgICAgICAgIGlmIHNwbGl0X2VyciA9PSBudWxsIHtcbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QubWV0aG9kID0gdXJsWzBdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnBhdGggPSB1cmxbMV1cbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QucHJvdG9jb2wgPSB1cmxbMl1cbiAgICAgICAgICB9XG4gICAgICB9XG4gICAgICBpZiBlcnIgIT0gbnVsbCB7XG4gICAgICAgIGFib3J0XG4gICAgICB9XG4gICMgSWdub3JlcyBub24gbmdpbnggZXJyb3JzIHNpbmNlIHRoZXkgYXJlIHJlbGF0ZWQgd2l0aCBrb25nIGJvb3RpbmcgdXBcbiAga29uZ19lcnI6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgLm1ldGFkYXRhLnJlcXVlc3QubWV0aG9kID0gXCJHRVRcIlxuICAgICAgLm1ldGFkYXRhLnJlc3BvbnNlLnN0YXR1c19jb2RlID0gMjAwXG4gICAgICBwYXJzZWQsIGVyciA9IHBhcnNlX25naW54X2xvZyguZXZlbnRfbWVzc2FnZSwgXCJlcnJvclwiKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZWQudGltZXN0YW1wXG4gICAgICAgICAgLnNldmVyaXR5ID0gcGFyc2VkLnNldmVyaXR5XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaG9zdCA9IHBhcnNlZC5ob3N0XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcGFyc2VkLmNsaWVudFxuICAgICAgICAgIHVybCwgZXJyID0gc3BsaXQocGFyc2VkLnJlcXVlc3QsIFwiIFwiKVxuICAgICAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QubWV0aG9kID0gdXJsWzBdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnBhdGggPSB1cmxbMV1cbiAgICAgICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QucHJvdG9jb2wgPSB1cmxbMl1cbiAgICAgICAgICB9XG4gICAgICB9XG4gICAgICBpZiBlcnIgIT0gbnVsbCB7XG4gICAgICAgIGFib3J0XG4gICAgICB9XG4gICMgR290cnVlIGxvZ3MgYXJlIHN0cnVjdHVyZWQganNvbiBzdHJpbmdzIHdoaWNoIGZyb250ZW5kIHBhcnNlcyBkaXJlY3RseS4gQnV0IHdlIGtlZXAgbWV0YWRhdGEgZm9yIGNvbnNpc3RlbmN5LlxuICBhdXRoX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5hdXRoXG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9qc29uKC5ldmVudF9tZXNzYWdlKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5tZXRhZGF0YS50aW1lc3RhbXAgPSBwYXJzZWQudGltZVxuICAgICAgICAgIC5tZXRhZGF0YSA9IG1lcmdlISgubWV0YWRhdGEsIHBhcnNlZClcbiAgICAgIH1cbiAgIyBQb3N0Z1JFU1QgbG9ncyBhcmUgc3RydWN0dXJlZCBzbyB3ZSBzZXBhcmF0ZSB0aW1lc3RhbXAgZnJvbSBtZXNzYWdlIHVzaW5nIHJlZ2V4XG4gIHJlc3RfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcm91dGVyLnJlc3RcbiAgICBzb3VyY2U6IHwtXG4gICAgICBwYXJzZWQsIGVyciA9IHBhcnNlX3JlZ2V4KC5ldmVudF9tZXNzYWdlLCByJ14oP1A8dGltZT4uKik6ICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLnRpbWVzdGFtcCA9IHBhcnNlX3RpbWVzdGFtcCEodmFsdWU6IHBhcnNlZC50aW1lLCBmb3JtYXQ6IFwiJWQvJWIvJVk6JUg6JU06JVMgJXpcIilcbiAgICAgICAgICAubWV0YWRhdGEuaG9zdCA9IC5wcm9qZWN0XG4gICAgICB9XG4gICMgRmlsdGVyIG91dCBoZWFsdGhjaGVjayBsb2dzIGZyb20gUmVhbHRpbWVcbiAgcmVhbHRpbWVfbG9nc19maWx0ZXJlZDpcbiAgICB0eXBlOiBmaWx0ZXJcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZWFsdGltZVxuICAgIGNvbmRpdGlvbjogJyFjb250YWlucyhzdHJpbmchKC5ldmVudF9tZXNzYWdlKSwgXCIvaGVhbHRoXCIpJ1xuICAjIFJlYWx0aW1lIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2UgcGFyc2UgdGhlIHNldmVyaXR5IGxldmVsIHVzaW5nIHJlZ2V4IChpZ25vcmUgdGltZSBiZWNhdXNlIGl0IGhhcyBubyBkYXRlKVxuICByZWFsdGltZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByZWFsdGltZV9sb2dzX2ZpbHRlcmVkXG4gICAgc291cmNlOiB8LVxuICAgICAgLm1ldGFkYXRhLnByb2plY3QgPSBkZWwoLnByb2plY3QpXG4gICAgICAubWV0YWRhdGEuZXh0ZXJuYWxfaWQgPSAubWV0YWRhdGEucHJvamVjdFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+XFxkKzpcXGQrOlxcZCtcXC5cXGQrKSBcXFsoP1A8bGV2ZWw+XFx3KylcXF0gKD9QPG1zZz4uKikkJylcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgIH1cbiAgIyBTdG9yYWdlIGxvZ3MgbWF5IGNvbnRhaW4ganNvbiBvYmplY3RzIHNvIHdlIHBhcnNlIHRoZW0gZm9yIGNvbXBsZXRlbmVzc1xuICBzdG9yYWdlX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5zdG9yYWdlXG4gICAgc291cmNlOiB8LVxuICAgICAgLm1ldGFkYXRhLnByb2plY3QgPSBkZWwoLnByb2plY3QpXG4gICAgICAubWV0YWRhdGEudGVuYW50SWQgPSAubWV0YWRhdGEucHJvamVjdFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9qc29uKC5ldmVudF9tZXNzYWdlKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC5tZXRhZGF0YS5sZXZlbCA9IHBhcnNlZC5sZXZlbFxuICAgICAgICAgIC5tZXRhZGF0YS50aW1lc3RhbXAgPSBwYXJzZWQudGltZVxuICAgICAgICAgIC5tZXRhZGF0YS5jb250ZXh0WzBdLmhvc3QgPSBwYXJzZWQuaG9zdG5hbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5waWQgPSBwYXJzZWQucGlkXG4gICAgICB9XG4gICMgRnVuY3Rpb24gbG9ncyBhcmUgdW5zdHJ1Y3R1cmVkIG1lc3NhZ2VzIG9uIHN0ZGVyclxuICBmdW5jdGlvbnNfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcm91dGVyLmZ1bmN0aW9uc1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0X3JlZiA9IGRlbCgucHJvamVjdClcbiAgIyBQb3N0Z3JlcyBsb2dzIHNvbWUgbWVzc2FnZXMgdG8gc3RkZXJyIHdoaWNoIHdlIG1hcCB0byB3YXJuaW5nIHNldmVyaXR5IGxldmVsXG4gIGRiX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5kYlxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5ob3N0ID0gXCJkYi1kZWZhdWx0XCJcbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQudGltZXN0YW1wID0gLnRpbWVzdGFtcFxuXG4gICAgICBwYXJzZWQsIGVyciA9IHBhcnNlX3JlZ2V4KC5ldmVudF9tZXNzYWdlLCByJy4qKD9QPGxldmVsPklORk98Tk9USUNFfFdBUk5JTkd8RVJST1J8TE9HfEZBVEFMfFBBTklDPyk6LionLCBudW1lcmljX2dyb3VwczogdHJ1ZSlcblxuICAgICAgaWYgZXJyICE9IG51bGwgfHwgcGFyc2VkID09IG51bGwge1xuICAgICAgICAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID0gXCJpbmZvXCJcbiAgICAgIH1cbiAgICAgIGlmIHBhcnNlZC5sZXZlbCAhPSBudWxsIHtcbiAgICAgICAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICAgICBpZiAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID09IFwiaW5mb1wiIHtcbiAgICAgICAgICAubWV0YWRhdGEucGFyc2VkLmVycm9yX3NldmVyaXR5ID0gXCJsb2dcIlxuICAgICAgfVxuICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHVwY2FzZSEoLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSlcblxuc2lua3M6XG4gIGxvZ2ZsYXJlX2F1dGg6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBhdXRoX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPWdvdHJ1ZS5sb2dzLnByb2QnXG4gIGxvZ2ZsYXJlX3JlYWx0aW1lOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cmVhbHRpbWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZXN0OlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gcmVzdF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z1JFU1QubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9kYjpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIGRiX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXBvc3RncmVzLmxvZ3MnXG4gIGxvZ2ZsYXJlX2Z1bmN0aW9uczpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIGZ1bmN0aW9uc19sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1kZW5vLXJlbGF5LWxvZ3MnXG4gIGxvZ2ZsYXJlX3N0b3JhZ2U6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBzdG9yYWdlX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXN0b3JhZ2UubG9ncy5wcm9kLjInXG4gIGxvZ2ZsYXJlX2tvbmc6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBrb25nX2xvZ3NcbiAgICAgIC0ga29uZ19lcnJcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPWNsb3VkZmxhcmUubG9ncy5wcm9kJ1xuIgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jazpybycKICAgIGVudmlyb25tZW50OgogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICBjb21tYW5kOgogICAgICAtICctLWNvbmZpZycKICAgICAgLSAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgc3VwYWJhc2UtcmVzdDoKICAgIGltYWdlOiAncG9zdGdyZXN0L3Bvc3RncmVzdDp2MTQuNicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BHUlNUX0RCX1VSST1wb3N0Z3JlczovL2F1dGhlbnRpY2F0b3I6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BHUlNUX0RCX1NDSEVNQVM9JHtQR1JTVF9EQl9TQ0hFTUFTOi1wdWJsaWMsc3RvcmFnZSxncmFwaHFsX3B1YmxpY30nCiAgICAgIC0gJ1BHUlNUX0RCX01BWF9ST1dTPSR7UEdSU1RfREJfTUFYX1JPV1M6LTEwMDB9JwogICAgICAtICdQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSD0ke1BHUlNUX0RCX0VYVFJBX1NFQVJDSF9QQVRIOi1wdWJsaWN9JwogICAgICAtIFBHUlNUX0RCX0FOT05fUk9MRT1hbm9uCiAgICAgIC0gJ1BHUlNUX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gUEdSU1RfREJfVVNFX0xFR0FDWV9HVUNTPWZhbHNlCiAgICAgIC0gJ1BHUlNUX0FQUF9TRVRUSU5HU19KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgY29tbWFuZDogcG9zdGdyZXN0CiAgICBleGNsdWRlX2Zyb21faGM6IHRydWUKICBzdXBhYmFzZS1hdXRoOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9nb3RydWU6djIuMTg2LjAnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLS1uby12ZXJib3NlJwogICAgICAgIC0gJy0tdHJpZXM9MScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjk5OTkvaGVhbHRoJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gR09UUlVFX0FQSV9IT1NUPTAuMC4wLjAKICAgICAgLSBHT1RSVUVfQVBJX1BPUlQ9OTk5OQogICAgICAtICdBUElfRVhURVJOQUxfVVJMPSR7QVBJX0VYVEVSTkFMX1VSTDotaHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMH0nCiAgICAgIC0gR09UUlVFX0RCX0RSSVZFUj1wb3N0Z3JlcwogICAgICAtICdHT1RSVUVfREJfREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vc3VwYWJhc2VfYXV0aF9hZG1pbjoke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QCR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifToke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9LyR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnR09UUlVFX1NJVEVfVVJMPSR7R09UUlVFX1NJVEVfVVJMOi0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9fScKICAgICAgLSAnR09UUlVFX1VSSV9BTExPV19MSVNUPSR7QURESVRJT05BTF9SRURJUkVDVF9VUkxTfScKICAgICAgLSAnR09UUlVFX0RJU0FCTEVfU0lHTlVQPSR7RElTQUJMRV9TSUdOVVA6LWZhbHNlfScKICAgICAgLSBHT1RSVUVfSldUX0FETUlOX1JPTEVTPXNlcnZpY2Vfcm9sZQogICAgICAtIEdPVFJVRV9KV1RfQVVEPWF1dGhlbnRpY2F0ZWQKICAgICAgLSBHT1RSVUVfSldUX0RFRkFVTFRfR1JPVVBfTkFNRT1hdXRoZW50aWNhdGVkCiAgICAgIC0gJ0dPVFJVRV9KV1RfRVhQPSR7SldUX0VYUElSWTotMzYwMH0nCiAgICAgIC0gJ0dPVFJVRV9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfRU1BSUxfRU5BQkxFRD0ke0VOQUJMRV9FTUFJTF9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfQU5PTllNT1VTX1VTRVJTX0VOQUJMRUQ9JHtFTkFCTEVfQU5PTllNT1VTX1VTRVJTOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfQVVUT0NPTkZJUk09JHtFTkFCTEVfRU1BSUxfQVVUT0NPTkZJUk06LWZhbHNlfScKICAgICAgLSAnR09UUlVFX1NNVFBfQURNSU5fRU1BSUw9JHtTTVRQX0FETUlOX0VNQUlMfScKICAgICAgLSAnR09UUlVFX1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1BPUlQ9JHtTTVRQX1BPUlQ6LTU4N30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1VTRVI9JHtTTVRQX1VTRVJ9JwogICAgICAtICdHT1RSVUVfU01UUF9QQVNTPSR7U01UUF9QQVNTfScKICAgICAgLSAnR09UUlVFX1NNVFBfU0VOREVSX05BTUU9JHtTTVRQX1NFTkRFUl9OQU1FfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19JTlZJVEU9JHtNQUlMRVJfVVJMUEFUSFNfSU5WSVRFOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT046LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk9JHtNQUlMRVJfVVJMUEFUSFNfUkVDT1ZFUlk6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfSU5WSVRFPSR7TUFJTEVSX1RFTVBMQVRFU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT049JHtNQUlMRVJfVEVNUExBVEVTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX1JFQ09WRVJZPSR7TUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTks9JHtNQUlMRVJfVEVNUExBVEVTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0U9JHtNQUlMRVJfVEVNUExBVEVTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTn0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUlk9JHtNQUlMRVJfU1VCSkVDVFNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTks9JHtNQUlMRVJfU1VCSkVDVFNfTUFHSUNfTElOS30nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfU1VCSkVDVFNfSU5WSVRFPSR7TUFJTEVSX1NVQkpFQ1RTX0lOVklURX0nCiAgICAgIC0gJ0dPVFJVRV9FWFRFUk5BTF9QSE9ORV9FTkFCTEVEPSR7RU5BQkxFX1BIT05FX1NJR05VUDotdHJ1ZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVNfQVVUT0NPTkZJUk09JHtFTkFCTEVfUEhPTkVfQVVUT0NPTkZJUk06LXRydWV9JwogIHJlYWx0aW1lLWRldjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcmVhbHRpbWU6djIuNzYuNScKICAgIGNvbnRhaW5lcl9uYW1lOiByZWFsdGltZS1kZXYuc3VwYWJhc2UtcmVhbHRpbWUKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctc1NmTCcKICAgICAgICAtICctLWhlYWQnCiAgICAgICAgLSAnLW8nCiAgICAgICAgLSAvZGV2L251bGwKICAgICAgICAtICctSCcKICAgICAgICAtICdBdXRob3JpemF0aW9uOiBCZWFyZXIgJHtTRVJWSUNFX1NVUEFCQVNFQU5PTl9LRVl9JwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9hcGkvdGVuYW50cy9yZWFsdGltZS1kZXYvaGVhbHRoJwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9SVD00MDAwCiAgICAgIC0gJ0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdEQl9QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gREJfVVNFUj1zdXBhYmFzZV9hZG1pbgogICAgICAtICdEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnREJfQUZURVJfQ09OTkVDVF9RVUVSWT1TRVQgc2VhcmNoX3BhdGggVE8gX3JlYWx0aW1lJwogICAgICAtIERCX0VOQ19LRVk9c3VwYWJhc2VyZWFsdGltZQogICAgICAtICdBUElfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnU0VDUkVUX0tFWV9CQVNFPSR7U0VDUkVUX1BBU1NXT1JEX1JFQUxUSU1FfScKICAgICAgLSAnTUVUUklDU19KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdFUkxfQUZMQUdTPS1wcm90b19kaXN0IGluZXRfdGNwJwogICAgICAtICJETlNfTk9ERVM9JyciCiAgICAgIC0gUkxJTUlUX05PRklMRT0xMDAwMAogICAgICAtIEFQUF9OQU1FPXJlYWx0aW1lCiAgICAgIC0gU0VFRF9TRUxGX0hPU1Q9dHJ1ZQogICAgICAtIExPR19MRVZFTD1lcnJvcgogICAgICAtIFJVTl9KQU5JVE9SPXRydWUKICAgICAgLSBKQU5JVE9SX0lOVEVSVkFMPTYwMDAwCiAgICAgIC0gRElTQUJMRV9IRUFMVEhDSEVDS19MT0dHSU5HPXRydWUKICAgIGNvbW1hbmQ6ICJzaCAtYyBcIi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vcmVhbHRpbWUgZXZhbCAnUmVhbHRpbWUuUmVsZWFzZS5zZWVkcyhSZWFsdGltZS5SZXBvKScgJiYgL2FwcC9iaW4vc2VydmVyXCJcbiIKICBzdXBhYmFzZS1taW5pbzoKICAgIGltYWdlOiAnZ2hjci5pby9jb29sbGFic2lvL21pbmlvOlJFTEVBU0UuMjAyNS0xMC0xNVQxNy0yOS01NVonCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgY29tbWFuZDogJ3NlcnZlciAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiIC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3N0b3JhZ2U6L2RhdGEnCiAgbWluaW8tY3JlYXRlYnVja2V0OgogICAgaW1hZ2U6IG1pbmlvL21jCiAgICByZXN0YXJ0OiAnbm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuL3Vzci9iaW4vbWMgYWxpYXMgc2V0IHN1cGFiYXNlLW1pbmlvIGh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwICR7TUlOSU9fUk9PVF9VU0VSfSAke01JTklPX1JPT1RfUEFTU1dPUkR9O1xuL3Vzci9iaW4vbWMgbWIgLS1pZ25vcmUtZXhpc3Rpbmcgc3VwYWJhc2UtbWluaW8vc3R1YjtcbmV4aXQgMFxuIgogIHN1cGFiYXNlLXN0b3JhZ2U6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0b3JhZ2UtYXBpOnYxLjQ0LjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1yZXN0OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICAgIGltZ3Byb3h5OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo1MDAwL3N0YXR1cycKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZFUl9QT1JUPTUwMDAKICAgICAgLSBTRVJWRVJfUkVHSU9OPWxvY2FsCiAgICAgIC0gTVVMVElfVEVOQU5UPWZhbHNlCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vc3VwYWJhc2Vfc3RvcmFnZV9hZG1pbjoke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QCR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifToke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9LyR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBEQl9JTlNUQUxMX1JPTEVTPWZhbHNlCiAgICAgIC0gU1RPUkFHRV9CQUNLRU5EPXMzCiAgICAgIC0gU1RPUkFHRV9TM19CVUNLRVQ9c3R1YgogICAgICAtICdTVE9SQUdFX1MzX0VORFBPSU5UPWh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwJwogICAgICAtIFNUT1JBR0VfUzNfRk9SQ0VfUEFUSF9TVFlMRT10cnVlCiAgICAgIC0gU1RPUkFHRV9TM19SRUdJT049dXMtZWFzdC0xCiAgICAgIC0gJ0FXU19BQ0NFU1NfS0VZX0lEPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gVVBMT0FEX0ZJTEVfU0laRV9MSU1JVD01MjQyODgwMDAKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUX1NUQU5EQVJEPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9TSUdORURfVVJMX0VYUElSQVRJT05fVElNRT0xMjAKICAgICAgLSBUVVNfVVJMX1BBVEg9L3VwbG9hZC9yZXN1bWFibGUKICAgICAgLSBUVVNfTUFYX1NJWkU9MzYwMDAwMAogICAgICAtIEVOQUJMRV9JTUFHRV9UUkFOU0ZPUk1BVElPTj10cnVlCiAgICAgIC0gJ0lNR1BST1hZX1VSTD1odHRwOi8vaW1ncHJveHk6ODA4MCcKICAgICAgLSBJTUdQUk9YWV9SRVFVRVNUX1RJTUVPVVQ9MTUKICAgICAgLSBEQVRBQkFTRV9TRUFSQ0hfUEFUSD1zdG9yYWdlCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFJFUVVFU1RfQUxMT1dfWF9GT1JXQVJERURfUEFUSD10cnVlCiAgICAgIC0gJ0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdQT1NUR1JFU1RfVVJMPWh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAnCiAgICAgIC0gJ1BHUlNUX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NUT1JBR0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdURU5BTlRfSUQ9JHtTVE9SQUdFX1RFTkFOVF9JRDotc3RvcmFnZS1zaW5nbGUtdGVuYW50fScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgaW1ncHJveHk6CiAgICBpbWFnZTogJ2RhcnRoc2ltL2ltZ3Byb3h5OnYzLjMwLjEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaW1ncHJveHkKICAgICAgICAtIGhlYWx0aAogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0lNR1BST1hZX0JJTkQ9OjgwODAnCiAgICAgIC0gSU1HUFJPWFlfTE9DQUxfRklMRVNZU1RFTV9ST09UPS8KICAgICAgLSBJTUdQUk9YWV9VU0VfRVRBRz10cnVlCiAgICAgIC0gJ0lNR1BST1hZX0FVVE9fV0VCUD0ke0lNR1BST1hZX0FVVE9fV0VCUDotdHJ1ZX0nCiAgICAgIC0gSU1HUFJPWFlfTUFYX1NSQ19SRVNPTFVUSU9OPTE2LjgKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgc3VwYWJhc2UtbWV0YToKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXMtbWV0YTp2MC45NS4yJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQR19NRVRBX1BPUlQ9ODA4MAogICAgICAtICdQR19NRVRBX0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQR19NRVRBX0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUEdfTUVUQV9EQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBQR19NRVRBX0RCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnUEdfTUVUQV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdDUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogIHN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9lZGdlLXJ1bnRpbWU6djEuNzEuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdFZGdlIEZ1bmN0aW9ucyBpcyBoZWFsdGh5JwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvaGVsbG8vaW5kZXgudHMKICAgICAgICBjb250ZW50OiAiLy8gRm9sbG93IHRoaXMgc2V0dXAgZ3VpZGUgdG8gaW50ZWdyYXRlIHRoZSBEZW5vIGxhbmd1YWdlIHNlcnZlciB3aXRoIHlvdXIgZWRpdG9yOlxuLy8gaHR0cHM6Ly9kZW5vLmxhbmQvbWFudWFsL2dldHRpbmdfc3RhcnRlZC9zZXR1cF95b3VyX2Vudmlyb25tZW50XG4vLyBUaGlzIGVuYWJsZXMgYXV0b2NvbXBsZXRlLCBnbyB0byBkZWZpbml0aW9uLCBldGMuXG5cbkRlbm8uc2VydmUoYXN5bmMgKCkgPT4ge1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKFxuICAgIGBcIkhlbGxvIGZyb20gRWRnZSBGdW5jdGlvbnMhXCJgLFxuICAgIHsgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9IH0sXG4gIClcbn0pXG5cbi8vIFRvIGludm9rZTpcbi8vIGN1cmwgJ2h0dHA6Ly9sb2NhbGhvc3Q6PEtPTkdfSFRUUF9QT1JUPi9mdW5jdGlvbnMvdjEvaGVsbG8nIFxcXG4vLyAgIC0taGVhZGVyICdBdXRob3JpemF0aW9uOiBCZWFyZXIgPGFub24vc2VydmljZV9yb2xlIEFQSSBrZXk+J1xuIgogICAgY29tbWFuZDoKICAgICAgLSBzdGFydAogICAgICAtICctLW1haW4tc2VydmljZScKICAgICAgLSAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9tYWluCiAgc3VwYWJhc2Utc3VwYXZpc29yOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdXBhdmlzb3I6Mi43LjQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9PTEVSX1RFTkFOVF9JRD0ke1BPT0xFUl9URU5BTlRfSUQ6LWRldl90ZW5hbnR9JwogICAgICAtIFBPT0xFUl9QT09MX01PREU9dHJhbnNhY3Rpb24KICAgICAgLSAnUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFPSR7UE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFOi0yMH0nCiAgICAgIC0gJ1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk49JHtQT09MRVJfTUFYX0NMSUVOVF9DT05OOi0xMDB9JwogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1ROQU1FPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9ZWN0bzovL3N1cGFiYXNlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vX3N1cGFiYXNlJwogICAgICAtIENMVVNURVJfUE9TVEdSRVM9dHJ1ZQogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRVJWSUNFX1BBU1NXT1JEX1NVUEFWSVNPUlNFQ1JFVH0nCiAgICAgIC0gJ1ZBVUxUX0VOQ19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1ZBVUxURU5DfScKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSBSRUdJT049bG9jYWwKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAnREJfUE9PTF9TSVpFPSR7UE9PTEVSX0RCX1BPT0xfU0laRTotNX0nCiAgICAgIC0gR0xPQkFMX0RPV05TVFJFQU1fQ0VSVF9QQVRIPS9ldGMvc3NsL3NlcnZlci5jcnQKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9LRVlfUEFUSD0vZXRjL3NzbC9zZXJ2ZXIua2V5CiAgICBjb21tYW5kOgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICAgIC0gImlmIFsgISAtZiAvZXRjL3NzbC9zZXJ2ZXIuY3J0IF07IHRoZW5cbiAgb3BlbnNzbCByZXEgLXg1MDkgLW5vZGVzIC1kYXlzIDM2NTAgLW5ld2tleSByc2E6MjA0OCBcXFxuICAgIC1rZXlvdXQgL2V0Yy9zc2wvc2VydmVyLmtleSAtb3V0IC9ldGMvc3NsL3NlcnZlci5jcnQgXFxcbiAgICAtc3ViaiBcIi9DTj1zdXBhYmFzZS1wb29sZXJcIlxuZmlcbi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vc3VwYXZpc29yIGV2YWwgXCIkJChjYXQgL2V0Yy9wb29sZXIvcG9vbGVyLmV4cylcIiAmJiAvYXBwL2Jpbi9zZXJ2ZXJcbiIKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICB0YXJnZXQ6IC9ldGMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICBjb250ZW50OiAiezpvaywgX30gPSBBcHBsaWNhdGlvbi5lbnN1cmVfYWxsX3N0YXJ0ZWQoOnN1cGF2aXNvcilcbns6b2ssIHZlcnNpb259ID1cbiAgICBjYXNlIFN1cGF2aXNvci5SZXBvLnF1ZXJ5IShcInNlbGVjdCB2ZXJzaW9uKClcIikgZG9cbiAgICAle3Jvd3M6IFtbdmVyXV19IC0+IFN1cGF2aXNvci5IZWxwZXJzLnBhcnNlX3BnX3ZlcnNpb24odmVyKVxuICAgIF8gLT4gbmlsXG4gICAgZW5kXG5wYXJhbXMgPSAle1xuICAgIFwiZXh0ZXJuYWxfaWRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9URU5BTlRfSURcIiksXG4gICAgXCJkYl9ob3N0XCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19IT1NUTkFNRVwiKSxcbiAgICBcImRiX3BvcnRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BPUlRcIikgfD4gU3RyaW5nLnRvX2ludGVnZXIoKSxcbiAgICBcImRiX2RhdGFiYXNlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19EQlwiKSxcbiAgICBcInJlcXVpcmVfdXNlclwiID0+IGZhbHNlLFxuICAgIFwiYXV0aF9xdWVyeVwiID0+IFwiU0VMRUNUICogRlJPTSBwZ2JvdW5jZXIuZ2V0X2F1dGgoJDEpXCIsXG4gICAgXCJkZWZhdWx0X21heF9jbGllbnRzXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfTUFYX0NMSUVOVF9DT05OXCIpLFxuICAgIFwiZGVmYXVsdF9wb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImRlZmF1bHRfcGFyYW1ldGVyX3N0YXR1c1wiID0+ICV7XCJzZXJ2ZXJfdmVyc2lvblwiID0+IHZlcnNpb259LFxuICAgIFwidXNlcnNcIiA9PiBbJXtcbiAgICBcImRiX3VzZXJcIiA9PiBcInBnYm91bmNlclwiLFxuICAgIFwiZGJfcGFzc3dvcmRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BBU1NXT1JEXCIpLFxuICAgIFwibW9kZV90eXBlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfUE9PTF9NT0RFXCIpLFxuICAgIFwicG9vbF9zaXplXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfREVGQVVMVF9QT09MX1NJWkVcIiksXG4gICAgXCJpc19tYW5hZ2VyXCIgPT4gdHJ1ZVxuICAgIH1dXG59XG5cbnRlbmFudCA9IFN1cGF2aXNvci5UZW5hbnRzLmdldF90ZW5hbnRfYnlfZXh0ZXJuYWxfaWQocGFyYW1zW1wiZXh0ZXJuYWxfaWRcIl0pXG5cbmlmIHRlbmFudCBkb1xuICB7Om9rLCBffSA9IFN1cGF2aXNvci5UZW5hbnRzLnVwZGF0ZV90ZW5hbnQodGVuYW50LCBwYXJhbXMpXG5lbHNlXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMuY3JlYXRlX3RlbmFudChwYXJhbXMpXG5lbmRcbiIK",
+        "compose": "c2VydmljZXM6CiAgc3VwYWJhc2Uta29uZzoKICAgIGltYWdlOiAna29uZy9rb25nOjMuOS4xJwogICAgZW50cnlwb2ludDogL2hvbWUva29uZy9rb25nLWVudHJ5cG9pbnQuc2gKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGtvbmcKICAgICAgICAtIGhlYWx0aAogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1NVUEFCQVNFS09OR184MDAwCiAgICAgIC0gJ0tPTkdfUE9SVF9NQVBTPTQ0Mzo4MDAwJwogICAgICAtICdKV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIEtPTkdfREFUQUJBU0U9b2ZmCiAgICAgIC0gS09OR19ERUNMQVJBVElWRV9DT05GSUc9L3Vzci9sb2NhbC9rb25nL2tvbmcueW1sCiAgICAgIC0gJ0tPTkdfRE5TX09SREVSPUxBU1QsQSxDTkFNRScKICAgICAgLSBLT05HX0ROU19OT1RfRk9VTkRfVFRMPTEKICAgICAgLSAnS09OR19QTFVHSU5TPXJlcXVlc3QtdHJhbnNmb3JtZXIsY29ycyxrZXktYXV0aCxhY2wsYmFzaWMtYXV0aCxyZXF1ZXN0LXRlcm1pbmF0aW9uLGlwLXJlc3RyaWN0aW9uLHBvc3QtZnVuY3Rpb24nCiAgICAgIC0gS09OR19OR0lOWF9QUk9YWV9QUk9YWV9CVUZGRVJfU0laRT0xNjBrCiAgICAgIC0gJ0tPTkdfTkdJTlhfUFJPWFlfUFJPWFlfQlVGRkVSUz02NCAxNjBrJwogICAgICAtICdLT05HX1BST1hZX0FDQ0VTU19MT0c9L2Rldi9zdGRvdXQgY29tYmluZWQnCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk9JHtTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVk6LX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFQ1JFVF9LRVk9JHtTVVBBQkFTRV9TRUNSRVRfS0VZOi19JwogICAgICAtICdBTk9OX0tFWV9BU1lNTUVUUklDPSR7QU5PTl9LRVlfQVNZTU1FVFJJQzotfScKICAgICAgLSAnU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDPSR7U0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDOi19JwogICAgICAtICdEQVNIQk9BUkRfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfQURNSU59JwogICAgICAtICdEQVNIQk9BUkRfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSAnS09OR19TVE9SQUdFX0NPTk5FQ1RfVElNRU9VVD0ke0tPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVQ6LTYwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfV1JJVEVfVElNRU9VVDotMzYwMH0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRUFEX1RJTUVPVVQ9JHtLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUOi0zNjAwfScKICAgICAgLSAnS09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HPSR7S09OR19TVE9SQUdFX1JFUVVFU1RfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICAgIC0gJ0tPTkdfU1RPUkFHRV9SRVNQT05TRV9CVUZGRVJJTkc9JHtLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLWVudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9ob21lL2tvbmcva29uZy1lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9iYXNoXG4jIEN1c3RvbSBlbnRyeXBvaW50IGZvciBLb25nIHRoYXQgYnVpbGRzIEx1YSBleHByZXNzaW9ucyBmb3IgcmVxdWVzdC10cmFuc2Zvcm1lclxuIyBhbmQgcGVyZm9ybXMgZW52aXJvbm1lbnQgdmFyaWFibGUgc3Vic3RpdHV0aW9uIGluIHRoZSBkZWNsYXJhdGl2ZSBjb25maWcuXG5cbmlmIFsgLW4gXCIkU1VQQUJBU0VfU0VDUkVUX0tFWVwiIF0gJiYgWyAtbiBcIiRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcIiBdOyB0aGVuXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciAoaGVhZGVycy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9TRUNSRVRfS0VZJyBhbmQgJ0JlYXJlciAkU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKGhlYWRlcnMuYXBpa2V5ID09ICckU1VQQUJBU0VfUFVCTElTSEFCTEVfS0VZJyBhbmQgJ0JlYXJlciAkQU5PTl9LRVlfQVNZTU1FVFJJQycpIG9yIGhlYWRlcnMuYXBpa2V5KVwiXG4gICAgZXhwb3J0IExVQV9SVF9XU19FWFBSPVwiXFwkKChxdWVyeV9wYXJhbXMuYXBpa2V5ID09ICckU1VQQUJBU0VfU0VDUkVUX0tFWScgYW5kICckU0VSVklDRV9ST0xFX0tFWV9BU1lNTUVUUklDJykgb3IgKHF1ZXJ5X3BhcmFtcy5hcGlrZXkgPT0gJyRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVknIGFuZCAnJEFOT05fS0VZX0FTWU1NRVRSSUMnKSBvciBxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5lbHNlXG4gICAgZXhwb3J0IExVQV9BVVRIX0VYUFI9XCJcXCQoKGhlYWRlcnMuYXV0aG9yaXphdGlvbiB+PSBuaWwgYW5kIGhlYWRlcnMuYXV0aG9yaXphdGlvbjpzdWIoMSwgMTApIH49ICdCZWFyZXIgc2JfJyBhbmQgaGVhZGVycy5hdXRob3JpemF0aW9uKSBvciBoZWFkZXJzLmFwaWtleSlcIlxuICAgIGV4cG9ydCBMVUFfUlRfV1NfRVhQUj1cIlxcJChxdWVyeV9wYXJhbXMuYXBpa2V5KVwiXG5maVxuXG5hd2sgJ3tcbiAgcmVzdWx0ID0gXCJcIlxuICByZXN0ID0gJDBcbiAgd2hpbGUgKG1hdGNoKHJlc3QsIC9cXCRbQS1aYS16X11bQS1aYS16XzAtOV0qLykpIHtcbiAgICB2YXJuYW1lID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIDEsIFJMRU5HVEggLSAxKVxuICAgIGlmICh2YXJuYW1lIGluIEVOVklST04pIHtcbiAgICAgIHJlc3VsdCA9IHJlc3VsdCBzdWJzdHIocmVzdCwgMSwgUlNUQVJUIC0gMSkgRU5WSVJPTlt2YXJuYW1lXVxuICAgIH0gZWxzZSB7XG4gICAgICByZXN1bHQgPSByZXN1bHQgc3Vic3RyKHJlc3QsIDEsIFJTVEFSVCArIFJMRU5HVEggLSAxKVxuICAgIH1cbiAgICByZXN0ID0gc3Vic3RyKHJlc3QsIFJTVEFSVCArIFJMRU5HVEgpXG4gIH1cbiAgcHJpbnQgcmVzdWx0IHJlc3Rcbn0nIC9ob21lL2tvbmcvdGVtcC55bWwgPiBcIiRLT05HX0RFQ0xBUkFUSVZFX0NPTkZJR1wiXG5cbnNlZCAtaSAnL15bWzpzcGFjZTpdXSotIGtleTpbWzpzcGFjZTpdXSokL2QnIFwiJEtPTkdfREVDTEFSQVRJVkVfQ09ORklHXCJcblxuZXhlYyAvZW50cnlwb2ludC5zaCBrb25nIGRvY2tlci1zdGFydFxuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2FwaS9rb25nLnltbAogICAgICAgIHRhcmdldDogL2hvbWUva29uZy90ZW1wLnltbAogICAgICAgIGNvbnRlbnQ6ICJfZm9ybWF0X3ZlcnNpb246ICcyLjEnXG5fdHJhbnNmb3JtOiB0cnVlXG5cbiMjI1xuIyMjIENvbnN1bWVycyAvIFVzZXJzXG4jIyNcbmNvbnN1bWVyczpcbiAgLSB1c2VybmFtZTogREFTSEJPQVJEXG4gIC0gdXNlcm5hbWU6IGFub25cbiAgICBrZXlhdXRoX2NyZWRlbnRpYWxzOlxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9BTk9OX0tFWVxuICAgICAgLSBrZXk6ICRTVVBBQkFTRV9QVUJMSVNIQUJMRV9LRVlcbiAgLSB1c2VybmFtZTogc2VydmljZV9yb2xlXG4gICAga2V5YXV0aF9jcmVkZW50aWFsczpcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VSVklDRV9LRVlcbiAgICAgIC0ga2V5OiAkU1VQQUJBU0VfU0VDUkVUX0tFWVxuXG4jIyNcbiMjIyBBY2Nlc3MgQ29udHJvbCBMaXN0XG4jIyNcbmFjbHM6XG4gIC0gY29uc3VtZXI6IGFub25cbiAgICBncm91cDogYW5vblxuICAtIGNvbnN1bWVyOiBzZXJ2aWNlX3JvbGVcbiAgICBncm91cDogYWRtaW5cblxuIyMjXG4jIyMgRGFzaGJvYXJkIGNyZWRlbnRpYWxzXG4jIyNcbmJhc2ljYXV0aF9jcmVkZW50aWFsczpcbi0gY29uc3VtZXI6IERBU0hCT0FSRFxuICB1c2VybmFtZTogJyREQVNIQk9BUkRfVVNFUk5BTUUnXG4gIHBhc3N3b3JkOiAnJERBU0hCT0FSRF9QQVNTV09SRCdcblxuXG4jIyNcbiMjIyBBUEkgUm91dGVzXG4jIyNcbnNlcnZpY2VzOlxuXG4gICMjIE9wZW4gQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvdmVyaWZ5XG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW5cbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL3ZlcmlmeVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tY2FsbGJhY2tcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvY2FsbGJhY2tcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1jYWxsYmFja1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2F1dGgvdjEvY2FsbGJhY2tcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gIC0gbmFtZTogYXV0aC12MS1vcGVuLWF1dGhvcml6ZVxuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9hdXRob3JpemVcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1hdXRob3JpemVcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9hdXRoL3YxL2F1dGhvcml6ZVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tandrc1xuICAgIF9jb21tZW50OiAnQXV0aDogL2F1dGgvdjEvLndlbGwta25vd24vandrcy5qc29uIC0+IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vandrcy5qc29uJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtb3Blbi1qd2tzXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS8ud2VsbC1rbm93bi9qd2tzLmpzb25cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgIHVybDogXCJodHRwOi8vc3VwYWJhc2UtYXV0aDo5OTk5L3Nzby9zYW1sL2Fjc1wiXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLWFjc1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9hY3NcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgLSBuYW1lOiBhdXRoLXYxLW9wZW4tc3NvLW1ldGFkYXRhXG4gICAgdXJsOiBcImh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvc3NvL3NhbWwvbWV0YWRhdGFcIlxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogYXV0aC12MS1vcGVuLXNzby1tZXRhZGF0YVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAtIC9zc28vc2FtbC9tZXRhZGF0YVxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBTZWN1cmUgQXV0aCByb3V0ZXNcbiAgLSBuYW1lOiBhdXRoLXYxXG4gICAgX2NvbW1lbnQ6ICdHb1RydWU6IC9hdXRoL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8qJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS9cbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IGF1dGgtdjEtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvYXV0aC92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU2VjdXJlIFJFU1Qgcm91dGVzXG4gIC0gbmFtZTogcmVzdC12MVxuICAgIF9jb21tZW50OiAnUG9zdGdSRVNUOiAvcmVzdC92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvKidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZXN0LXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3Jlc3QvdjEvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgICAgICByZXBsYWNlOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkF1dGhvcml6YXRpb246ICRMVUFfQVVUSF9FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuXG4gICMjIFNlY3VyZSBHcmFwaFFMIHJvdXRlc1xuICAtIG5hbWU6IGdyYXBocWwtdjFcbiAgICBfY29tbWVudDogJ1Bvc3RnUkVTVDogL2dyYXBocWwvdjEvKiAtPiBodHRwOi8vc3VwYWJhc2UtcmVzdDozMDAwL3JwYy9ncmFwaHFsJ1xuICAgIHVybDogaHR0cDovL3N1cGFiYXNlLXJlc3Q6MzAwMC9ycGMvZ3JhcGhxbFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZ3JhcGhxbC12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9ncmFwaHFsL3YxXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogcmVxdWVzdC10cmFuc2Zvcm1lclxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgYWRkOlxuICAgICAgICAgICAgaGVhZGVyczpcbiAgICAgICAgICAgICAgLSBcIkNvbnRlbnQtUHJvZmlsZTogZ3JhcGhxbF9wdWJsaWNcIlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQ29udGVudC1Qcm9maWxlOiBncmFwaHFsX3B1YmxpY1wiXG4gICAgICAgICAgICAgIC0gXCJBdXRob3JpemF0aW9uOiAkTFVBX0FVVEhfRVhQUlwiXG4gICAgICAtIG5hbWU6IGFjbFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9ncm91cHNfaGVhZGVyOiB0cnVlXG4gICAgICAgICAgYWxsb3c6XG4gICAgICAgICAgICAtIGFkbWluXG4gICAgICAgICAgICAtIGFub25cblxuICAjIyBTZWN1cmUgUmVhbHRpbWUgcm91dGVzXG4gIC0gbmFtZTogcmVhbHRpbWUtdjEtd3NcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvKiAtPiB3czovL3JlYWx0aW1lOjQwMDAvc29ja2V0LyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvc29ja2V0XG4gICAgcHJvdG9jb2w6IHdzXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiByZWFsdGltZS12MS13c1xuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL3JlYWx0aW1lL3YxL1xuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcbiAgICAgIC0gbmFtZToga2V5LWF1dGhcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfY3JlZGVudGlhbHM6IGZhbHNlXG4gICAgICAtIG5hbWU6IHJlcXVlc3QtdHJhbnNmb3JtZXJcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGFkZDpcbiAgICAgICAgICAgIHF1ZXJ5c3RyaW5nOlxuICAgICAgICAgICAgICAtIFwiYXBpa2V5OiAkTFVBX1JUX1dTX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBxdWVyeXN0cmluZzpcbiAgICAgICAgICAgICAgLSBcImFwaWtleTogJExVQV9SVF9XU19FWFBSXCJcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cbiAgICAgICAgICAgIC0gYW5vblxuICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICBfY29tbWVudDogJ1JlYWx0aW1lOiAvcmVhbHRpbWUvdjEvYXBpLyogLT4gaHR0cDovL3JlYWx0aW1lOjQwMDAvYXBpLyonXG4gICAgdXJsOiBodHRwOi8vcmVhbHRpbWUtZGV2OjQwMDAvYXBpXG4gICAgcHJvdG9jb2w6IGh0dHBcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHJlYWx0aW1lLXYxLXJlc3RcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9yZWFsdGltZS92MS9hcGlcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG4gICAgICAtIG5hbWU6IGtleS1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiBmYWxzZVxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRyYW5zZm9ybWVyXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhZGQ6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgICAgIHJlcGxhY2U6XG4gICAgICAgICAgICBoZWFkZXJzOlxuICAgICAgICAgICAgICAtIFwiQXV0aG9yaXphdGlvbjogJExVQV9BVVRIX0VYUFJcIlxuICAgICAgLSBuYW1lOiBhY2xcbiAgICAgICAgY29uZmlnOlxuICAgICAgICAgIGhpZGVfZ3JvdXBzX2hlYWRlcjogdHJ1ZVxuICAgICAgICAgIGFsbG93OlxuICAgICAgICAgICAgLSBhZG1pblxuICAgICAgICAgICAgLSBhbm9uXG5cbiAgIyMgU3RvcmFnZSBBUEkgZW5kcG9pbnRcbiAgIyMgTm8ga2V5LWF1dGggLSBTMyBwcm90b2NvbCByZXF1ZXN0cyBkb24ndCBjYXJyeSBhbiBhcGlrZXkgaGVhZGVyLlxuICAtIG5hbWU6IHN0b3JhZ2UtdjFcbiAgICBfY29tbWVudDogJ1N0b3JhZ2U6IC9zdG9yYWdlL3YxLyogLT4gaHR0cDovL3N1cGFiYXNlLXN0b3JhZ2U6NTAwMC8qJ1xuICAgIGNvbm5lY3RfdGltZW91dDogJEtPTkdfU1RPUkFHRV9DT05ORUNUX1RJTUVPVVRcbiAgICB3cml0ZV90aW1lb3V0OiAkS09OR19TVE9SQUdFX1dSSVRFX1RJTUVPVVRcbiAgICByZWFkX3RpbWVvdXQ6ICRLT05HX1NUT1JBR0VfUkVBRF9USU1FT1VUXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3RvcmFnZTo1MDAwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogc3RvcmFnZS12MS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9zdG9yYWdlL3YxL1xuICAgICAgICByZXF1ZXN0X2J1ZmZlcmluZzogJEtPTkdfU1RPUkFHRV9SRVFVRVNUX0JVRkZFUklOR1xuICAgICAgICByZXNwb25zZV9idWZmZXJpbmc6ICRLT05HX1NUT1JBR0VfUkVTUE9OU0VfQlVGRkVSSU5HXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBwb3N0LWZ1bmN0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBhY2Nlc3M6XG4gICAgICAgICAgICAtIHxcbiAgICAgICAgICAgICAgbG9jYWwgYXV0aCA9IGtvbmcucmVxdWVzdC5nZXRfaGVhZGVyKFwiYXV0aG9yaXphdGlvblwiKVxuICAgICAgICAgICAgICBpZiBhdXRoID09IG5pbCBvciBhdXRoID09IFwiXCIgb3IgYXV0aDpmaW5kKFwiXiVzKiRcIikgdGhlblxuICAgICAgICAgICAgICAgIGtvbmcuc2VydmljZS5yZXF1ZXN0LmNsZWFyX2hlYWRlcihcImF1dGhvcml6YXRpb25cIilcbiAgICAgICAgICAgICAgZW5kXG5cbiAgIyMgRWRnZSBGdW5jdGlvbnMgcm91dGVzXG4gIC0gbmFtZTogZnVuY3Rpb25zLXYxXG4gICAgX2NvbW1lbnQ6ICdFZGdlIEZ1bmN0aW9uczogL2Z1bmN0aW9ucy92MS8qIC0+IGh0dHA6Ly9zdXBhYmFzZS1lZGdlLWZ1bmN0aW9uczo5MDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtZWRnZS1mdW5jdGlvbnM6OTAwMC9cbiAgICByZWFkX3RpbWVvdXQ6IDE1MDAwMFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogZnVuY3Rpb25zLXYxLWFsbFxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2Z1bmN0aW9ucy92MS9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBjb3JzXG5cbiAgIyMgT0F1dGggMi4wIEF1dGhvcml6YXRpb24gU2VydmVyIE1ldGFkYXRhIChSRkMgODQxNClcbiAgLSBuYW1lOiB3ZWxsLWtub3duLW9hdXRoXG4gICAgX2NvbW1lbnQ6ICdBdXRoOiAvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXIgLT4gaHR0cDovL3N1cGFiYXNlLWF1dGg6OTk5OS8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlcidcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hdXRoOjk5OTkvLndlbGwta25vd24vb2F1dGgtYXV0aG9yaXphdGlvbi1zZXJ2ZXJcbiAgICByb3V0ZXM6XG4gICAgICAtIG5hbWU6IHdlbGwta25vd24tb2F1dGhcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC8ud2VsbC1rbm93bi9vYXV0aC1hdXRob3JpemF0aW9uLXNlcnZlclxuICAgIHBsdWdpbnM6XG4gICAgICAtIG5hbWU6IGNvcnNcblxuICAjIyBBbmFseXRpY3Mgcm91dGVzXG4gICMjIE5vdCB1c2VkIC0gU3R1ZGlvIGFuZCBWZWN0b3IgdGFsayBkaXJlY3RseSB0byBhbmFseXRpY3MgdmlhIERvY2tlciBuZXR3b3JraW5nLlxuICAjIC0gbmFtZTogYW5hbHl0aWNzLXYxXG4gICMgICBfY29tbWVudDogJ0FuYWx5dGljczogL2FuYWx5dGljcy92MS8qIC0+IGh0dHA6Ly9sb2dmbGFyZTo0MDAwLyonXG4gICMgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9cbiAgIyAgIHJvdXRlczpcbiAgIyAgICAgLSBuYW1lOiBhbmFseXRpY3MtdjEtYWxsXG4gICMgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAjICAgICAgIHBhdGhzOlxuICAjICAgICAgICAgLSAvYW5hbHl0aWNzL3YxL1xuXG4gICMjIFNlY3VyZSBEYXRhYmFzZSByb3V0ZXNcbiAgLSBuYW1lOiBtZXRhXG4gICAgX2NvbW1lbnQ6ICdwZy1tZXRhOiAvcGcvKiAtPiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwL1xuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWV0YS1hbGxcbiAgICAgICAgc3RyaXBfcGF0aDogdHJ1ZVxuICAgICAgICBwYXRoczpcbiAgICAgICAgICAtIC9wZy9cbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiBrZXktYXV0aFxuICAgICAgICBjb25maWc6XG4gICAgICAgICAgaGlkZV9jcmVkZW50aWFsczogZmFsc2VcbiAgICAgIC0gbmFtZTogYWNsXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2dyb3Vwc19oZWFkZXI6IHRydWVcbiAgICAgICAgICBhbGxvdzpcbiAgICAgICAgICAgIC0gYWRtaW5cblxuICAjIyBCbG9jayBhY2Nlc3MgdG8gL2FwaS9tY3BcbiAgLSBuYW1lOiBtY3AtYmxvY2tlclxuICAgIF9jb21tZW50OiAnQmxvY2sgZGlyZWN0IGFjY2VzcyB0byAvYXBpL21jcCdcbiAgICB1cmw6IGh0dHA6Ly9zdXBhYmFzZS1zdHVkaW86MzAwMC9hcGkvbWNwXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBtY3AtYmxvY2tlci1yb3V0ZVxuICAgICAgICBzdHJpcF9wYXRoOiB0cnVlXG4gICAgICAgIHBhdGhzOlxuICAgICAgICAgIC0gL2FwaS9tY3BcbiAgICBwbHVnaW5zOlxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG5cbiAgIyMgTUNQIGVuZHBvaW50IC0gbG9jYWwgYWNjZXNzXG4gIC0gbmFtZTogbWNwXG4gICAgX2NvbW1lbnQ6ICdNQ1A6IC9tY3AgLT4gaHR0cDovL3N1cGFiYXNlLXN0dWRpbzozMDAwL2FwaS9tY3AgKGxvY2FsIGFjY2VzcyknXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvYXBpL21jcFxuICAgIHJvdXRlczpcbiAgICAgIC0gbmFtZTogbWNwXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvbWNwXG4gICAgcGx1Z2luczpcbiAgICAgICMgQmxvY2sgYWNjZXNzIHRvIC9tY3AgYnkgZGVmYXVsdFxuICAgICAgLSBuYW1lOiByZXF1ZXN0LXRlcm1pbmF0aW9uXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBzdGF0dXNfY29kZTogNDAzXG4gICAgICAgICAgbWVzc2FnZTogXCJBY2Nlc3MgaXMgZm9yYmlkZGVuLlwiXG4gICAgICAjIEVuYWJsZSBsb2NhbCBhY2Nlc3MgKGRhbmdlciB6b25lISlcbiAgICAgICMgMS4gQ29tbWVudCBvdXQgdGhlICdyZXF1ZXN0LXRlcm1pbmF0aW9uJyBzZWN0aW9uIGFib3ZlXG4gICAgICAjIDIuIFVuY29tbWVudCB0aGUgZW50aXJlIHNlY3Rpb24gYmVsb3csIGluY2x1ZGluZyAnZGVueSdcbiAgICAgICMgMy4gQWRkIHlvdXIgbG9jYWwgSVBzIHRvIHRoZSAnYWxsb3cnIGxpc3RcbiAgICAgICMtIG5hbWU6IGNvcnNcbiAgICAgICMtIG5hbWU6IGlwLXJlc3RyaWN0aW9uXG4gICAgICAjICBjb25maWc6XG4gICAgICAjICAgIGFsbG93OlxuICAgICAgIyAgICAgIC0gMTI3LjAuMC4xXG4gICAgICAjICAgICAgLSA6OjFcbiAgICAgICMgICAgZGVueTogW11cblxuICAjIyBQcm90ZWN0ZWQgRGFzaGJvYXJkIC0gY2F0Y2ggYWxsIHJlbWFpbmluZyByb3V0ZXNcbiAgLSBuYW1lOiBkYXNoYm9hcmRcbiAgICBfY29tbWVudDogJ1N0dWRpbzogLyogLT4gaHR0cDovL3N0dWRpbzozMDAwLyonXG4gICAgdXJsOiBodHRwOi8vc3VwYWJhc2Utc3R1ZGlvOjMwMDAvXG4gICAgcm91dGVzOlxuICAgICAgLSBuYW1lOiBkYXNoYm9hcmQtYWxsXG4gICAgICAgIHN0cmlwX3BhdGg6IHRydWVcbiAgICAgICAgcGF0aHM6XG4gICAgICAgICAgLSAvXG4gICAgcGx1Z2luczpcbiAgICAgIC0gbmFtZTogY29yc1xuICAgICAgLSBuYW1lOiBiYXNpYy1hdXRoXG4gICAgICAgIGNvbmZpZzpcbiAgICAgICAgICBoaWRlX2NyZWRlbnRpYWxzOiB0cnVlXG4iCiAgc3VwYWJhc2Utc3R1ZGlvOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdHVkaW86MjAyNi4wMy4xNi1zaGEtNTUyODgxNycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBub2RlCiAgICAgICAgLSAnLWUnCiAgICAgICAgLSAiZmV0Y2goJ2h0dHA6Ly8xMjcuMC4wLjE6MzAwMC9hcGkvcGxhdGZvcm0vcHJvZmlsZScpLnRoZW4oKHIpID0+IHtpZiAoci5zdGF0dXMgIT09IDIwMCkgdGhyb3cgbmV3IEVycm9yKHIuc3RhdHVzKX0pIgogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBIT1NUTkFNRT0wLjAuMC4wCiAgICAgIC0gJ1NUVURJT19QR19NRVRBX1VSTD1odHRwOi8vc3VwYWJhc2UtbWV0YTo4MDgwJwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19IT1NUPSR7UE9TVEdSRVNfSE9TVDotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnUEdSU1RfREJfU0NIRU1BUz0ke1BHUlNUX0RCX1NDSEVNQVM6LXB1YmxpYyxzdG9yYWdlLGdyYXBocWxfcHVibGljfScKICAgICAgLSAnUEdSU1RfREJfTUFYX1JPV1M9JHtQR1JTVF9EQl9NQVhfUk9XUzotMTAwMH0nCiAgICAgIC0gJ1BHUlNUX0RCX0VYVFJBX1NFQVJDSF9QQVRIPSR7UEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg6LXB1YmxpY30nCiAgICAgIC0gJ0RFRkFVTFRfT1JHQU5JWkFUSU9OX05BTUU9JHtTVFVESU9fREVGQVVMVF9PUkdBTklaQVRJT046LURlZmF1bHQgT3JnYW5pemF0aW9ufScKICAgICAgLSAnREVGQVVMVF9QUk9KRUNUX05BTUU9JHtTVFVESU9fREVGQVVMVF9QUk9KRUNUOi1EZWZhdWx0IFByb2plY3R9JwogICAgICAtICdTVVBBQkFTRV9VUkw9aHR0cDovL3N1cGFiYXNlLWtvbmc6ODAwMCcKICAgICAgLSAnU1VQQUJBU0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdTVVBBQkFTRV9BTk9OX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VBTk9OX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX1NFUlZJQ0VfS0VZPSR7U0VSVklDRV9TVVBBQkFTRVNFUlZJQ0VfS0VZfScKICAgICAgLSAnQVVUSF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtICdQR19NRVRBX0NSWVBUT19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1BHTUVUQUNSWVBUT30nCiAgICAgIC0gJ0xPR0ZMQVJFX0FQSV9LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX0xPR0ZMQVJFfScKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgICAtICdMT0dGTEFSRV9QUklWQVRFX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkVQUklWQVRFfScKICAgICAgLSAnTE9HRkxBUkVfVVJMPWh0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMCcKICAgICAgLSAnTkVYVF9QVUJMSUNfU1VQQUJBU0VfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ05FWFRfUFVCTElDX1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSBORVhUX1BVQkxJQ19FTkFCTEVfTE9HUz10cnVlCiAgICAgIC0gTkVYVF9BTkFMWVRJQ1NfQkFDS0VORF9QUk9WSURFUj1wb3N0Z3JlcwogICAgICAtICdPUEVOQUlfQVBJX0tFWT0ke09QRU5BSV9BUElfS0VZfScKICAgICAgLSBTTklQUEVUU19NQU5BR0VNRU5UX0ZPTERFUj0vYXBwL3NuaXBwZXRzCiAgICAgIC0gRURHRV9GVU5DVElPTlNfTUFOQUdFTUVOVF9GT0xERVI9L2FwcC9lZGdlLWZ1bmN0aW9ucwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3NuaXBwZXRzOi9hcHAvc25pcHBldHMnCiAgICAgIC0gJy4vdm9sdW1lcy9mdW5jdGlvbnM6L2FwcC9lZGdlLWZ1bmN0aW9ucycKICBzdXBhYmFzZS1kYjoKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXM6MTUuOC4xLjA4NScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAncGdfaXNyZWFkeSAtVSBwb3N0Z3JlcyAtaCAxMjcuMC4wLjEnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtdmVjdG9yOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBjb21tYW5kOgogICAgICAtIHBvc3RncmVzCiAgICAgIC0gJy1jJwogICAgICAtIGNvbmZpZ19maWxlPS9ldGMvcG9zdGdyZXNxbC9wb3N0Z3Jlc3FsLmNvbmYKICAgICAgLSAnLWMnCiAgICAgIC0gbG9nX21pbl9tZXNzYWdlcz1mYXRhbAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfSE9TVD0vdmFyL3J1bi9wb3N0Z3Jlc3FsCiAgICAgIC0gJ1BHUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BHUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUEdEQVRBQkFTRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSAnSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgdm9sdW1lczoKICAgICAgLSAnc3VwYWJhc2UtZGItZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvcmVhbHRpbWUuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85OS1yZWFsdGltZS5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxuY3JlYXRlIHNjaGVtYSBpZiBub3QgZXhpc3RzIF9yZWFsdGltZTtcbmFsdGVyIHNjaGVtYSBfcmVhbHRpbWUgb3duZXIgdG8gOnBndXNlcjtcbiIKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9kYi9fc3VwYWJhc2Uuc3FsCiAgICAgICAgdGFyZ2V0OiAvZG9ja2VyLWVudHJ5cG9pbnQtaW5pdGRiLmQvbWlncmF0aW9ucy85Ny1fc3VwYWJhc2Uuc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cbkNSRUFURSBEQVRBQkFTRSBfc3VwYWJhc2UgV0lUSCBPV05FUiA6cGd1c2VyO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3Bvb2xlci5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LXBvb2xlci5zcWwKICAgICAgICBjb250ZW50OiAiXFxzZXQgcGd1c2VyIGBlY2hvIFwiJFBPU1RHUkVTX1VTRVJcImBcblxcYyBfc3VwYWJhc2VcbmNyZWF0ZSBzY2hlbWEgaWYgbm90IGV4aXN0cyBfc3VwYXZpc29yO1xuYWx0ZXIgc2NoZW1hIF9zdXBhdmlzb3Igb3duZXIgdG8gOnBndXNlcjtcblxcYyBwb3N0Z3Jlc1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3dlYmhvb2tzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OC13ZWJob29rcy5zcWwKICAgICAgICBjb250ZW50OiAiQkVHSU47XG4tLSBDcmVhdGUgcGdfbmV0IGV4dGVuc2lvblxuQ1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHBnX25ldCBTQ0hFTUEgZXh0ZW5zaW9ucztcbi0tIENyZWF0ZSBzdXBhYmFzZV9mdW5jdGlvbnMgc2NoZW1hXG5DUkVBVEUgU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBBVVRIT1JJWkFUSU9OIHN1cGFiYXNlX2FkbWluO1xuR1JBTlQgVVNBR0UgT04gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFRBQkxFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIEZVTkNUSU9OUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQUxURVIgREVGQVVMVCBQUklWSUxFR0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgR1JBTlQgQUxMIE9OIFNFUVVFTkNFUyBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLm1pZ3JhdGlvbnMgZGVmaW5pdGlvblxuQ1JFQVRFIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5taWdyYXRpb25zIChcbiAgdmVyc2lvbiB0ZXh0IFBSSU1BUlkgS0VZLFxuICBpbnNlcnRlZF9hdCB0aW1lc3RhbXB0eiBOT1QgTlVMTCBERUZBVUxUIE5PVygpXG4pO1xuLS0gSW5pdGlhbCBzdXBhYmFzZV9mdW5jdGlvbnMgbWlncmF0aW9uXG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnaW5pdGlhbCcpO1xuLS0gc3VwYWJhc2VfZnVuY3Rpb25zLmhvb2tzIGRlZmluaXRpb25cbkNSRUFURSBUQUJMRSBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgKFxuICBpZCBiaWdzZXJpYWwgUFJJTUFSWSBLRVksXG4gIGhvb2tfdGFibGVfaWQgaW50ZWdlciBOT1QgTlVMTCxcbiAgaG9va19uYW1lIHRleHQgTk9UIE5VTEwsXG4gIGNyZWF0ZWRfYXQgdGltZXN0YW1wdHogTk9UIE5VTEwgREVGQVVMVCBOT1coKSxcbiAgcmVxdWVzdF9pZCBiaWdpbnRcbik7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX3JlcXVlc3RfaWRfaWR4IE9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBVU0lORyBidHJlZSAocmVxdWVzdF9pZCk7XG5DUkVBVEUgSU5ERVggc3VwYWJhc2VfZnVuY3Rpb25zX2hvb2tzX2hfdGFibGVfaWRfaF9uYW1lX2lkeCBPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaG9va3MgVVNJTkcgYnRyZWUgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSk7XG5DT01NRU5UIE9OIFRBQkxFIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rcyBJUyAnU3VwYWJhc2UgRnVuY3Rpb25zIEhvb2tzOiBBdWRpdCB0cmFpbCBmb3IgdHJpZ2dlcmVkIGhvb2tzLic7XG5DUkVBVEUgRlVOQ1RJT04gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpXG4gIFJFVFVSTlMgdHJpZ2dlclxuICBMQU5HVUFHRSBwbHBnc3FsXG4gIEFTICRmdW5jdGlvbiRcbiAgREVDTEFSRVxuICAgIHJlcXVlc3RfaWQgYmlnaW50O1xuICAgIHBheWxvYWQganNvbmI7XG4gICAgdXJsIHRleHQgOj0gVEdfQVJHVlswXTo6dGV4dDtcbiAgICBtZXRob2QgdGV4dCA6PSBUR19BUkdWWzFdOjp0ZXh0O1xuICAgIGhlYWRlcnMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICBwYXJhbXMganNvbmIgREVGQVVMVCAne30nOjpqc29uYjtcbiAgICB0aW1lb3V0X21zIGludGVnZXIgREVGQVVMVCAxMDAwO1xuICBCRUdJTlxuICAgIElGIHVybCBJUyBOVUxMIE9SIHVybCA9ICdudWxsJyBUSEVOXG4gICAgICBSQUlTRSBFWENFUFRJT04gJ3VybCBhcmd1bWVudCBpcyBtaXNzaW5nJztcbiAgICBFTkQgSUY7XG5cbiAgICBJRiBtZXRob2QgSVMgTlVMTCBPUiBtZXRob2QgPSAnbnVsbCcgVEhFTlxuICAgICAgUkFJU0UgRVhDRVBUSU9OICdtZXRob2QgYXJndW1lbnQgaXMgbWlzc2luZyc7XG4gICAgRU5EIElGO1xuXG4gICAgSUYgVEdfQVJHVlsyXSBJUyBOVUxMIE9SIFRHX0FSR1ZbMl0gPSAnbnVsbCcgVEhFTlxuICAgICAgaGVhZGVycyA9ICd7XCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCJ9Jzo6anNvbmI7XG4gICAgRUxTRVxuICAgICAgaGVhZGVycyA9IFRHX0FSR1ZbMl06Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbM10gSVMgTlVMTCBPUiBUR19BUkdWWzNdID0gJ251bGwnIFRIRU5cbiAgICAgIHBhcmFtcyA9ICd7fSc6Ompzb25iO1xuICAgIEVMU0VcbiAgICAgIHBhcmFtcyA9IFRHX0FSR1ZbM106Ompzb25iO1xuICAgIEVORCBJRjtcblxuICAgIElGIFRHX0FSR1ZbNF0gSVMgTlVMTCBPUiBUR19BUkdWWzRdID0gJ251bGwnIFRIRU5cbiAgICAgIHRpbWVvdXRfbXMgPSAxMDAwO1xuICAgIEVMU0VcbiAgICAgIHRpbWVvdXRfbXMgPSBUR19BUkdWWzRdOjppbnRlZ2VyO1xuICAgIEVORCBJRjtcblxuICAgIENBU0VcbiAgICAgIFdIRU4gbWV0aG9kID0gJ0dFVCcgVEhFTlxuICAgICAgICBTRUxFQ1QgaHR0cF9nZXQgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfZ2V0KFxuICAgICAgICAgIHVybCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBXSEVOIG1ldGhvZCA9ICdQT1NUJyBUSEVOXG4gICAgICAgIHBheWxvYWQgPSBqc29uYl9idWlsZF9vYmplY3QoXG4gICAgICAgICAgJ29sZF9yZWNvcmQnLCBPTEQsXG4gICAgICAgICAgJ3JlY29yZCcsIE5FVyxcbiAgICAgICAgICAndHlwZScsIFRHX09QLFxuICAgICAgICAgICd0YWJsZScsIFRHX1RBQkxFX05BTUUsXG4gICAgICAgICAgJ3NjaGVtYScsIFRHX1RBQkxFX1NDSEVNQVxuICAgICAgICApO1xuXG4gICAgICAgIFNFTEVDVCBodHRwX3Bvc3QgSU5UTyByZXF1ZXN0X2lkIEZST00gbmV0Lmh0dHBfcG9zdChcbiAgICAgICAgICB1cmwsXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICBwYXJhbXMsXG4gICAgICAgICAgaGVhZGVycyxcbiAgICAgICAgICB0aW1lb3V0X21zXG4gICAgICAgICk7XG4gICAgICBFTFNFXG4gICAgICAgIFJBSVNFIEVYQ0VQVElPTiAnbWV0aG9kIGFyZ3VtZW50ICUgaXMgaW52YWxpZCcsIG1ldGhvZDtcbiAgICBFTkQgQ0FTRTtcblxuICAgIElOU0VSVCBJTlRPIHN1cGFiYXNlX2Z1bmN0aW9ucy5ob29rc1xuICAgICAgKGhvb2tfdGFibGVfaWQsIGhvb2tfbmFtZSwgcmVxdWVzdF9pZClcbiAgICBWQUxVRVNcbiAgICAgIChUR19SRUxJRCwgVEdfTkFNRSwgcmVxdWVzdF9pZCk7XG5cbiAgICBSRVRVUk4gTkVXO1xuICBFTkRcbiRmdW5jdGlvbiQ7XG4tLSBTdXBhYmFzZSBzdXBlciBhZG1pblxuRE9cbiQkXG5CRUdJTlxuICBJRiBOT1QgRVhJU1RTIChcbiAgICBTRUxFQ1QgMVxuICAgIEZST00gcGdfcm9sZXNcbiAgICBXSEVSRSByb2xuYW1lID0gJ3N1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbidcbiAgKVxuICBUSEVOXG4gICAgQ1JFQVRFIFVTRVIgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIE5PSU5IRVJJVCBDUkVBVEVST0xFIExPR0lOIE5PUkVQTElDQVRJT047XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBTQ0hFTUEgc3VwYWJhc2VfZnVuY3Rpb25zIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkdSQU5UIEFMTCBQUklWSUxFR0VTIE9OIEFMTCBUQUJMRVMgSU4gU0NIRU1BIHN1cGFiYXNlX2Z1bmN0aW9ucyBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5HUkFOVCBBTEwgUFJJVklMRUdFUyBPTiBBTEwgU0VRVUVOQ0VTIElOIFNDSEVNQSBzdXBhYmFzZV9mdW5jdGlvbnMgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gU0VUIHNlYXJjaF9wYXRoID0gXCJzdXBhYmFzZV9mdW5jdGlvbnNcIjtcbkFMVEVSIHRhYmxlIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIubWlncmF0aW9ucyBPV05FUiBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW47XG5BTFRFUiB0YWJsZSBcInN1cGFiYXNlX2Z1bmN0aW9uc1wiLmhvb2tzIE9XTkVSIFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbjtcbkFMVEVSIGZ1bmN0aW9uIFwic3VwYWJhc2VfZnVuY3Rpb25zXCIuaHR0cF9yZXF1ZXN0KCkgT1dORVIgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluO1xuR1JBTlQgc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluIFRPIHBvc3RncmVzO1xuLS0gUmVtb3ZlIHVudXNlZCBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gcm9sZVxuRE9cbiQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19yb2xlc1xuICAgIFdIRVJFIHJvbG5hbWUgPSAnc3VwYWJhc2VfcGdfbmV0X2FkbWluJ1xuICApXG4gIFRIRU5cbiAgICBSRUFTU0lHTiBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW4gVE8gc3VwYWJhc2VfYWRtaW47XG4gICAgRFJPUCBPV05FRCBCWSBzdXBhYmFzZV9wZ19uZXRfYWRtaW47XG4gICAgRFJPUCBST0xFIHN1cGFiYXNlX3BnX25ldF9hZG1pbjtcbiAgRU5EIElGO1xuRU5EXG4kJDtcbi0tIHBnX25ldCBncmFudHMgd2hlbiBleHRlbnNpb24gaXMgYWxyZWFkeSBlbmFibGVkXG5ET1xuJCRcbkJFR0lOXG4gIElGIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V4dGVuc2lvblxuICAgIFdIRVJFIGV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG4tLSBFdmVudCB0cmlnZ2VyIGZvciBwZ19uZXRcbkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIGV4dGVuc2lvbnMuZ3JhbnRfcGdfbmV0X2FjY2VzcygpXG5SRVRVUk5TIGV2ZW50X3RyaWdnZXJcbkxBTkdVQUdFIHBscGdzcWxcbkFTICQkXG5CRUdJTlxuICBJRiBFWElTVFMgKFxuICAgIFNFTEVDVCAxXG4gICAgRlJPTSBwZ19ldmVudF90cmlnZ2VyX2RkbF9jb21tYW5kcygpIEFTIGV2XG4gICAgSk9JTiBwZ19leHRlbnNpb24gQVMgZXh0XG4gICAgT04gZXYub2JqaWQgPSBleHQub2lkXG4gICAgV0hFUkUgZXh0LmV4dG5hbWUgPSAncGdfbmV0J1xuICApXG4gIFRIRU5cbiAgICBHUkFOVCBVU0FHRSBPTiBTQ0hFTUEgbmV0IFRPIHN1cGFiYXNlX2Z1bmN0aW9uc19hZG1pbiwgcG9zdGdyZXMsIGFub24sIGF1dGhlbnRpY2F0ZWQsIHNlcnZpY2Vfcm9sZTtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgU0VDVVJJVFkgREVGSU5FUjtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFQ1VSSVRZIERFRklORVI7XG4gICAgQUxURVIgZnVuY3Rpb24gbmV0Lmh0dHBfZ2V0KHVybCB0ZXh0LCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBBTFRFUiBmdW5jdGlvbiBuZXQuaHR0cF9wb3N0KHVybCB0ZXh0LCBib2R5IGpzb25iLCBwYXJhbXMganNvbmIsIGhlYWRlcnMganNvbmIsIHRpbWVvdXRfbWlsbGlzZWNvbmRzIGludGVnZXIpIFNFVCBzZWFyY2hfcGF0aCA9IG5ldDtcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX2dldCh1cmwgdGV4dCwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBGUk9NIFBVQkxJQztcbiAgICBSRVZPS0UgQUxMIE9OIEZVTkNUSU9OIG5ldC5odHRwX3Bvc3QodXJsIHRleHQsIGJvZHkganNvbmIsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgRlJPTSBQVUJMSUM7XG4gICAgR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBuZXQuaHR0cF9nZXQodXJsIHRleHQsIHBhcmFtcyBqc29uYiwgaGVhZGVycyBqc29uYiwgdGltZW91dF9taWxsaXNlY29uZHMgaW50ZWdlcikgVE8gc3VwYWJhc2VfZnVuY3Rpb25zX2FkbWluLCBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuICAgIEdSQU5UIEVYRUNVVEUgT04gRlVOQ1RJT04gbmV0Lmh0dHBfcG9zdCh1cmwgdGV4dCwgYm9keSBqc29uYiwgcGFyYW1zIGpzb25iLCBoZWFkZXJzIGpzb25iLCB0aW1lb3V0X21pbGxpc2Vjb25kcyBpbnRlZ2VyKSBUTyBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4sIHBvc3RncmVzLCBhbm9uLCBhdXRoZW50aWNhdGVkLCBzZXJ2aWNlX3JvbGU7XG4gIEVORCBJRjtcbkVORDtcbiQkO1xuQ09NTUVOVCBPTiBGVU5DVElPTiBleHRlbnNpb25zLmdyYW50X3BnX25ldF9hY2Nlc3MgSVMgJ0dyYW50cyBhY2Nlc3MgdG8gcGdfbmV0JztcbkRPXG4kJFxuQkVHSU5cbiAgSUYgTk9UIEVYSVNUUyAoXG4gICAgU0VMRUNUIDFcbiAgICBGUk9NIHBnX2V2ZW50X3RyaWdnZXJcbiAgICBXSEVSRSBldnRuYW1lID0gJ2lzc3VlX3BnX25ldF9hY2Nlc3MnXG4gICkgVEhFTlxuICAgIENSRUFURSBFVkVOVCBUUklHR0VSIGlzc3VlX3BnX25ldF9hY2Nlc3MgT04gZGRsX2NvbW1hbmRfZW5kIFdIRU4gVEFHIElOICgnQ1JFQVRFIEVYVEVOU0lPTicpXG4gICAgRVhFQ1VURSBQUk9DRURVUkUgZXh0ZW5zaW9ucy5ncmFudF9wZ19uZXRfYWNjZXNzKCk7XG4gIEVORCBJRjtcbkVORFxuJCQ7XG5JTlNFUlQgSU5UTyBzdXBhYmFzZV9mdW5jdGlvbnMubWlncmF0aW9ucyAodmVyc2lvbikgVkFMVUVTICgnMjAyMTA4MDkxODM0MjNfdXBkYXRlX2dyYW50cycpO1xuQUxURVIgZnVuY3Rpb24gc3VwYWJhc2VfZnVuY3Rpb25zLmh0dHBfcmVxdWVzdCgpIFNFQ1VSSVRZIERFRklORVI7XG5BTFRFUiBmdW5jdGlvbiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgU0VUIHNlYXJjaF9wYXRoID0gc3VwYWJhc2VfZnVuY3Rpb25zO1xuUkVWT0tFIEFMTCBPTiBGVU5DVElPTiBzdXBhYmFzZV9mdW5jdGlvbnMuaHR0cF9yZXF1ZXN0KCkgRlJPTSBQVUJMSUM7XG5HUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHN1cGFiYXNlX2Z1bmN0aW9ucy5odHRwX3JlcXVlc3QoKSBUTyBwb3N0Z3JlcywgYW5vbiwgYXV0aGVudGljYXRlZCwgc2VydmljZV9yb2xlO1xuQ09NTUlUO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL3JvbGVzLnNxbAogICAgICAgIHRhcmdldDogL2RvY2tlci1lbnRyeXBvaW50LWluaXRkYi5kL2luaXQtc2NyaXB0cy85OS1yb2xlcy5zcWwKICAgICAgICBjb250ZW50OiAiLS0gTk9URTogY2hhbmdlIHRvIHlvdXIgb3duIHBhc3N3b3JkcyBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHNcbiBcXHNldCBwZ3Bhc3MgYGVjaG8gXCIkUE9TVEdSRVNfUEFTU1dPUkRcImBcblxuIEFMVEVSIFVTRVIgYXV0aGVudGljYXRvciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHBnYm91bmNlciBXSVRIIFBBU1NXT1JEIDoncGdwYXNzJztcbiBBTFRFUiBVU0VSIHN1cGFiYXNlX2F1dGhfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9mdW5jdGlvbnNfYWRtaW4gV0lUSCBQQVNTV09SRCA6J3BncGFzcyc7XG4gQUxURVIgVVNFUiBzdXBhYmFzZV9zdG9yYWdlX2FkbWluIFdJVEggUEFTU1dPUkQgOidwZ3Bhc3MnO1xuIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2RiL2p3dC5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9pbml0LXNjcmlwdHMvOTktand0LnNxbAogICAgICAgIGNvbnRlbnQ6ICJcXHNldCBqd3Rfc2VjcmV0IGBlY2hvIFwiJEpXVF9TRUNSRVRcImBcblxcc2V0IGp3dF9leHAgYGVjaG8gXCIkSldUX0VYUFwiYFxuXFxzZXQgZGJfbmFtZSBgZWNobyBcIiR7UE9TVEdSRVNfREI6LXBvc3RncmVzfVwiYFxuXG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X3NlY3JldFwiIFRPIDonand0X3NlY3JldCc7XG5BTFRFUiBEQVRBQkFTRSA6ZGJfbmFtZSBTRVQgXCJhcHAuc2V0dGluZ3Muand0X2V4cFwiIFRPIDonand0X2V4cCc7XG4iCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvZGIvbG9ncy5zcWwKICAgICAgICB0YXJnZXQ6IC9kb2NrZXItZW50cnlwb2ludC1pbml0ZGIuZC9taWdyYXRpb25zLzk5LWxvZ3Muc3FsCiAgICAgICAgY29udGVudDogIlxcc2V0IHBndXNlciBgZWNobyBcIiRQT1NUR1JFU19VU0VSXCJgXG5cXGMgX3N1cGFiYXNlXG5jcmVhdGUgc2NoZW1hIGlmIG5vdCBleGlzdHMgX2FuYWx5dGljcztcbmFsdGVyIHNjaGVtYSBfYW5hbHl0aWNzIG93bmVyIHRvIDpwZ3VzZXI7XG5cXGMgcG9zdGdyZXNcbiIKICAgICAgLSAnc3VwYWJhc2UtZGItY29uZmlnOi9ldGMvcG9zdGdyZXNxbC1jdXN0b20nCiAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9sb2dmbGFyZToxLjMxLjInCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6NDAwMC9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtIExPR0ZMQVJFX05PREVfSE9TVD0xMjcuMC4wLjEKICAgICAgLSBEQl9VU0VSTkFNRT1zdXBhYmFzZV9hZG1pbgogICAgICAtIERCX0RBVEFCQVNFPV9zdXBhYmFzZQogICAgICAtICdEQl9IT1NUTkFNRT0ke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn0nCiAgICAgIC0gJ0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSBEQl9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtICdMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRX0nCiAgICAgIC0gJ0xPR0ZMQVJFX1BSSVZBVEVfQUNDRVNTX1RPS0VOPSR7U0VSVklDRV9QQVNTV09SRF9MT0dGTEFSRVBSSVZBVEV9JwogICAgICAtIExPR0ZMQVJFX1NJTkdMRV9URU5BTlQ9dHJ1ZQogICAgICAtIExPR0ZMQVJFX1NVUEFCQVNFX01PREU9dHJ1ZQogICAgICAtICdQT1NUR1JFU19CQUNLRU5EX1VSTD1wb3N0Z3Jlc3FsOi8vc3VwYWJhc2VfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS9fc3VwYWJhc2UnCiAgICAgIC0gUE9TVEdSRVNfQkFDS0VORF9TQ0hFTUE9X2FuYWx5dGljcwogICAgICAtIExPR0ZMQVJFX0ZFQVRVUkVfRkxBR19PVkVSUklERT1tdWx0aWJhY2tlbmQ9dHJ1ZQogIHN1cGFiYXNlLXZlY3RvcjoKICAgIGltYWdlOiAndGltYmVyaW8vdmVjdG9yOjAuNTMuMC1hbHBpbmUnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovL3N1cGFiYXNlLXZlY3Rvcjo5MDAxL2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvbG9ncy92ZWN0b3IueW1sCiAgICAgICAgdGFyZ2V0OiAvZXRjL3ZlY3Rvci92ZWN0b3IueW1sCiAgICAgICAgcmVhZF9vbmx5OiB0cnVlCiAgICAgICAgY29udGVudDogImFwaTpcbiAgZW5hYmxlZDogdHJ1ZVxuICBhZGRyZXNzOiAwLjAuMC4wOjkwMDFcblxuc291cmNlczpcbiAgZG9ja2VyX2hvc3Q6XG4gICAgdHlwZTogZG9ja2VyX2xvZ3NcbiAgICBleGNsdWRlX2NvbnRhaW5lcnM6XG4gICAgICAtIHN1cGFiYXNlLXZlY3RvclxuXG50cmFuc2Zvcm1zOlxuICBwcm9qZWN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIGRvY2tlcl9ob3N0XG4gICAgc291cmNlOiB8LVxuICAgICAgLnByb2plY3QgPSBcImRlZmF1bHRcIlxuICAgICAgLmV2ZW50X21lc3NhZ2UgPSBkZWwoLm1lc3NhZ2UpXG4gICAgICAuYXBwbmFtZSA9IGRlbCguY29udGFpbmVyX25hbWUpXG4gICAgICBkZWwoLmNvbnRhaW5lcl9jcmVhdGVkX2F0KVxuICAgICAgZGVsKC5jb250YWluZXJfaWQpXG4gICAgICBkZWwoLnNvdXJjZV90eXBlKVxuICAgICAgZGVsKC5zdHJlYW0pXG4gICAgICBkZWwoLmxhYmVsKVxuICAgICAgZGVsKC5pbWFnZSlcbiAgICAgIGRlbCguaG9zdClcbiAgICAgIGRlbCguc3RyZWFtKVxuICByb3V0ZXI6XG4gICAgdHlwZTogcm91dGVcbiAgICBpbnB1dHM6XG4gICAgICAtIHByb2plY3RfbG9nc1xuICAgIHJvdXRlOlxuICAgICAga29uZzogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWtvbmdcIiknXG4gICAgICBhdXRoOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2UtYXV0aFwiKSdcbiAgICAgIHJlc3Q6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1yZXN0XCIpJ1xuICAgICAgcmVhbHRpbWU6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJyZWFsdGltZS1kZXZcIiknXG4gICAgICBzdG9yYWdlOiAnY29udGFpbnMoc3RyaW5nISguYXBwbmFtZSksIFwic3VwYWJhc2Utc3RvcmFnZVwiKSdcbiAgICAgIGZ1bmN0aW9uczogJ2NvbnRhaW5zKHN0cmluZyEoLmFwcG5hbWUpLCBcInN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zXCIpJ1xuICAgICAgZGI6ICdjb250YWlucyhzdHJpbmchKC5hcHBuYW1lKSwgXCJzdXBhYmFzZS1kYlwiKSdcbiAgIyBJZ25vcmVzIG5vbiBuZ2lueCBlcnJvcnMgc2luY2UgdGhleSBhcmUgcmVsYXRlZCB3aXRoIGtvbmcgYm9vdGluZyB1cFxuICBrb25nX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5rb25nXG4gICAgc291cmNlOiB8LVxuICAgICAgcmVxLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiY29tYmluZWRcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcmVxLnRpbWVzdGFtcFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMucmVmZXJlciA9IHJlcS5yZWZlcmVyXG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy51c2VyX2FnZW50ID0gcmVxLmFnZW50XG4gICAgICAgICAgLm1ldGFkYXRhLnJlcXVlc3QuaGVhZGVycy5jZl9jb25uZWN0aW5nX2lwID0gcmVxLmNsaWVudFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IHJlcS5zdGF0dXNcbiAgICAgICAgICB1cmwsIHNwbGl0X2VyciA9IHNwbGl0KHJlcS5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBzcGxpdF9lcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIElnbm9yZXMgbm9uIG5naW54IGVycm9ycyBzaW5jZSB0aGV5IGFyZSByZWxhdGVkIHdpdGgga29uZyBib290aW5nIHVwXG4gIGtvbmdfZXJyOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIua29uZ1xuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IFwiR0VUXCJcbiAgICAgIC5tZXRhZGF0YS5yZXNwb25zZS5zdGF0dXNfY29kZSA9IDIwMFxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9uZ2lueF9sb2coLmV2ZW50X21lc3NhZ2UsIFwiZXJyb3JcIilcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAudGltZXN0YW1wID0gcGFyc2VkLnRpbWVzdGFtcFxuICAgICAgICAgIC5zZXZlcml0eSA9IHBhcnNlZC5zZXZlcml0eVxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lmhvc3QgPSBwYXJzZWQuaG9zdFxuICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LmhlYWRlcnMuY2ZfY29ubmVjdGluZ19pcCA9IHBhcnNlZC5jbGllbnRcbiAgICAgICAgICB1cmwsIGVyciA9IHNwbGl0KHBhcnNlZC5yZXF1ZXN0LCBcIiBcIilcbiAgICAgICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0Lm1ldGhvZCA9IHVybFswXVxuICAgICAgICAgICAgICAubWV0YWRhdGEucmVxdWVzdC5wYXRoID0gdXJsWzFdXG4gICAgICAgICAgICAgIC5tZXRhZGF0YS5yZXF1ZXN0LnByb3RvY29sID0gdXJsWzJdXG4gICAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgZXJyICE9IG51bGwge1xuICAgICAgICBhYm9ydFxuICAgICAgfVxuICAjIEdvdHJ1ZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIGpzb24gc3RyaW5ncyB3aGljaCBmcm9udGVuZCBwYXJzZXMgZGlyZWN0bHkuIEJ1dCB3ZSBrZWVwIG1ldGFkYXRhIGZvciBjb25zaXN0ZW5jeS5cbiAgYXV0aF9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuYXV0aFxuICAgIHNvdXJjZTogfC1cbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEgPSBtZXJnZSEoLm1ldGFkYXRhLCBwYXJzZWQpXG4gICAgICB9XG4gICMgUG9zdGdSRVNUIGxvZ3MgYXJlIHN0cnVjdHVyZWQgc28gd2Ugc2VwYXJhdGUgdGltZXN0YW1wIGZyb20gbWVzc2FnZSB1c2luZyByZWdleFxuICByZXN0X2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5yZXN0XG4gICAgc291cmNlOiB8LVxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcideKD9QPHRpbWU+LiopOiAoP1A8bXNnPi4qKSQnKVxuICAgICAgaWYgZXJyID09IG51bGwge1xuICAgICAgICAgIC5ldmVudF9tZXNzYWdlID0gcGFyc2VkLm1zZ1xuICAgICAgICAgIC50aW1lc3RhbXAgPSBwYXJzZV90aW1lc3RhbXAhKHZhbHVlOiBwYXJzZWQudGltZSwgZm9ybWF0OiBcIiVkLyViLyVZOiVIOiVNOiVTICV6XCIpXG4gICAgICAgICAgLm1ldGFkYXRhLmhvc3QgPSAucHJvamVjdFxuICAgICAgfVxuICAjIEZpbHRlciBvdXQgaGVhbHRoY2hlY2sgbG9ncyBmcm9tIFJlYWx0aW1lXG4gIHJlYWx0aW1lX2xvZ3NfZmlsdGVyZWQ6XG4gICAgdHlwZTogZmlsdGVyXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIucmVhbHRpbWVcbiAgICBjb25kaXRpb246ICchY29udGFpbnMoc3RyaW5nISguZXZlbnRfbWVzc2FnZSksIFwiL2hlYWx0aFwiKSdcbiAgIyBSZWFsdGltZSBsb2dzIGFyZSBzdHJ1Y3R1cmVkIHNvIHdlIHBhcnNlIHRoZSBzZXZlcml0eSBsZXZlbCB1c2luZyByZWdleCAoaWdub3JlIHRpbWUgYmVjYXVzZSBpdCBoYXMgbm8gZGF0ZSlcbiAgcmVhbHRpbWVfbG9nczpcbiAgICB0eXBlOiByZW1hcFxuICAgIGlucHV0czpcbiAgICAgIC0gcmVhbHRpbWVfbG9nc19maWx0ZXJlZFxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLmV4dGVybmFsX2lkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfcmVnZXgoLmV2ZW50X21lc3NhZ2UsIHInXig/UDx0aW1lPlxcZCs6XFxkKzpcXGQrXFwuXFxkKykgXFxbKD9QPGxldmVsPlxcdyspXFxdICg/UDxtc2c+LiopJCcpXG4gICAgICBpZiBlcnIgPT0gbnVsbCB7XG4gICAgICAgICAgLmV2ZW50X21lc3NhZ2UgPSBwYXJzZWQubXNnXG4gICAgICAgICAgLm1ldGFkYXRhLmxldmVsID0gcGFyc2VkLmxldmVsXG4gICAgICB9XG4gICMgU3RvcmFnZSBsb2dzIG1heSBjb250YWluIGpzb24gb2JqZWN0cyBzbyB3ZSBwYXJzZSB0aGVtIGZvciBjb21wbGV0ZW5lc3NcbiAgc3RvcmFnZV9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuc3RvcmFnZVxuICAgIHNvdXJjZTogfC1cbiAgICAgIC5tZXRhZGF0YS5wcm9qZWN0ID0gZGVsKC5wcm9qZWN0KVxuICAgICAgLm1ldGFkYXRhLnRlbmFudElkID0gLm1ldGFkYXRhLnByb2plY3RcbiAgICAgIHBhcnNlZCwgZXJyID0gcGFyc2VfanNvbiguZXZlbnRfbWVzc2FnZSlcbiAgICAgIGlmIGVyciA9PSBudWxsIHtcbiAgICAgICAgICAuZXZlbnRfbWVzc2FnZSA9IHBhcnNlZC5tc2dcbiAgICAgICAgICAubWV0YWRhdGEubGV2ZWwgPSBwYXJzZWQubGV2ZWxcbiAgICAgICAgICAubWV0YWRhdGEudGltZXN0YW1wID0gcGFyc2VkLnRpbWVcbiAgICAgICAgICAubWV0YWRhdGEuY29udGV4dFswXS5ob3N0ID0gcGFyc2VkLmhvc3RuYW1lXG4gICAgICAgICAgLm1ldGFkYXRhLmNvbnRleHRbMF0ucGlkID0gcGFyc2VkLnBpZFxuICAgICAgfVxuICAjIEZ1bmN0aW9uIGxvZ3MgYXJlIHVuc3RydWN0dXJlZCBtZXNzYWdlcyBvbiBzdGRlcnJcbiAgZnVuY3Rpb25zX2xvZ3M6XG4gICAgdHlwZTogcmVtYXBcbiAgICBpbnB1dHM6XG4gICAgICAtIHJvdXRlci5mdW5jdGlvbnNcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEucHJvamVjdF9yZWYgPSBkZWwoLnByb2plY3QpXG4gICMgUG9zdGdyZXMgbG9ncyBzb21lIG1lc3NhZ2VzIHRvIHN0ZGVyciB3aGljaCB3ZSBtYXAgdG8gd2FybmluZyBzZXZlcml0eSBsZXZlbFxuICBkYl9sb2dzOlxuICAgIHR5cGU6IHJlbWFwXG4gICAgaW5wdXRzOlxuICAgICAgLSByb3V0ZXIuZGJcbiAgICBzb3VyY2U6IHwtXG4gICAgICAubWV0YWRhdGEuaG9zdCA9IFwiZGItZGVmYXVsdFwiXG4gICAgICAubWV0YWRhdGEucGFyc2VkLnRpbWVzdGFtcCA9IC50aW1lc3RhbXBcblxuICAgICAgcGFyc2VkLCBlcnIgPSBwYXJzZV9yZWdleCguZXZlbnRfbWVzc2FnZSwgcicuKig/UDxsZXZlbD5JTkZPfE5PVElDRXxXQVJOSU5HfEVSUk9SfExPR3xGQVRBTHxQQU5JQz8pOi4qJywgbnVtZXJpY19ncm91cHM6IHRydWUpXG5cbiAgICAgIGlmIGVyciAhPSBudWxsIHx8IHBhcnNlZCA9PSBudWxsIHtcbiAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwiaW5mb1wiXG4gICAgICB9XG4gICAgICBpZiBwYXJzZWQubGV2ZWwgIT0gbnVsbCB7XG4gICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IHBhcnNlZC5sZXZlbFxuICAgICAgfVxuICAgICAgaWYgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9PSBcImluZm9cIiB7XG4gICAgICAgICAgLm1ldGFkYXRhLnBhcnNlZC5lcnJvcl9zZXZlcml0eSA9IFwibG9nXCJcbiAgICAgIH1cbiAgICAgIC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkgPSB1cGNhc2UhKC5tZXRhZGF0YS5wYXJzZWQuZXJyb3Jfc2V2ZXJpdHkpXG5cbnNpbmtzOlxuICBsb2dmbGFyZV9hdXRoOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gYXV0aF9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1nb3RydWUubG9ncy5wcm9kJ1xuICBsb2dmbGFyZV9yZWFsdGltZTpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlYWx0aW1lX2xvZ3NcbiAgICBlbmNvZGluZzpcbiAgICAgIGNvZGVjOiAnanNvbidcbiAgICBtZXRob2Q6ICdwb3N0J1xuICAgIHJlcXVlc3Q6XG4gICAgICByZXRyeV9tYXhfZHVyYXRpb25fc2VjczogMzBcbiAgICAgIHJldHJ5X2luaXRpYWxfYmFja29mZl9zZWNzOiAxXG4gICAgICBoZWFkZXJzOlxuICAgICAgICB4LWFwaS1rZXk6ICcke0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4/TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTiBpcyByZXF1aXJlZH0nXG4gICAgdXJpOiAnaHR0cDovL3N1cGFiYXNlLWFuYWx5dGljczo0MDAwL2FwaS9sb2dzP3NvdXJjZV9uYW1lPXJlYWx0aW1lLmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfcmVzdDpcbiAgICB0eXBlOiAnaHR0cCdcbiAgICBpbnB1dHM6XG4gICAgICAtIHJlc3RfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9cG9zdGdSRVNULmxvZ3MucHJvZCdcbiAgbG9nZmxhcmVfZGI6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBkYl9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1wb3N0Z3Jlcy5sb2dzJ1xuICBsb2dmbGFyZV9mdW5jdGlvbnM6XG4gICAgdHlwZTogJ2h0dHAnXG4gICAgaW5wdXRzOlxuICAgICAgLSBmdW5jdGlvbnNfbG9nc1xuICAgIGVuY29kaW5nOlxuICAgICAgY29kZWM6ICdqc29uJ1xuICAgIG1ldGhvZDogJ3Bvc3QnXG4gICAgcmVxdWVzdDpcbiAgICAgIHJldHJ5X21heF9kdXJhdGlvbl9zZWNzOiAzMFxuICAgICAgcmV0cnlfaW5pdGlhbF9iYWNrb2ZmX3NlY3M6IDFcbiAgICAgIGhlYWRlcnM6XG4gICAgICAgIHgtYXBpLWtleTogJyR7TE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj9MT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOIGlzIHJlcXVpcmVkfSdcbiAgICB1cmk6ICdodHRwOi8vc3VwYWJhc2UtYW5hbHl0aWNzOjQwMDAvYXBpL2xvZ3M/c291cmNlX25hbWU9ZGVuby1yZWxheS1sb2dzJ1xuICBsb2dmbGFyZV9zdG9yYWdlOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0gc3RvcmFnZV9sb2dzXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1zdG9yYWdlLmxvZ3MucHJvZC4yJ1xuICBsb2dmbGFyZV9rb25nOlxuICAgIHR5cGU6ICdodHRwJ1xuICAgIGlucHV0czpcbiAgICAgIC0ga29uZ19sb2dzXG4gICAgICAtIGtvbmdfZXJyXG4gICAgZW5jb2Rpbmc6XG4gICAgICBjb2RlYzogJ2pzb24nXG4gICAgbWV0aG9kOiAncG9zdCdcbiAgICByZXF1ZXN0OlxuICAgICAgcmV0cnlfbWF4X2R1cmF0aW9uX3NlY3M6IDMwXG4gICAgICByZXRyeV9pbml0aWFsX2JhY2tvZmZfc2VjczogMVxuICAgICAgaGVhZGVyczpcbiAgICAgICAgeC1hcGkta2V5OiAnJHtMT0dGTEFSRV9QVUJMSUNfQUNDRVNTX1RPS0VOP0xPR0ZMQVJFX1BVQkxJQ19BQ0NFU1NfVE9LRU4gaXMgcmVxdWlyZWR9J1xuICAgIHVyaTogJ2h0dHA6Ly9zdXBhYmFzZS1hbmFseXRpY3M6NDAwMC9hcGkvbG9ncz9zb3VyY2VfbmFtZT1jbG91ZGZsYXJlLmxvZ3MucHJvZCdcbiIKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2s6cm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTE9HRkxBUkVfUFVCTElDX0FDQ0VTU19UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfTE9HRkxBUkV9JwogICAgY29tbWFuZDoKICAgICAgLSAnLS1jb25maWcnCiAgICAgIC0gL2V0Yy92ZWN0b3IvdmVjdG9yLnltbAogIHN1cGFiYXNlLXJlc3Q6CiAgICBpbWFnZTogJ3Bvc3RncmVzdC9wb3N0Z3Jlc3Q6djE0LjYnCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudmlyb25tZW50OgogICAgICAtICdQR1JTVF9EQl9VUkk9cG9zdGdyZXM6Ly9hdXRoZW50aWNhdG9yOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vJHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQR1JTVF9EQl9TQ0hFTUFTPSR7UEdSU1RfREJfU0NIRU1BUzotcHVibGljLHN0b3JhZ2UsZ3JhcGhxbF9wdWJsaWN9JwogICAgICAtICdQR1JTVF9EQl9NQVhfUk9XUz0ke1BHUlNUX0RCX01BWF9ST1dTOi0xMDAwfScKICAgICAgLSAnUEdSU1RfREJfRVhUUkFfU0VBUkNIX1BBVEg9JHtQR1JTVF9EQl9FWFRSQV9TRUFSQ0hfUEFUSDotcHVibGljfScKICAgICAgLSBQR1JTVF9EQl9BTk9OX1JPTEU9YW5vbgogICAgICAtICdQR1JTVF9KV1RfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KV1R9JwogICAgICAtIFBHUlNUX0RCX1VTRV9MRUdBQ1lfR1VDUz1mYWxzZQogICAgICAtICdQR1JTVF9BUFBfU0VUVElOR1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnUEdSU1RfQVBQX1NFVFRJTkdTX0pXVF9FWFA9JHtKV1RfRVhQSVJZOi0zNjAwfScKICAgIGNvbW1hbmQ6IHBvc3RncmVzdAogICAgZXhjbHVkZV9mcm9tX2hjOiB0cnVlCiAgc3VwYWJhc2UtYXV0aDoKICAgIGltYWdlOiAnc3VwYWJhc2UvZ290cnVlOnYyLjE4Ni4wJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo5OTk5L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIEdPVFJVRV9BUElfSE9TVD0wLjAuMC4wCiAgICAgIC0gR09UUlVFX0FQSV9QT1JUPTk5OTkKICAgICAgLSAnQVBJX0VYVEVSTkFMX1VSTD0ke0FQSV9FWFRFUk5BTF9VUkw6LWh0dHA6Ly9zdXBhYmFzZS1rb25nOjgwMDB9JwogICAgICAtIEdPVFJVRV9EQl9EUklWRVI9cG9zdGdyZXMKICAgICAgLSAnR09UUlVFX0RCX0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovL3N1cGFiYXNlX2F1dGhfYWRtaW46JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0dPVFJVRV9TSVRFX1VSTD0ke0dPVFJVRV9TSVRFX1VSTDotJHtTRVJWSUNFX0ZRRE5fU1VQQUJBU0VLT05HfX0nCiAgICAgIC0gJ0dPVFJVRV9VUklfQUxMT1dfTElTVD0ke0FERElUSU9OQUxfUkVESVJFQ1RfVVJMU30nCiAgICAgIC0gJ0dPVFJVRV9ESVNBQkxFX1NJR05VUD0ke0RJU0FCTEVfU0lHTlVQOi1mYWxzZX0nCiAgICAgIC0gR09UUlVFX0pXVF9BRE1JTl9ST0xFUz1zZXJ2aWNlX3JvbGUKICAgICAgLSBHT1RSVUVfSldUX0FVRD1hdXRoZW50aWNhdGVkCiAgICAgIC0gR09UUlVFX0pXVF9ERUZBVUxUX0dST1VQX05BTUU9YXV0aGVudGljYXRlZAogICAgICAtICdHT1RSVUVfSldUX0VYUD0ke0pXVF9FWFBJUlk6LTM2MDB9JwogICAgICAtICdHT1RSVUVfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX0VNQUlMX0VOQUJMRUQ9JHtFTkFCTEVfRU1BSUxfU0lHTlVQOi10cnVlfScKICAgICAgLSAnR09UUlVFX0VYVEVSTkFMX0FOT05ZTU9VU19VU0VSU19FTkFCTEVEPSR7RU5BQkxFX0FOT05ZTU9VU19VU0VSUzotZmFsc2V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX0FVVE9DT05GSVJNPSR7RU5BQkxFX0VNQUlMX0FVVE9DT05GSVJNOi1mYWxzZX0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0FETUlOX0VNQUlMPSR7U01UUF9BRE1JTl9FTUFJTH0nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdHT1RSVUVfU01UUF9QT1JUPSR7U01UUF9QT1JUOi01ODd9JwogICAgICAtICdHT1RSVUVfU01UUF9VU0VSPSR7U01UUF9VU0VSfScKICAgICAgLSAnR09UUlVFX1NNVFBfUEFTUz0ke1NNVFBfUEFTU30nCiAgICAgIC0gJ0dPVFJVRV9TTVRQX1NFTkRFUl9OQU1FPSR7U01UUF9TRU5ERVJfTkFNRX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVVJMUEFUSFNfSU5WSVRFPSR7TUFJTEVSX1VSTFBBVEhTX0lOVklURTotL2F1dGgvdjEvdmVyaWZ5fScKICAgICAgLSAnR09UUlVFX01BSUxFUl9VUkxQQVRIU19DT05GSVJNQVRJT049JHtNQUlMRVJfVVJMUEFUSFNfQ09ORklSTUFUSU9OOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX1JFQ09WRVJZPSR7TUFJTEVSX1VSTFBBVEhTX1JFQ09WRVJZOi0vYXV0aC92MS92ZXJpZnl9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1VSTFBBVEhTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9VUkxQQVRIU19FTUFJTF9DSEFOR0U6LS9hdXRoL3YxL3ZlcmlmeX0nCiAgICAgIC0gJ0dPVFJVRV9NQUlMRVJfVEVNUExBVEVTX0lOVklURT0ke01BSUxFUl9URU1QTEFURVNfSU5WSVRFfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfQ09ORklSTUFUSU9OPSR7TUFJTEVSX1RFTVBMQVRFU19DT05GSVJNQVRJT059JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19SRUNPVkVSWT0ke01BSUxFUl9URU1QTEFURVNfUkVDT1ZFUll9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1RFTVBMQVRFU19NQUdJQ19MSU5LPSR7TUFJTEVSX1RFTVBMQVRFU19NQUdJQ19MSU5LfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9URU1QTEFURVNfRU1BSUxfQ0hBTkdFPSR7TUFJTEVSX1RFTVBMQVRFU19FTUFJTF9DSEFOR0V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0NPTkZJUk1BVElPTj0ke01BSUxFUl9TVUJKRUNUU19DT05GSVJNQVRJT059JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX1JFQ09WRVJZPSR7TUFJTEVSX1NVQkpFQ1RTX1JFQ09WRVJZfScKICAgICAgLSAnR09UUlVFX01BSUxFUl9TVUJKRUNUU19NQUdJQ19MSU5LPSR7TUFJTEVSX1NVQkpFQ1RTX01BR0lDX0xJTkt9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0VNQUlMX0NIQU5HRT0ke01BSUxFUl9TVUJKRUNUU19FTUFJTF9DSEFOR0V9JwogICAgICAtICdHT1RSVUVfTUFJTEVSX1NVQkpFQ1RTX0lOVklURT0ke01BSUxFUl9TVUJKRUNUU19JTlZJVEV9JwogICAgICAtICdHT1RSVUVfRVhURVJOQUxfUEhPTkVfRU5BQkxFRD0ke0VOQUJMRV9QSE9ORV9TSUdOVVA6LXRydWV9JwogICAgICAtICdHT1RSVUVfU01TX0FVVE9DT05GSVJNPSR7RU5BQkxFX1BIT05FX0FVVE9DT05GSVJNOi10cnVlfScKICByZWFsdGltZS1kZXY6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3JlYWx0aW1lOnYyLjc2LjUnCiAgICBjb250YWluZXJfbmFtZTogcmVhbHRpbWUtZGV2LnN1cGFiYXNlLXJlYWx0aW1lCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1hbmFseXRpY3M6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLXNTZkwnCiAgICAgICAgLSAnLS1oZWFkJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjQwMDAvYXBpL3RlbmFudHMvcmVhbHRpbWUtZGV2L2hlYWx0aCcKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgIGVudmlyb25tZW50OgogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdEQl9IT1NUPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnREJfUE9SVD0ke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9JwogICAgICAtIERCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnREJfTkFNRT0ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ0RCX0FGVEVSX0NPTk5FQ1RfUVVFUlk9U0VUIHNlYXJjaF9wYXRoIFRPIF9yZWFsdGltZScKICAgICAgLSBEQl9FTkNfS0VZPXN1cGFiYXNlcmVhbHRpbWUKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NFQ1JFVF9LRVlfQkFTRT0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVBTFRJTUV9JwogICAgICAtICdNRVRSSUNTX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ0VSTF9BRkxBR1M9LXByb3RvX2Rpc3QgaW5ldF90Y3AnCiAgICAgIC0gIkROU19OT0RFUz0nJyIKICAgICAgLSBSTElNSVRfTk9GSUxFPTEwMDAwCiAgICAgIC0gQVBQX05BTUU9cmVhbHRpbWUKICAgICAgLSBTRUVEX1NFTEZfSE9TVD10cnVlCiAgICAgIC0gTE9HX0xFVkVMPWVycm9yCiAgICAgIC0gUlVOX0pBTklUT1I9dHJ1ZQogICAgICAtIEpBTklUT1JfSU5URVJWQUw9NjAwMDAKICAgICAgLSBESVNBQkxFX0hFQUxUSENIRUNLX0xPR0dJTkc9dHJ1ZQogICAgY29tbWFuZDogInNoIC1jIFwiL2FwcC9iaW4vbWlncmF0ZSAmJiAvYXBwL2Jpbi9yZWFsdGltZSBldmFsICdSZWFsdGltZS5SZWxlYXNlLnNlZWRzKFJlYWx0aW1lLlJlcG8pJyAmJiAvYXBwL2Jpbi9zZXJ2ZXJcIlxuIgogIHN1cGFiYXNlLW1pbmlvOgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgY29tbWFuZDogJ3NlcnZlciAtLWNvbnNvbGUtYWRkcmVzcyAiOjkwMDEiIC9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG1jCiAgICAgICAgLSByZWFkeQogICAgICAgIC0gbG9jYWwKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL3N0b3JhZ2U6L2RhdGEnCiAgbWluaW8tY3JlYXRlYnVja2V0OgogICAgaW1hZ2U6ICdwZ3N0eS9zaWxvOlJFTEVBU0UuMjAyNi0xMC0xNVQwMC0wMC0wMFonCiAgICByZXN0YXJ0OiAnbm8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUlOSU9fUk9PVF9VU0VSPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnTUlOSU9fUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUlOSU99JwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtbWluaW86CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGVudHJ5cG9pbnQ6CiAgICAgIC0gL2VudHJ5cG9pbnQuc2gKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL2VudHJ5cG9pbnQuc2gKICAgICAgICB0YXJnZXQ6IC9lbnRyeXBvaW50LnNoCiAgICAgICAgY29udGVudDogIiMhL2Jpbi9zaFxuL3Vzci9iaW4vbWMgYWxpYXMgc2V0IHN1cGFiYXNlLW1pbmlvIGh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwICR7TUlOSU9fUk9PVF9VU0VSfSAke01JTklPX1JPT1RfUEFTU1dPUkR9O1xuL3Vzci9iaW4vbWMgbWIgLS1pZ25vcmUtZXhpc3Rpbmcgc3VwYWJhc2UtbWluaW8vc3R1YjtcbmV4aXQgMFxuIgogIHN1cGFiYXNlLXN0b3JhZ2U6CiAgICBpbWFnZTogJ3N1cGFiYXNlL3N0b3JhZ2UtYXBpOnYxLjQ0LjInCiAgICBkZXBlbmRzX29uOgogICAgICBzdXBhYmFzZS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICBzdXBhYmFzZS1yZXN0OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICAgIGltZ3Byb3h5OgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy0tbm8tdmVyYm9zZScKICAgICAgICAtICctLXRyaWVzPTEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo1MDAwL3N0YXR1cycKICAgICAgdGltZW91dDogNXMKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHJldHJpZXM6IDMKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZFUl9QT1JUPTUwMDAKICAgICAgLSBTRVJWRVJfUkVHSU9OPWxvY2FsCiAgICAgIC0gTVVMVElfVEVOQU5UPWZhbHNlCiAgICAgIC0gJ0FVVEhfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vc3VwYWJhc2Vfc3RvcmFnZV9hZG1pbjoke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9QCR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifToke1BPU1RHUkVTX1BPUlQ6LTU0MzJ9LyR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBEQl9JTlNUQUxMX1JPTEVTPWZhbHNlCiAgICAgIC0gU1RPUkFHRV9CQUNLRU5EPXMzCiAgICAgIC0gU1RPUkFHRV9TM19CVUNLRVQ9c3R1YgogICAgICAtICdTVE9SQUdFX1MzX0VORFBPSU5UPWh0dHA6Ly9zdXBhYmFzZS1taW5pbzo5MDAwJwogICAgICAtIFNUT1JBR0VfUzNfRk9SQ0VfUEFUSF9TVFlMRT10cnVlCiAgICAgIC0gU1RPUkFHRV9TM19SRUdJT049dXMtZWFzdC0xCiAgICAgIC0gJ0FXU19BQ0NFU1NfS0VZX0lEPSR7U0VSVklDRV9VU0VSX01JTklPfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7U0VSVklDRV9QQVNTV09SRF9NSU5JT30nCiAgICAgIC0gVVBMT0FEX0ZJTEVfU0laRV9MSU1JVD01MjQyODgwMDAKICAgICAgLSBVUExPQURfRklMRV9TSVpFX0xJTUlUX1NUQU5EQVJEPTUyNDI4ODAwMAogICAgICAtIFVQTE9BRF9TSUdORURfVVJMX0VYUElSQVRJT05fVElNRT0xMjAKICAgICAgLSBUVVNfVVJMX1BBVEg9L3VwbG9hZC9yZXN1bWFibGUKICAgICAgLSBUVVNfTUFYX1NJWkU9MzYwMDAwMAogICAgICAtIEVOQUJMRV9JTUFHRV9UUkFOU0ZPUk1BVElPTj10cnVlCiAgICAgIC0gJ0lNR1BST1hZX1VSTD1odHRwOi8vaW1ncHJveHk6ODA4MCcKICAgICAgLSBJTUdQUk9YWV9SRVFVRVNUX1RJTUVPVVQ9MTUKICAgICAgLSBEQVRBQkFTRV9TRUFSQ0hfUEFUSD1zdG9yYWdlCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtIFJFUVVFU1RfQUxMT1dfWF9GT1JXQVJERURfUEFUSD10cnVlCiAgICAgIC0gJ0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU0VSVklDRV9LRVk9JHtTRVJWSUNFX1NVUEFCQVNFU0VSVklDRV9LRVl9JwogICAgICAtICdQT1NUR1JFU1RfVVJMPWh0dHA6Ly9zdXBhYmFzZS1yZXN0OjMwMDAnCiAgICAgIC0gJ1BHUlNUX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NUT1JBR0VfUFVCTElDX1VSTD0ke1NFUlZJQ0VfRlFETl9TVVBBQkFTRUtPTkd9JwogICAgICAtICdURU5BTlRfSUQ9JHtTVE9SQUdFX1RFTkFOVF9JRDotc3RvcmFnZS1zaW5nbGUtdGVuYW50fScKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgaW1ncHJveHk6CiAgICBpbWFnZTogJ2RhcnRoc2ltL2ltZ3Byb3h5OnYzLjMwLjEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaW1ncHJveHkKICAgICAgICAtIGhlYWx0aAogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0lNR1BST1hZX0JJTkQ9OjgwODAnCiAgICAgIC0gSU1HUFJPWFlfTE9DQUxfRklMRVNZU1RFTV9ST09UPS8KICAgICAgLSBJTUdQUk9YWV9VU0VfRVRBRz10cnVlCiAgICAgIC0gJ0lNR1BST1hZX0FVVE9fV0VCUD0ke0lNR1BST1hZX0FVVE9fV0VCUDotdHJ1ZX0nCiAgICAgIC0gSU1HUFJPWFlfTUFYX1NSQ19SRVNPTFVUSU9OPTE2LjgKICAgIHZvbHVtZXM6CiAgICAgIC0gJy4vdm9sdW1lcy9zdG9yYWdlOi92YXIvbGliL3N0b3JhZ2UnCiAgc3VwYWJhc2UtbWV0YToKICAgIGltYWdlOiAnc3VwYWJhc2UvcG9zdGdyZXMtbWV0YTp2MC45NS4yJwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQR19NRVRBX1BPUlQ9ODA4MAogICAgICAtICdQR19NRVRBX0RCX0hPU1Q9JHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9JwogICAgICAtICdQR19NRVRBX0RCX1BPUlQ9JHtQT1NUR1JFU19QT1JUOi01NDMyfScKICAgICAgLSAnUEdfTUVUQV9EQl9OQU1FPSR7UE9TVEdSRVNfREI6LXBvc3RncmVzfScKICAgICAgLSBQR19NRVRBX0RCX1VTRVI9c3VwYWJhc2VfYWRtaW4KICAgICAgLSAnUEdfTUVUQV9EQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdDUllQVE9fS0VZPSR7U0VSVklDRV9QQVNTV09SRF9QR01FVEFDUllQVE99JwogIHN1cGFiYXNlLWVkZ2UtZnVuY3Rpb25zOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9lZGdlLXJ1bnRpbWU6djEuNzEuMicKICAgIGRlcGVuZHNfb246CiAgICAgIHN1cGFiYXNlLWFuYWx5dGljczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGVjaG8KICAgICAgICAtICdFZGdlIEZ1bmN0aW9ucyBpcyBoZWFsdGh5JwogICAgICB0aW1lb3V0OiA1cwogICAgICBpbnRlcnZhbDogNXMKICAgICAgcmV0cmllczogMwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ1NVUEFCQVNFX1VSTD1odHRwOi8vc3VwYWJhc2Uta29uZzo4MDAwJwogICAgICAtICdTVVBBQkFTRV9QVUJMSUNfVVJMPSR7U0VSVklDRV9GUUROX1NVUEFCQVNFS09OR30nCiAgICAgIC0gJ1NVUEFCQVNFX0FOT05fS0VZPSR7U0VSVklDRV9TVVBBQkFTRUFOT05fS0VZfScKICAgICAgLSAnU1VQQUJBU0VfU0VSVklDRV9ST0xFX0tFWT0ke1NFUlZJQ0VfU1VQQUJBU0VTRVJWSUNFX0tFWX0nCiAgICAgIC0gJ1NVUEFCQVNFX0RCX1VSTD1wb3N0Z3Jlc3FsOi8vcG9zdGdyZXM6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUAke1BPU1RHUkVTX0hPU1ROQU1FOi1zdXBhYmFzZS1kYn06JHtQT1NUR1JFU19QT1JUOi01NDMyfS8ke1BPU1RHUkVTX0RCOi1wb3N0Z3Jlc30nCiAgICAgIC0gJ1ZFUklGWV9KV1Q9JHtGVU5DVElPTlNfVkVSSUZZX0pXVDotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnLi92b2x1bWVzL2Z1bmN0aW9uczovaG9tZS9kZW5vL2Z1bmN0aW9ucycKICAgICAgLSAnZGVuby1jYWNoZTovcm9vdC8uY2FjaGUvZGVubycKICAgICAgLQogICAgICAgIHR5cGU6IGJpbmQKICAgICAgICBzb3VyY2U6IC4vdm9sdW1lcy9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvbWFpbi9pbmRleC50cwogICAgICAgIGNvbnRlbnQ6ICJpbXBvcnQgKiBhcyBqb3NlIGZyb20gJ2h0dHBzOi8vZGVuby5sYW5kL3gvam9zZUB2NC4xNC40L2luZGV4LnRzJ1xuXG5jb25zb2xlLmxvZygnbWFpbiBmdW5jdGlvbiBzdGFydGVkJylcblxuY29uc3QgSldUX1NFQ1JFVCA9IERlbm8uZW52LmdldCgnSldUX1NFQ1JFVCcpXG5jb25zdCBTVVBBQkFTRV9VUkwgPSBEZW5vLmVudi5nZXQoJ1NVUEFCQVNFX1VSTCcpXG5jb25zdCBWRVJJRllfSldUID0gRGVuby5lbnYuZ2V0KCdWRVJJRllfSldUJykgPT09ICd0cnVlJ1xuXG4vLyBDcmVhdGUgSldLUyBmb3IgRVMyNTYvUlMyNTYgdG9rZW5zIChuZXdlciB0b2tlbnMpXG5sZXQgU1VQQUJBU0VfSldUX0tFWVM6IFJldHVyblR5cGU8dHlwZW9mIGpvc2UuY3JlYXRlUmVtb3RlSldLU2V0PiB8IG51bGwgPSBudWxsXG5pZiAoU1VQQUJBU0VfVVJMKSB7XG4gIHRyeSB7XG4gICAgU1VQQUJBU0VfSldUX0tFWVMgPSBqb3NlLmNyZWF0ZVJlbW90ZUpXS1NldChcbiAgICAgIG5ldyBVUkwoJy9hdXRoL3YxLy53ZWxsLWtub3duL2p3a3MuanNvbicsIFNVUEFCQVNFX1VSTClcbiAgICApXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdGYWlsZWQgdG8gZmV0Y2ggSldLUyBmcm9tIFNVUEFCQVNFX1VSTDonLCBlKVxuICB9XG59XG5cbmZ1bmN0aW9uIGdldEF1dGhUb2tlbihyZXE6IFJlcXVlc3QpIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmdldCgnYXV0aG9yaXphdGlvbicpXG4gIGlmICghYXV0aEhlYWRlcikge1xuICAgIHRocm93IG5ldyBFcnJvcignTWlzc2luZyBhdXRob3JpemF0aW9uIGhlYWRlcicpXG4gIH1cbiAgY29uc3QgW2JlYXJlciwgdG9rZW5dID0gYXV0aEhlYWRlci5zcGxpdCgnICcpXG4gIGlmIChiZWFyZXIgIT09ICdCZWFyZXInKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBBdXRoIGhlYWRlciBpcyBub3QgJ0JlYXJlciB7dG9rZW59J2ApXG4gIH1cbiAgcmV0dXJuIHRva2VuXG59XG5cbmFzeW5jIGZ1bmN0aW9uIGlzVmFsaWRMZWdhY3lKV1Qoand0OiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFKV1RfU0VDUkVUKSB7XG4gICAgY29uc29sZS5lcnJvcignSldUX1NFQ1JFVCBub3QgYXZhaWxhYmxlIGZvciBIUzI1NiB0b2tlbiB2ZXJpZmljYXRpb24nKVxuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgY29uc3QgZW5jb2RlciA9IG5ldyBUZXh0RW5jb2RlcigpO1xuICBjb25zdCBzZWNyZXRLZXkgPSBlbmNvZGVyLmVuY29kZShKV1RfU0VDUkVUKVxuXG4gIHRyeSB7XG4gICAgYXdhaXQgam9zZS5qd3RWZXJpZnkoand0LCBzZWNyZXRLZXkpO1xuICB9IGNhdGNoIChlKSB7XG4gICAgY29uc29sZS5lcnJvcignU3ltbWV0cmljIExlZ2FjeSBKV1QgdmVyaWZpY2F0aW9uIGVycm9yJywgZSk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGlmICghU1VQQUJBU0VfSldUX0tFWVMpIHtcbiAgICBjb25zb2xlLmVycm9yKCdKV0tTIG5vdCBhdmFpbGFibGUgZm9yIEVTMjU2L1JTMjU2IHRva2VuIHZlcmlmaWNhdGlvbicpXG4gICAgcmV0dXJuIGZhbHNlXG4gIH1cblxuICB0cnkge1xuICAgIGF3YWl0IGpvc2Uuand0VmVyaWZ5KGp3dCwgU1VQQUJBU0VfSldUX0tFWVMpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zb2xlLmVycm9yKCdBc3ltbWV0cmljIEpXVCB2ZXJpZmljYXRpb24gZXJyb3InLCBlKTtcbiAgICByZXR1cm4gZmFsc2VcbiAgfVxuXG4gIHJldHVybiB0cnVlO1xufVxuXG5hc3luYyBmdW5jdGlvbiBpc1ZhbGlkSHlicmlkSldUKGp3dDogc3RyaW5nKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHsgYWxnOiBqd3RBbGdvcml0aG0gfSA9IGpvc2UuZGVjb2RlUHJvdGVjdGVkSGVhZGVyKGp3dClcblxuICBpZiAoand0QWxnb3JpdGhtID09PSAnSFMyNTYnKSB7XG4gICAgY29uc29sZS5sb2coYExlZ2FjeSB0b2tlbiB0eXBlIGRldGVjdGVkLCBhdHRlbXB0aW5nICR7and0QWxnb3JpdGhtfSB2ZXJpZmljYXRpb24uYClcblxuICAgIHJldHVybiBhd2FpdCBpc1ZhbGlkTGVnYWN5SldUKGp3dClcbiAgfVxuXG4gIGlmIChqd3RBbGdvcml0aG0gPT09ICdFUzI1NicgfHwgand0QWxnb3JpdGhtID09PSAnUlMyNTYnKSB7XG4gICAgcmV0dXJuIGF3YWl0IGlzVmFsaWRKV1Qoand0KVxuICB9XG5cbiAgcmV0dXJuIGZhbHNlO1xufVxuXG5EZW5vLnNlcnZlKGFzeW5jIChyZXE6IFJlcXVlc3QpID0+IHtcbiAgaWYgKHJlcS5tZXRob2QgIT09ICdPUFRJT05TJyAmJiBWRVJJRllfSldUKSB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRva2VuID0gZ2V0QXV0aFRva2VuKHJlcSlcbiAgICAgIGNvbnN0IGlzVmFsaWRKV1QgPSBhd2FpdCBpc1ZhbGlkSHlicmlkSldUKHRva2VuKTtcblxuICAgICAgaWYgKCFpc1ZhbGlkSldUKSB7XG4gICAgICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoeyBtc2c6ICdJbnZhbGlkIEpXVCcgfSksIHtcbiAgICAgICAgICBzdGF0dXM6IDQwMSxcbiAgICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICBjb25zb2xlLmVycm9yKGUpXG4gICAgICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KHsgbXNnOiBlLnRvU3RyaW5nKCkgfSksIHtcbiAgICAgICAgc3RhdHVzOiA0MDEsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgfSlcbiAgICB9XG4gIH1cblxuICBjb25zdCB1cmwgPSBuZXcgVVJMKHJlcS51cmwpXG4gIGNvbnN0IHsgcGF0aG5hbWUgfSA9IHVybFxuICBjb25zdCBwYXRoX3BhcnRzID0gcGF0aG5hbWUuc3BsaXQoJy8nKVxuICBjb25zdCBzZXJ2aWNlX25hbWUgPSBwYXRoX3BhcnRzWzFdXG5cbiAgaWYgKCFzZXJ2aWNlX25hbWUgfHwgc2VydmljZV9uYW1lID09PSAnJykge1xuICAgIGNvbnN0IGVycm9yID0geyBtc2c6ICdtaXNzaW5nIGZ1bmN0aW9uIG5hbWUgaW4gcmVxdWVzdCcgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDQwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cblxuICBjb25zdCBzZXJ2aWNlUGF0aCA9IGAvaG9tZS9kZW5vL2Z1bmN0aW9ucy8ke3NlcnZpY2VfbmFtZX1gXG4gIGNvbnNvbGUuZXJyb3IoYHNlcnZpbmcgdGhlIHJlcXVlc3Qgd2l0aCAke3NlcnZpY2VQYXRofWApXG5cbiAgY29uc3QgbWVtb3J5TGltaXRNYiA9IDE1MFxuICBjb25zdCB3b3JrZXJUaW1lb3V0TXMgPSAxICogNjAgKiAxMDAwXG4gIGNvbnN0IG5vTW9kdWxlQ2FjaGUgPSBmYWxzZVxuICBjb25zdCBpbXBvcnRNYXBQYXRoID0gbnVsbFxuICBjb25zdCBlbnZWYXJzT2JqID0gRGVuby5lbnYudG9PYmplY3QoKVxuICBjb25zdCBlbnZWYXJzID0gT2JqZWN0LmtleXMoZW52VmFyc09iaikubWFwKChrKSA9PiBbaywgZW52VmFyc09ialtrXV0pXG5cbiAgdHJ5IHtcbiAgICBjb25zdCB3b3JrZXIgPSBhd2FpdCBFZGdlUnVudGltZS51c2VyV29ya2Vycy5jcmVhdGUoe1xuICAgICAgc2VydmljZVBhdGgsXG4gICAgICBtZW1vcnlMaW1pdE1iLFxuICAgICAgd29ya2VyVGltZW91dE1zLFxuICAgICAgbm9Nb2R1bGVDYWNoZSxcbiAgICAgIGltcG9ydE1hcFBhdGgsXG4gICAgICBlbnZWYXJzLFxuICAgIH0pXG4gICAgcmV0dXJuIGF3YWl0IHdvcmtlci5mZXRjaChyZXEpXG4gIH0gY2F0Y2ggKGUpIHtcbiAgICBjb25zdCBlcnJvciA9IHsgbXNnOiBlLnRvU3RyaW5nKCkgfVxuICAgIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoZXJyb3IpLCB7XG4gICAgICBzdGF0dXM6IDUwMCxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgIH0pXG4gIH1cbn0pIgogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogLi92b2x1bWVzL2Z1bmN0aW9ucy9oZWxsby9pbmRleC50cwogICAgICAgIHRhcmdldDogL2hvbWUvZGVuby9mdW5jdGlvbnMvaGVsbG8vaW5kZXgudHMKICAgICAgICBjb250ZW50OiAiLy8gRm9sbG93IHRoaXMgc2V0dXAgZ3VpZGUgdG8gaW50ZWdyYXRlIHRoZSBEZW5vIGxhbmd1YWdlIHNlcnZlciB3aXRoIHlvdXIgZWRpdG9yOlxuLy8gaHR0cHM6Ly9kZW5vLmxhbmQvbWFudWFsL2dldHRpbmdfc3RhcnRlZC9zZXR1cF95b3VyX2Vudmlyb25tZW50XG4vLyBUaGlzIGVuYWJsZXMgYXV0b2NvbXBsZXRlLCBnbyB0byBkZWZpbml0aW9uLCBldGMuXG5cbkRlbm8uc2VydmUoYXN5bmMgKCkgPT4ge1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKFxuICAgIGBcIkhlbGxvIGZyb20gRWRnZSBGdW5jdGlvbnMhXCJgLFxuICAgIHsgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9IH0sXG4gIClcbn0pXG5cbi8vIFRvIGludm9rZTpcbi8vIGN1cmwgJ2h0dHA6Ly9sb2NhbGhvc3Q6PEtPTkdfSFRUUF9QT1JUPi9mdW5jdGlvbnMvdjEvaGVsbG8nIFxcXG4vLyAgIC0taGVhZGVyICdBdXRob3JpemF0aW9uOiBCZWFyZXIgPGFub24vc2VydmljZV9yb2xlIEFQSSBrZXk+J1xuIgogICAgY29tbWFuZDoKICAgICAgLSBzdGFydAogICAgICAtICctLW1haW4tc2VydmljZScKICAgICAgLSAvaG9tZS9kZW5vL2Z1bmN0aW9ucy9tYWluCiAgc3VwYWJhc2Utc3VwYXZpc29yOgogICAgaW1hZ2U6ICdzdXBhYmFzZS9zdXBhdmlzb3I6Mi43LjQnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1zU2ZMJwogICAgICAgIC0gJy1vJwogICAgICAgIC0gL2Rldi9udWxsCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FwaS9oZWFsdGgnCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIGludGVydmFsOiA1cwogICAgICByZXRyaWVzOiAxMAogICAgICBzdGFydF9wZXJpb2Q6IDMwcwogICAgZGVwZW5kc19vbjoKICAgICAgc3VwYWJhc2UtZGI6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgICAgc3VwYWJhc2UtYW5hbHl0aWNzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9PTEVSX1RFTkFOVF9JRD0ke1BPT0xFUl9URU5BTlRfSUQ6LWRldl90ZW5hbnR9JwogICAgICAtIFBPT0xFUl9QT09MX01PREU9dHJhbnNhY3Rpb24KICAgICAgLSAnUE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFPSR7UE9PTEVSX0RFRkFVTFRfUE9PTF9TSVpFOi0yMH0nCiAgICAgIC0gJ1BPT0xFUl9NQVhfQ0xJRU5UX0NPTk49JHtQT09MRVJfTUFYX0NMSUVOVF9DT05OOi0xMDB9JwogICAgICAtIFBPUlQ9NDAwMAogICAgICAtICdQT1NUR1JFU19QT1JUPSR7UE9TVEdSRVNfUE9SVDotNTQzMn0nCiAgICAgIC0gJ1BPU1RHUkVTX0hPU1ROQU1FPSR7UE9TVEdSRVNfSE9TVE5BTUU6LXN1cGFiYXNlLWRifScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotcG9zdGdyZXN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9ZWN0bzovL3N1cGFiYXNlX2FkbWluOiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AJHtQT1NUR1JFU19IT1NUTkFNRTotc3VwYWJhc2UtZGJ9OiR7UE9TVEdSRVNfUE9SVDotNTQzMn0vX3N1cGFiYXNlJwogICAgICAtIENMVVNURVJfUE9TVEdSRVM9dHJ1ZQogICAgICAtICdTRUNSRVRfS0VZX0JBU0U9JHtTRVJWSUNFX1BBU1NXT1JEX1NVUEFWSVNPUlNFQ1JFVH0nCiAgICAgIC0gJ1ZBVUxUX0VOQ19LRVk9JHtTRVJWSUNFX1BBU1NXT1JEX1ZBVUxURU5DfScKICAgICAgLSAnQVBJX0pXVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pXVH0nCiAgICAgIC0gJ01FVFJJQ1NfSldUX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSldUfScKICAgICAgLSBSRUdJT049bG9jYWwKICAgICAgLSAnRVJMX0FGTEFHUz0tcHJvdG9fZGlzdCBpbmV0X3RjcCcKICAgICAgLSAnREJfUE9PTF9TSVpFPSR7UE9PTEVSX0RCX1BPT0xfU0laRTotNX0nCiAgICAgIC0gR0xPQkFMX0RPV05TVFJFQU1fQ0VSVF9QQVRIPS9ldGMvc3NsL3NlcnZlci5jcnQKICAgICAgLSBHTE9CQUxfRE9XTlNUUkVBTV9LRVlfUEFUSD0vZXRjL3NzbC9zZXJ2ZXIua2V5CiAgICBjb21tYW5kOgogICAgICAtIC9iaW4vc2gKICAgICAgLSAnLWMnCiAgICAgIC0gImlmIFsgISAtZiAvZXRjL3NzbC9zZXJ2ZXIuY3J0IF07IHRoZW5cbiAgb3BlbnNzbCByZXEgLXg1MDkgLW5vZGVzIC1kYXlzIDM2NTAgLW5ld2tleSByc2E6MjA0OCBcXFxuICAgIC1rZXlvdXQgL2V0Yy9zc2wvc2VydmVyLmtleSAtb3V0IC9ldGMvc3NsL3NlcnZlci5jcnQgXFxcbiAgICAtc3ViaiBcIi9DTj1zdXBhYmFzZS1wb29sZXJcIlxuZmlcbi9hcHAvYmluL21pZ3JhdGUgJiYgL2FwcC9iaW4vc3VwYXZpc29yIGV2YWwgXCIkJChjYXQgL2V0Yy9wb29sZXIvcG9vbGVyLmV4cylcIiAmJiAvYXBwL2Jpbi9zZXJ2ZXJcbiIKICAgIHZvbHVtZXM6CiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiAuL3ZvbHVtZXMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICB0YXJnZXQ6IC9ldGMvcG9vbGVyL3Bvb2xlci5leHMKICAgICAgICBjb250ZW50OiAiezpvaywgX30gPSBBcHBsaWNhdGlvbi5lbnN1cmVfYWxsX3N0YXJ0ZWQoOnN1cGF2aXNvcilcbns6b2ssIHZlcnNpb259ID1cbiAgICBjYXNlIFN1cGF2aXNvci5SZXBvLnF1ZXJ5IShcInNlbGVjdCB2ZXJzaW9uKClcIikgZG9cbiAgICAle3Jvd3M6IFtbdmVyXV19IC0+IFN1cGF2aXNvci5IZWxwZXJzLnBhcnNlX3BnX3ZlcnNpb24odmVyKVxuICAgIF8gLT4gbmlsXG4gICAgZW5kXG5wYXJhbXMgPSAle1xuICAgIFwiZXh0ZXJuYWxfaWRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9URU5BTlRfSURcIiksXG4gICAgXCJkYl9ob3N0XCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19IT1NUTkFNRVwiKSxcbiAgICBcImRiX3BvcnRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BPUlRcIikgfD4gU3RyaW5nLnRvX2ludGVnZXIoKSxcbiAgICBcImRiX2RhdGFiYXNlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT1NUR1JFU19EQlwiKSxcbiAgICBcInJlcXVpcmVfdXNlclwiID0+IGZhbHNlLFxuICAgIFwiYXV0aF9xdWVyeVwiID0+IFwiU0VMRUNUICogRlJPTSBwZ2JvdW5jZXIuZ2V0X2F1dGgoJDEpXCIsXG4gICAgXCJkZWZhdWx0X21heF9jbGllbnRzXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfTUFYX0NMSUVOVF9DT05OXCIpLFxuICAgIFwiZGVmYXVsdF9wb29sX3NpemVcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPT0xFUl9ERUZBVUxUX1BPT0xfU0laRVwiKSxcbiAgICBcImRlZmF1bHRfcGFyYW1ldGVyX3N0YXR1c1wiID0+ICV7XCJzZXJ2ZXJfdmVyc2lvblwiID0+IHZlcnNpb259LFxuICAgIFwidXNlcnNcIiA9PiBbJXtcbiAgICBcImRiX3VzZXJcIiA9PiBcInBnYm91bmNlclwiLFxuICAgIFwiZGJfcGFzc3dvcmRcIiA9PiBTeXN0ZW0uZ2V0X2VudihcIlBPU1RHUkVTX1BBU1NXT1JEXCIpLFxuICAgIFwibW9kZV90eXBlXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfUE9PTF9NT0RFXCIpLFxuICAgIFwicG9vbF9zaXplXCIgPT4gU3lzdGVtLmdldF9lbnYoXCJQT09MRVJfREVGQVVMVF9QT09MX1NJWkVcIiksXG4gICAgXCJpc19tYW5hZ2VyXCIgPT4gdHJ1ZVxuICAgIH1dXG59XG5cbnRlbmFudCA9IFN1cGF2aXNvci5UZW5hbnRzLmdldF90ZW5hbnRfYnlfZXh0ZXJuYWxfaWQocGFyYW1zW1wiZXh0ZXJuYWxfaWRcIl0pXG5cbmlmIHRlbmFudCBkb1xuICB7Om9rLCBffSA9IFN1cGF2aXNvci5UZW5hbnRzLnVwZGF0ZV90ZW5hbnQodGVuYW50LCBwYXJhbXMpXG5lbHNlXG4gIHs6b2ssIF99ID0gU3VwYXZpc29yLlRlbmFudHMuY3JlYXRlX3RlbmFudChwYXJhbXMpXG5lbmRcbiIK",
         "tags": [
             "firebase",
             "alternative",
@@ -5299,7 +5386,7 @@
         "category": "backend",
         "logo": "svgs/supabase.svg",
         "minversion": "4.0.0-beta.228",
-        "template_last_updated_at": "2026-04-05T20:21:11+02:00",
+        "template_last_updated_at": "2026-10-15T23:15:19+02:00",
         "port": "8000"
     },
     "superset-with-postgresql": {
diff --git a/tests/Feature/AdvisorySecurityRegressionTest.php b/tests/Feature/AdvisorySecurityRegressionTest.php
index 452308d22a..00e8098197 100644
--- a/tests/Feature/AdvisorySecurityRegressionTest.php
+++ b/tests/Feature/AdvisorySecurityRegressionTest.php
@@ -49,7 +49,7 @@ it('does not require email verification for protected web routes', function () {
     $this->actingAs($user)->get('/analytics')->assertOk();
 });
 
-it('does not apply the REST API allowlist to MCP and MCP switch routes', function () {
+it('applies only the IP allow-list, not the REST API switch, to MCP and MCP switch routes', function () {
     $mcp = Route::getRoutes()->match(Request::create('/mcp', 'POST'));
     $enable = Route::getRoutes()->match(Request::create('/api/v1/mcp/enable', 'POST'));
     $disable = Route::getRoutes()->match(Request::create('/api/v1/mcp/disable', 'POST'));
@@ -57,7 +57,10 @@ it('does not apply the REST API allowlist to MCP and MCP switch routes', functio
     expect($mcp)->not->toBeNull()
         ->and($mcp->gatherMiddleware())->not->toContain(ApiAllowed::class)
         ->and($enable->gatherMiddleware())->not->toContain(ApiAllowed::class)
-        ->and($disable->gatherMiddleware())->not->toContain(ApiAllowed::class);
+        ->and($disable->gatherMiddleware())->not->toContain(ApiAllowed::class)
+        ->and($mcp->gatherMiddleware())->toContain('api.ip.allowed')
+        ->and($enable->gatherMiddleware())->toContain('api.ip.allowed')
+        ->and($disable->gatherMiddleware())->toContain('api.ip.allowed');
 });
 
 it('throttles only failed authentication on manual webhook routes', function (string $provider) {
diff --git a/tests/Feature/Api/ApplicationDomainValidationApiTest.php b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
index 88533ce760..cb9b4007ba 100644
--- a/tests/Feature/Api/ApplicationDomainValidationApiTest.php
+++ b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
@@ -9,6 +9,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -84,3 +85,28 @@ it('rejects wildcard domains on application creation', function (string $proxyTy
 
     expect(Application::count())->toBe($count);
 })->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
+
+it('honours force_domain_override for conflicting docker_compose_domains on application creation', function (bool $force, int $expectedStatus) {
+    Queue::fake();
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $this->application->update(['fqdn' => 'https://shared.example.com']);
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/applications/public', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'git_repository' => 'https://gitlab.com/coollabsio/coolify-examples',
+            'git_branch' => 'v4.x',
+            'build_pack' => 'dockercompose',
+            'docker_compose_domains' => [
+                ['name' => 'web', 'domain' => 'https://shared.example.com'],
+                ['name' => 'api', 'domain' => 'https://shared.example.com'],
+            ],
+            'force_domain_override' => $force,
+        ])
+        ->assertStatus($expectedStatus);
+})->with([
+    'without override' => [false, 422],
+    'with override' => [true, 201],
+]);
diff --git a/tests/Feature/Api/PublicApplicationSshUrlApiTest.php b/tests/Feature/Api/PublicApplicationSshUrlApiTest.php
index 03c18ab48b..0aa3e76eeb 100644
--- a/tests/Feature/Api/PublicApplicationSshUrlApiTest.php
+++ b/tests/Feature/Api/PublicApplicationSshUrlApiTest.php
@@ -30,7 +30,7 @@ beforeEach(function () {
     $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 });
 
-test('public application api converts scp-style ssh urls to https', function () {
+test('public application api converts ssh urls to https', function (string $gitRepository) {
     $response = $this->withHeaders([
         'Authorization' => 'Bearer '.$this->bearerToken,
         'Content-Type' => 'application/json',
@@ -38,7 +38,7 @@ test('public application api converts scp-style ssh urls to https', function ()
         'project_uuid' => $this->project->uuid,
         'environment_uuid' => $this->environment->uuid,
         'server_uuid' => $this->server->uuid,
-        'git_repository' => 'custom-user@git.example.com:2222/organization/repository.git',
+        'git_repository' => $gitRepository,
         'git_branch' => 'main',
         'build_pack' => 'nixpacks',
         'ports_exposes' => '3000',
@@ -50,4 +50,7 @@ test('public application api converts scp-style ssh urls to https', function ()
     $application = Application::where('uuid', $response->json('uuid'))->firstOrFail();
 
     expect($application->git_repository)->toBe('https://git.example.com/organization/repository.git');
-});
+})->with([
+    'scp-style with port' => 'custom-user@git.example.com:2222/organization/repository.git',
+    'ssh scheme with port' => 'ssh://custom-user@git.example.com:2222/organization/repository.git',
+]);
diff --git a/tests/Feature/Api/ServerTransferApiTest.php b/tests/Feature/Api/ServerTransferApiTest.php
index ad1f6d4387..134802cd09 100644
--- a/tests/Feature/Api/ServerTransferApiTest.php
+++ b/tests/Feature/Api/ServerTransferApiTest.php
@@ -1,8 +1,13 @@
 <?php
 
+use App\Enums\ApplicationDeploymentStatus;
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Project;
@@ -10,18 +15,21 @@ use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
-use App\Services\ServerTransfer\ServerTransferBundle;
-use App\Services\ServerTransfer\ServerTransferClaimer;
 use App\Services\ServerTransfer\ServerTransferExporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    config(['app.env' => 'local']);
-
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     Storage::fake('ssh-keys');
 
     InstanceSettings::forceCreate([
@@ -78,19 +86,19 @@ beforeEach(function () {
     });
 });
 
-test('server transfer API is unavailable outside development mode', function (string $method, string $uri) {
+test('server transfer API is available in production', function () {
     config(['app.env' => 'production']);
 
     $this->withHeaders(transferHeaders($this->sensitiveToken))
-        ->json($method, str_replace('{uuid}', $this->server->uuid, $uri))
-        ->assertNotFound();
-})->with([
-    ['POST', '/api/v1/servers/import'],
-    ['GET', '/api/v1/servers/{uuid}/export'],
-    ['POST', '/api/v1/servers/{uuid}/export/mailbox'],
-    ['POST', '/api/v1/servers/{uuid}/transfer/complete'],
-    ['POST', '/api/v1/servers/{uuid}/migrate'],
-]);
+        ->getJson("/api/v1/servers/{$this->server->uuid}/transfer")
+        ->assertOk()
+        ->assertJsonPath('server_uuid', $this->server->uuid);
+});
+
+function transferExportForApiTest(Server $server): array
+{
+    return app(ServerTransferExporter::class)->export($server);
+}
 
 function transferHeaders(string $token): array
 {
@@ -101,53 +109,15 @@ function transferHeaders(string $token): array
     ];
 }
 
-describe('GET /api/v1/servers/{uuid}/export', function () {
-    test('exports bundle with sensitive token', function () {
-        $response = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export");
-
-        $response->assertOk()
-            ->assertJsonPath('schema_version', ServerTransferBundle::SCHEMA_VERSION)
-            ->assertJsonPath('server.uuid', $this->server->uuid)
-            ->assertJsonPath('server.ip', '10.66.0.20');
-
-        $envs = collect($response->json('projects.0.environments.0.applications.0.environment_variables'));
-        $tokenEnv = $envs->firstWhere('key', 'API_TOKEN');
-
-        expect($response->json('private_key.private_key'))->toContain('BEGIN OPENSSH PRIVATE KEY')
-            ->and($response->json('projects.0.environments.0.applications.0.uuid'))->toBe($this->application->uuid)
-            ->and($tokenEnv)->not->toBeNull()
-            ->and($tokenEnv['value'])->toBe('token-value-123');
-    });
-
-    test('rejects token without read:sensitive', function () {
-        $this->withHeaders(transferHeaders($this->readToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->assertForbidden();
-    });
-
-    test('returns 404 for unknown or other team server uuid', function () {
-        $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson('/api/v1/servers/not-a-real-server-uuid/export')
-            ->assertNotFound();
-    });
-
-    test('can return passphrase-encrypted envelope', function () {
-        $response = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export?encrypt=1&passphrase=secret-pass");
-
-        $response->assertOk()
-            ->assertJsonPath('encrypted', true);
-
-        expect($response->json('payload'))->toBeString()->not->toBeEmpty();
-    });
-});
+test('the manual export endpoints no longer exist', function (string $path) {
+    $this->withHeaders(transferHeaders($this->sensitiveToken))
+        ->postJson("/api/v1/servers/{$this->server->uuid}{$path}", ['passphrase' => 'correct horse battery'])
+        ->assertNotFound();
+})->with(['/export', '/export/mailbox']);
 
 describe('POST /api/v1/servers/import', function () {
     test('dry run does not create resources', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $before = Server::count();
 
@@ -164,9 +134,7 @@ describe('POST /api/v1/servers/import', function () {
     });
 
     test('imports after source handoff and preserves application uuid', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $appUuid = $this->application->uuid;
         $serverUuid = $this->server->uuid;
@@ -195,51 +163,63 @@ describe('POST /api/v1/servers/import', function () {
             ->toBe('claimed');
     });
 
-    test('imports encrypted bundle with passphrase', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
-        $encrypted = ServerTransferBundle::encryptWithPassphrase($export, 'mailbox-pass');
-
-        $this->application->forceDelete();
-        $this->server->forceDelete();
-        $this->privateKey->delete();
-
-        $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->postJson('/api/v1/servers/import', [
-                'bundle' => $encrypted,
-                'passphrase' => 'mailbox-pass',
-            ])
-            ->assertCreated()
-            ->assertJsonPath('server_uuid', $export['server']['uuid']);
-    });
-
-    test('rejects encrypted bundle without passphrase', function () {
-        $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->postJson('/api/v1/servers/import', [
-                'bundle' => ['encrypted' => true, 'payload' => 'abc', 'schema_version' => 1],
-            ])
-            ->assertStatus(422);
-    });
-
     test('rejects import when ip still exists', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->withHeaders(transferHeaders($this->sensitiveToken))
             ->postJson('/api/v1/servers/import', ['bundle' => $export])
             ->assertStatus(422)
-            ->assertJsonPath('message', fn ($m) => str_contains($m, 'already exists') || str_contains(json_encode($m), 'already exists') || true);
+            ->assertJsonValidationErrors(['server.uuid']);
+    });
+
+    test('does not reveal the server of another team when the ip exists', function () {
+        $export = transferExportForApiTest($this->server);
+        $this->application->forceDelete();
+        $this->server->forceDelete();
+        $otherServer = Server::factory()->create([
+            'team_id' => Team::factory()->create()->id,
+            'private_key_id' => $this->privateKey->id,
+            'ip' => '10.66.0.20',
+        ]);
+
+        $response = $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson('/api/v1/servers/import', ['bundle' => $export])
+            ->assertStatus(422);
+
+        expect($response->getContent())->toContain('already exists')
+            ->not->toContain($otherServer->uuid);
+    });
+
+    test('rejects a bundle from a newer Coolify version', function () {
+        $export = transferExportForApiTest($this->server);
+        $export['coolify_version'] = '99.0.0';
+        $this->application->forceDelete();
+        $this->server->forceDelete();
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson('/api/v1/servers/import', ['bundle' => $export])
+            ->assertStatus(422)
+            ->assertJsonPath('errors.bundle.0', fn ($message) => str_contains($message, 'Upgrade this instance'));
+
+        expect(Server::where('uuid', $export['server']['uuid'])->exists())->toBeFalse();
+    });
+
+    test('adopt mode requires the original uuids', function () {
+        $export = transferExportForApiTest($this->server);
+        $this->application->forceDelete();
+        $this->server->forceDelete();
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson('/api/v1/servers/import', ['bundle' => $export, 'preserve_uuids' => false, 'adopt_mode' => true])
+            ->assertStatus(422)
+            ->assertJsonValidationErrors(['preserve_uuids']);
     });
 
     test('rejects import when the destination team is at its cloud server limit', function () {
         config()->set('constants.coolify.self_hosted', false);
         $this->team->update(['custom_server_limit' => 1]);
 
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->server->forceDelete();
         Server::factory()->create([
@@ -259,9 +239,7 @@ describe('POST /api/v1/servers/import', function () {
 
 describe('POST /api/v1/servers/import claim', function () {
     test('import takes management of the server and rebinds Sentinel', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->application->forceDelete();
         $this->server->forceDelete();
@@ -315,10 +293,7 @@ describe('POST /api/v1/servers/{uuid}/transfer/complete', function () {
 
 describe('full transfer flow A to B on same process', function () {
     test('export complete import sequence', function () {
-        $export = $this->withHeaders(transferHeaders($this->sensitiveToken))
-            ->getJson("/api/v1/servers/{$this->server->uuid}/export")
-            ->assertOk()
-            ->json();
+        $export = transferExportForApiTest($this->server);
 
         $this->withHeaders(transferHeaders($this->sensitiveToken))
             ->postJson("/api/v1/servers/{$this->server->uuid}/transfer/complete", [
@@ -358,15 +333,145 @@ describe('full transfer flow A to B on same process', function () {
     });
 });
 
-describe('ServerTransferClaimer unit-ish via container', function () {
-    test('writeMailbox returns path even when remote fails in tests', function () {
-        $claimer = app(ServerTransferClaimer::class);
-        $exporter = app(ServerTransferExporter::class);
-        $bundle = $exporter->export($this->server);
+describe('POST /api/v1/servers/{uuid}/migrate', function () {
+    test('starts the transfer in a queued job', function () {
+        Queue::fake();
+        Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
 
-        $result = $claimer->writeMailbox($this->server, $bundle, 'pass');
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/migrate", [
+                'target_url' => 'https://8.8.8.8',
+                'target_token' => 'target-token',
+            ])
+            ->assertStatus(202)
+            ->assertJsonPath('migration.status', 'running');
 
-        expect($result['path'])->toContain('/data/coolify/exports/server-transfer-')
-            ->and($result)->toHaveKey('written');
+        Queue::assertPushed(MigrateServerToInstanceJob::class, fn ($job) => $job->server->is($this->server) && $job->targetToken === 'target-token');
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->getJson("/api/v1/servers/{$this->server->uuid}/transfer")
+            ->assertOk()
+            ->assertJsonPath('migration.status', 'running')
+            ->assertJsonPath('migration.target_url', 'https://8.8.8.8');
+    });
+
+    test('rejects a target without https', function () {
+        Queue::fake();
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/migrate", [
+                'target_url' => 'http://8.8.8.8',
+                'target_token' => 'target-token',
+            ])
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'https'));
+
+        Queue::assertNothingPushed();
+    });
+
+    test('rejects a transfer while a deployment runs on the server', function () {
+        Queue::fake();
+        ApplicationDeploymentQueue::create([
+            'application_id' => (string) $this->application->id,
+            'deployment_uuid' => new_public_id(),
+            'server_id' => $this->server->id,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+
+        $this->withHeaders(transferHeaders($this->sensitiveToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/migrate", [
+                'target_url' => 'https://8.8.8.8',
+                'target_token' => 'target-token',
+            ])
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'deployment'));
+
+        Queue::assertNothingPushed();
     });
 });
+
+describe('GET /api/v1/servers/import/check', function () {
+    test('accepts a server that this instance can import and reach', function () {
+        $listener = stream_socket_server('tcp://127.0.0.1:0');
+        $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+
+        $this->withHeaders(transferHeaders($this->writeToken))
+            ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}")
+            ->assertOk()
+            ->assertJsonPath('checks', fn ($checks) => collect($checks)->every(fn ($check) => $check['ok'] === true)
+                && collect($checks)->pluck('label')->contains("the target can reach the SSH port of the server (127.0.0.1:{$port})"));
+
+        fclose($listener);
+    });
+
+    test('rejects a server whose SSH port this instance cannot reach', function () {
+        $listener = stream_socket_server('tcp://127.0.0.1:0');
+        $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+        fclose($listener);
+
+        $this->withHeaders(transferHeaders($this->writeToken))
+            ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}")
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'cannot reach the server at 127.0.0.1'));
+    });
+
+    test('rejects a target that is not an IP address or hostname before it opens a socket', function (string $ip) {
+        $this->withHeaders(transferHeaders($this->writeToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip='.urlencode($ip))
+            ->assertStatus(422)
+            ->assertJsonValidationErrors('ip')
+            ->assertJsonMissingPath('checks');
+    })->with(['tcp://127.0.0.1', 'unix:///var/run/docker.sock', 'ssl://example.com']);
+
+    test('rejects another transfer bundle version', function () {
+        $this->withHeaders(transferHeaders($this->writeToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&schema_version=999')
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'Upgrade both instances'));
+    });
+
+    test('lists every check with its result when a server already exists on this instance', function () {
+        $listener = stream_socket_server('tcp://127.0.0.1:0');
+        $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+        $this->server->forceFill(['ip' => '127.0.0.1'])->save();
+
+        $checks = $this->withHeaders(transferHeaders($this->writeToken))
+            ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}")
+            ->assertStatus(422)
+            ->assertJsonPath('message', fn ($message) => str_contains($message, 'already exists on this instance'))
+            ->json('checks');
+
+        expect(collect($checks)->pluck('ok', 'label')->all())->toMatchArray([
+            'the transfer bundle version is supported' => true,
+            'no server with the same UUID exists' => true,
+            'no server with the same IP exists' => false,
+            "the target can reach the SSH port of the server (127.0.0.1:{$port})" => true,
+        ]);
+        fclose($listener);
+    });
+
+    test('rejects a token without the write permission', function () {
+        $this->withHeaders(transferHeaders($this->readToken))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=10.66.0.99')
+            ->assertForbidden();
+    });
+
+    test('rejects an invalid token', function () {
+        $this->withHeaders(transferHeaders('1|not-a-real-token'))
+            ->getJson('/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=10.66.0.99')
+            ->assertUnauthorized();
+    });
+});
+
+test('the import check lists the system-wide git sources that this instance does not have', function () {
+    $present = GithubApp::create(['name' => 'present', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true]);
+    $listener = stream_socket_server('tcp://127.0.0.1:0');
+    $port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+
+    $this->withHeaders(transferHeaders($this->writeToken))
+        ->getJson("/api/v1/servers/import/check?server_uuid=new-server-uuid&ip=127.0.0.1&port={$port}&system_github_apps[]={$present->uuid}&system_github_apps[]=missing-uuid&system_gitlab_apps[]=other-missing")
+        ->assertOk()
+        ->assertJsonPath('missing_system_sources.github', ['missing-uuid'])
+        ->assertJsonPath('missing_system_sources.gitlab', ['other-missing']);
+
+    fclose($listener);
+});
diff --git a/tests/Feature/ApiDisabledCalloutTest.php b/tests/Feature/ApiDisabledCalloutTest.php
index 555ce5db2d..4b2196e4ff 100644
--- a/tests/Feature/ApiDisabledCalloutTest.php
+++ b/tests/Feature/ApiDisabledCalloutTest.php
@@ -78,19 +78,16 @@ it('does not show the API notice on the webhooks page when the API is enabled',
         ->assertDontSee('API access is turned off');
 });
 
-it('lets users create API tokens for MCP when only the REST API is disabled', function () {
-    InstanceSettings::query()->whereKey(0)->update(['is_mcp_server_enabled' => true]);
-    Once::flush();
+it('lets users create API tokens for MCP while the REST API is disabled', function () {
     $this->actingAs($this->teamAdmin);
     session(['currentTeam' => $this->team]);
 
     Livewire::test(ApiTokens::class)
-        ->assertDontSee('API access is turned off')
-        ->assertSee('REST API disabled')
-        ->set('description', 'mcp-token')
-        ->set('permissions', ['read'])
+        ->assertSee('API access is turned off')
+        ->assertSee('Create token')
+        ->set('description', 'MCP client')
         ->call('addNewToken')
         ->assertHasNoErrors();
 
-    expect($this->teamAdmin->tokens()->where('name', 'mcp-token')->where('team_id', $this->team->id)->exists())->toBeTrue();
+    expect($this->teamAdmin->tokens()->where('name', 'MCP client')->exists())->toBeTrue();
 });
diff --git a/tests/Feature/Application/GithubSourceChangeTest.php b/tests/Feature/Application/GithubSourceChangeTest.php
index c3912ead7d..c42139c396 100644
--- a/tests/Feature/Application/GithubSourceChangeTest.php
+++ b/tests/Feature/Application/GithubSourceChangeTest.php
@@ -62,6 +62,30 @@ describe('GitHub Source Change Component', function () {
         expect($missingAuthorization)->toBeEmpty();
     });
 
+    test('deletes an incomplete github app and redirects without a render error', function () {
+        $githubApp = GithubApp::create([
+            'name' => 'Incomplete GitHub App',
+            'organization' => 'coollabsio',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSee('Incomplete GitHub App')
+            ->call('delete')
+            ->assertHasNoErrors()
+            ->assertRedirect(route('source.all'))
+            ->assertSet('github_app', null)
+            ->call('$refresh');
+
+        expect(GithubApp::find($githubApp->id))->toBeNull();
+    });
+
     test('can mount with newly created github app with null app_id', function () {
         // Create a GitHub app without app_id (simulating a newly created source)
         $githubApp = GithubApp::create([
diff --git a/tests/Feature/ApplicationDeploymentImportRetryTest.php b/tests/Feature/ApplicationDeploymentImportRetryTest.php
new file mode 100644
index 0000000000..e05bb97f1c
--- /dev/null
+++ b/tests/Feature/ApplicationDeploymentImportRetryTest.php
@@ -0,0 +1,89 @@
+<?php
+
+use App\Exceptions\DeploymentException;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use Illuminate\Support\Sleep;
+
+/**
+ * Records remote commands and fails the repository import with the queued exit codes.
+ */
+class ImportRetryDeploymentJob extends ApplicationDeploymentJob
+{
+    public array $commands = [];
+
+    public array $importExitCodes = [];
+
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void
+    {
+        foreach ($commands as $command) {
+            $this->commands[] = $command[0];
+            if (str_contains($command[0], 'git clone') && $exitCode = array_shift($this->importExitCodes)) {
+                throw new DeploymentException('Command execution failed', $exitCode);
+            }
+        }
+    }
+}
+
+beforeEach(function () {
+    Sleep::fake();
+    config()->set('constants.ssh.max_retries', 3);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('generateGitImportCommands')->andReturn([
+        'commands' => "docker exec deploy-uuid bash -c 'git clone repo /artifacts/deploy-uuid'",
+        'branch' => 'main',
+        'fullRepoUrl' => 'repo',
+    ]);
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+    $queue->shouldReceive('addLogEntry');
+
+    $this->job = new ImportRetryDeploymentJob;
+    foreach ([
+        'application' => $application,
+        'application_deployment_queue' => $queue,
+        'deployment_uuid' => 'deploy-uuid',
+        'basedir' => '/artifacts/deploy-uuid',
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+    ] as $property => $value) {
+        (new ReflectionProperty(ApplicationDeploymentJob::class, $property))->setValue($this->job, $value);
+    }
+});
+
+function importRepository(ImportRetryDeploymentJob $job): void
+{
+    (new ReflectionMethod(ApplicationDeploymentJob::class, 'import_repository'))->invoke($job);
+}
+
+function cloneCommandCount(ImportRetryDeploymentJob $job): int
+{
+    return collect($job->commands)->filter(fn (string $command) => str_contains($command, 'git clone'))->count();
+}
+
+it('cleans up and clones again when the SSH connection drops during the import', function () {
+    $this->job->importExitCodes = [255];
+
+    importRepository($this->job);
+
+    expect(cloneCommandCount($this->job))->toBe(2)
+        ->and($this->job->commands[1])->toBe(executeInDocker('deploy-uuid', "pkill git; rm -rf '/artifacts/deploy-uuid'"));
+});
+
+it('does not retry the import when git itself fails', function () {
+    $this->job->importExitCodes = [128];
+
+    expect(fn () => importRepository($this->job))->toThrow(DeploymentException::class);
+    expect(cloneCommandCount($this->job))->toBe(1);
+});
+
+it('stops retrying the import after the configured SSH attempts', function () {
+    $this->job->importExitCodes = [255, 255, 255];
+
+    expect(fn () => importRepository($this->job))->toThrow(DeploymentException::class);
+    expect(cloneCommandCount($this->job))->toBe(3);
+});
diff --git a/tests/Feature/ApplicationDockerfileUpdateApiTest.php b/tests/Feature/ApplicationDockerfileUpdateApiTest.php
new file mode 100644
index 0000000000..8aed601394
--- /dev/null
+++ b/tests/Feature/ApplicationDockerfileUpdateApiTest.php
@@ -0,0 +1,73 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->token = $this->user->createToken('dockerfile-update-test', ['*'])->plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'build_pack' => 'dockerfile',
+        'dockerfile' => "FROM nginx:alpine\n",
+        'custom_healthcheck_found' => true,
+        'health_check_interval' => 30,
+    ]);
+});
+
+function patchApplicationDockerfile(array $payload)
+{
+    return test()->withHeaders(['Authorization' => 'Bearer '.test()->token])
+        ->patchJson('/api/v1/applications/'.test()->application->uuid, $payload);
+}
+
+test('PATCH updates the Dockerfile of a Dockerfile application', function () {
+    $dockerfile = "FROM nginx:1.27-alpine\n";
+
+    patchApplicationDockerfile(['dockerfile' => base64_encode($dockerfile)])->assertOk();
+
+    $application = $this->application->refresh();
+    expect($application->dockerfile)->toBe($dockerfile)
+        ->and($application->custom_healthcheck_found)->toBeFalsy()
+        ->and($application->health_check_interval)->toBe(5);
+});
+
+test('PATCH rejects a Dockerfile that is not base64 encoded', function () {
+    patchApplicationDockerfile(['dockerfile' => "FROM nginx:1.27-alpine\n"])
+        ->assertUnprocessable()
+        ->assertJsonPath('errors.dockerfile', 'The dockerfile should be base64 encoded.');
+
+    expect($this->application->refresh()->dockerfile)->toBe("FROM nginx:alpine\n");
+});
+
+test('PATCH rejects a Dockerfile for applications built from a git repository', function () {
+    $this->application->forceFill(['dockerfile' => null])->saveQuietly();
+
+    patchApplicationDockerfile(['dockerfile' => base64_encode("FROM nginx:1.27-alpine\n")])
+        ->assertUnprocessable()
+        ->assertInvalid(['dockerfile']);
+
+    expect($this->application->refresh()->dockerfile)->toBeNull();
+});
diff --git a/tests/Feature/ApplicationGithubAppSourceApiTest.php b/tests/Feature/ApplicationGithubAppSourceApiTest.php
new file mode 100644
index 0000000000..d67b546483
--- /dev/null
+++ b/tests/Feature/ApplicationGithubAppSourceApiTest.php
@@ -0,0 +1,116 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->token = $this->user->createToken('github-app-source-test', ['*'])->plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->oldGithubApp = githubAppSourceApiApp($this->team->id, 'org-a');
+    $this->newGithubApp = githubAppSourceApiApp($this->team->id, 'org-b');
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'git_repository' => 'org-a/repository',
+        'source_id' => $this->oldGithubApp->id,
+        'source_type' => GithubApp::class,
+        'repository_project_id' => 111,
+        'private_key_id' => null,
+    ]);
+});
+
+function githubAppSourceApiApp(int $teamId, string $name, array $overrides = []): GithubApp
+{
+    return GithubApp::create(array_merge([
+        'name' => $name,
+        'team_id' => $teamId,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+        'app_id' => 1,
+        'installation_id' => 1,
+    ], $overrides));
+}
+
+function patchApplicationSource(array $payload)
+{
+    return test()->withHeaders(['Authorization' => 'Bearer '.test()->token])
+        ->patchJson('/api/v1/applications/'.test()->application->uuid, $payload);
+}
+
+test('PATCH moves the application to another GitHub App of the team', function () {
+    patchApplicationSource([
+        'github_app_uuid' => $this->newGithubApp->uuid,
+        'git_repository' => 'org-b/repository',
+        'git_branch' => 'main',
+    ])->assertOk();
+
+    $application = $this->application->refresh();
+    expect($application->source_id)->toBe($this->newGithubApp->id)
+        ->and($application->source_type)->toBe(GithubApp::class)
+        ->and($application->git_repository)->toBe('org-b/repository')
+        ->and($application->repository_project_id)->toBeNull();
+});
+
+test('PATCH rejects a GitHub App of another team', function () {
+    $otherTeam = Team::factory()->create();
+    $foreignGithubApp = githubAppSourceApiApp($otherTeam->id, 'foreign');
+
+    patchApplicationSource(['github_app_uuid' => $foreignGithubApp->uuid])->assertNotFound();
+
+    expect($this->application->refresh()->source_id)->toBe($this->oldGithubApp->id);
+});
+
+test('PATCH rejects a GitHub App that is not installed', function () {
+    $notInstalled = githubAppSourceApiApp($this->team->id, 'not-installed', ['installation_id' => null]);
+
+    patchApplicationSource(['github_app_uuid' => $notInstalled->uuid])->assertNotFound();
+
+    expect($this->application->refresh()->source_id)->toBe($this->oldGithubApp->id);
+});
+
+test('PATCH rejects github_app_uuid for deploy key applications', function () {
+    $this->application->forceFill(['private_key_id' => 1])->saveQuietly();
+
+    patchApplicationSource(['github_app_uuid' => $this->newGithubApp->uuid])
+        ->assertUnprocessable()
+        ->assertInvalid(['github_app_uuid']);
+
+    expect($this->application->refresh()->source_id)->toBe($this->oldGithubApp->id);
+});
+
+test('PATCH rejects github_app_uuid for applications without a git repository', function (array $attributes) {
+    $this->application->forceFill($attributes)->saveQuietly();
+
+    patchApplicationSource(['github_app_uuid' => $this->newGithubApp->uuid])
+        ->assertUnprocessable()
+        ->assertInvalid(['github_app_uuid']);
+
+    expect($this->application->refresh()->source_id)->toBe($this->oldGithubApp->id);
+})->with([
+    'inline dockerfile' => [['build_pack' => 'dockerfile', 'dockerfile' => "FROM nginx:alpine\n"]],
+    'docker image' => [['build_pack' => 'dockerimage']],
+]);
diff --git a/tests/Feature/ApplicationPreviewVolumeCleanupTest.php b/tests/Feature/ApplicationPreviewVolumeCleanupTest.php
index 7f59f689fc..de7731aa08 100644
--- a/tests/Feature/ApplicationPreviewVolumeCleanupTest.php
+++ b/tests/Feature/ApplicationPreviewVolumeCleanupTest.php
@@ -11,6 +11,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 
 uses(RefreshDatabase::class);
 
@@ -118,3 +119,48 @@ it('continues removing preview volumes when an earlier volume is already absent'
     Process::assertRan(fn ($process) => str_contains($process->command, "docker volume rm -f 'app-data-pr-42'"));
     expect(ApplicationPreview::find($this->preview->id))->toBeNull();
 });
+
+it('deletes the persistent storage records of a docker compose preview', function () {
+    Queue::fake();
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '5',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  app:
+    image: nginx:alpine
+    volumes:
+      - files:/app/files
+      - db:/var/lib/mysql
+volumes:
+  files:
+  db:
+YAML,
+    ]);
+    $this->application->refresh();
+    $uuid = $this->application->uuid;
+
+    // Deploying the application, this preview and another preview creates the storage records
+    $this->application->parse();
+    $this->application->parse(pull_request_id: 42);
+    $this->application->parse(pull_request_id: 43);
+    expect($this->application->persistentStorages()->pluck('name')->sort()->values()->all())->toBe([
+        "{$uuid}_db",
+        "{$uuid}_db-pr-42",
+        "{$uuid}_db-pr-43",
+        "{$uuid}_files",
+        "{$uuid}_files-pr-42",
+        "{$uuid}_files-pr-43",
+    ]);
+    Process::fake(['*' => Process::result(output: '')]);
+
+    $this->preview->forceDelete();
+
+    Process::assertRan(fn ($process) => str_contains($process->command, "docker volume rm -f '{$uuid}_db-pr-42'"));
+    expect($this->application->persistentStorages()->pluck('name')->sort()->values()->all())->toBe([
+        "{$uuid}_db",
+        "{$uuid}_db-pr-43",
+        "{$uuid}_files",
+        "{$uuid}_files-pr-43",
+    ]);
+});
diff --git a/tests/Feature/AppwriteServiceTemplateTest.php b/tests/Feature/AppwriteServiceTemplateTest.php
new file mode 100644
index 0000000000..55ee163907
--- /dev/null
+++ b/tests/Feature/AppwriteServiceTemplateTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('routes the appwrite api and realtime to port 80 and the console to port 3000', function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+    $service = Service::factory()->create([
+        'service_type' => 'appwrite',
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => file_get_contents(base_path('templates/compose/appwrite.yaml')),
+    ]);
+
+    $requiredPort = fn (string $name) => ServiceApplication::create(['name' => $name, 'service_id' => $service->id])->getRequiredPort();
+
+    expect($requiredPort('appwrite'))->toBe(80)
+        ->and($requiredPort('appwrite-realtime'))->toBe(80)
+        ->and($requiredPort('appwrite-console'))->toBe(3000);
+});
diff --git a/tests/Feature/Authorization/DeployKeyApplicationCreationAuthorizationTest.php b/tests/Feature/Authorization/DeployKeyApplicationCreationAuthorizationTest.php
index 62cf02ef3b..59be95e55c 100644
--- a/tests/Feature/Authorization/DeployKeyApplicationCreationAuthorizationTest.php
+++ b/tests/Feature/Authorization/DeployKeyApplicationCreationAuthorizationTest.php
@@ -85,6 +85,34 @@ test('admin can select and create an application with a key owned by the current
     expect(Application::query()->sole()->private_key_id)->toBe($this->privateKey->id);
 });
 
+test('deploy key application keeps an ssh url with a custom port', function () {
+    actAsDeployKeyUser($this->admin, $this->team);
+
+    deployKeyComponent()
+        ->call('setPrivateKey', $this->privateKey->id)
+        ->set('repository_url', 'ssh://git@gitea.example.local:2222/myuser/my-repository.git')
+        ->set('branch', 'main')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    expect(Application::query()->sole()->git_repository)
+        ->toBe('ssh://git@gitea.example.local:2222/myuser/my-repository.git');
+});
+
+test('deploy key application keeps an scp-style ssh url with a custom username', function () {
+    actAsDeployKeyUser($this->admin, $this->team);
+
+    deployKeyComponent()
+        ->call('setPrivateKey', $this->privateKey->id)
+        ->set('repository_url', 'custom-user@github.example.com:organization/repository.git')
+        ->set('branch', 'main')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    expect(Application::query()->sole()->git_repository)
+        ->toBe('custom-user@github.example.com:organization/repository.git');
+});
+
 test('member cannot invoke the deploy key selection action directly', function () {
     actAsDeployKeyUser($this->member, $this->team);
     $this->withoutExceptionHandling();
diff --git a/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php b/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
index 229848220a..99b8715aa3 100644
--- a/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
+++ b/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
@@ -110,7 +110,7 @@ test('admin sees deploy controls for application', function () {
     session(['currentTeam' => $this->team]);
 
     Livewire::test(ApplicationHeading::class, ['application' => $this->application])
-        ->assertSee('Deploy')
+        ->assertSee('Redeploy')
         ->assertSee('Restart')
         ->assertSee('Stop');
 });
diff --git a/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php b/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
index 2d37fd00d9..16ff1e9947 100644
--- a/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
@@ -222,6 +222,16 @@ test('admin sees terminal link for service', function () {
         ->assertSee('Terminal');
 });
 
+test('service configuration page sidebar links to the file browser', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Team::query()->update(['show_boarding' => false]);
+
+    $this->get(route('project.service.configuration', $this->serviceParams))
+        ->assertOk()
+        ->assertSee(route('project.service.files', $this->serviceParams), false);
+});
+
 test('admin sees deploy button for service', function () {
     $this->actingAs($this->admin);
     session(['currentTeam' => $this->team]);
diff --git a/tests/Feature/AutoUpdateFrequencyDefaultTest.php b/tests/Feature/AutoUpdateFrequencyDefaultTest.php
new file mode 100644
index 0000000000..8d64e26b09
--- /dev/null
+++ b/tests/Feature/AutoUpdateFrequencyDefaultTest.php
@@ -0,0 +1,29 @@
+<?php
+
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('gives a new instance a random minute after midnight for auto updates', function () {
+    $settings = InstanceSettings::forceCreate(['id' => 0]);
+
+    expect($settings->fresh()->auto_update_frequency)->toMatch('/^([0-9]|[1-5][0-9]) 0 \* \* \*$/');
+});
+
+it('keeps an explicit auto update frequency on create', function () {
+    $settings = InstanceSettings::forceCreate(['id' => 0, 'auto_update_frequency' => '23 3 * * *']);
+
+    expect($settings->fresh()->auto_update_frequency)->toBe('23 3 * * *');
+});
+
+it('moves instances off the old midnight default and keeps custom schedules', function (string $frequency, string $expected) {
+    InstanceSettings::forceCreate(['id' => 0, 'auto_update_frequency' => $frequency]);
+
+    (require database_path('migrations/2026_10_15_213357_spread_default_auto_update_frequency.php'))->up();
+
+    expect(InstanceSettings::find(0)->auto_update_frequency)->toMatch($expected);
+})->with([
+    'old default' => ['0 0 * * *', '/^([0-9]|[1-5][0-9]) 0 \* \* \*$/'],
+    'custom' => ['23 3 * * *', '/^23 3 \* \* \*$/'],
+]);
diff --git a/tests/Feature/BackupEditValidationTest.php b/tests/Feature/BackupEditValidationTest.php
index 3479e8db11..93d38c78e5 100644
--- a/tests/Feature/BackupEditValidationTest.php
+++ b/tests/Feature/BackupEditValidationTest.php
@@ -86,7 +86,6 @@ it('enables and disables S3 backups from the S3 title action', function () {
     $component = Livewire::test(BackupEdit::class, [
         'backup' => $backup->fresh(),
         'availableS3Storages' => $this->team->s3s,
-        'section' => 's3',
     ])
         ->assertSee('Enable S3')
         ->call('toggleS3')
@@ -117,7 +116,6 @@ it('shows and saves S3 retention while S3 backups are disabled', function () {
     Livewire::test(BackupEdit::class, [
         'backup' => $backup->fresh(),
         'availableS3Storages' => $this->team->s3s,
-        'section' => 'retention',
     ])
         ->assertSee('S3 backups')
         ->set('databaseBackupRetentionAmountS3', 12)
@@ -147,34 +145,18 @@ it('splits standalone database backup settings and executions across dedicated u
     $this->get($generalUrl)
         ->assertOk()
         ->assertSee('General')
-        ->assertSee('S3 storage')
-        ->assertSee('Retention')
         ->assertSee('Executions')
         ->assertSee('Danger Zone')
         ->assertSee('Frequency')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Disable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Clean failed backups')
-        ->assertDontSee('Delete schedule');
-
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
         ->assertSeeText('No validated S3 storage')
-        ->assertDontSee('Local copy')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Disable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Clean failed backups');
-
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
         ->assertSee('Local backups')
         ->assertSee('S3 backups')
         ->assertSee('Backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Clean failed backups');
+        ->assertDontSee('Clean failed backups')
+        ->assertDontSee('Delete schedule');
+
+    $this->get($generalUrl.'/s3')->assertRedirect($generalUrl);
+    $this->get($generalUrl.'/retention')->assertRedirect($generalUrl);
 
     $this->get($generalUrl.'/executions')
         ->assertOk()
@@ -478,22 +460,21 @@ it('shows available S3 storages even when S3 backup is disabled', function () {
         's3_storage_id' => null,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->assertSee('First S3')
         ->assertSee('Second S3');
 });
 
-it('shows only an empty S3 state when no storages are available', function () {
+it('shows an empty S3 state when no storages are available', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'save_s3' => false,
         's3_storage_id' => null,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->assertSeeText('No validated S3 storage')
         ->assertSeeHtml('href="'.route('storage.index').'"')
         ->assertSeeText('Open S3 storage')
-        ->assertDontSee('Save')
         ->assertDontSee('Enable S3')
         ->assertDontSee('Disable S3')
         ->assertDontSee('S3 Storage')
@@ -510,7 +491,6 @@ it('allows S3 backups to be disabled when no usable storage remains', function (
     $component = Livewire::test(BackupEdit::class, [
         'backup' => $backup->fresh(),
         'availableS3Storages' => collect(),
-        'section' => 's3',
     ])
         ->assertSet('saveS3', true)
         ->assertSeeText('No validated S3 storage')
@@ -532,7 +512,7 @@ it('shows when S3 backups are currently disabled', function () {
         's3_storage_id' => null,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         // Disabled S3 backups are indicated by the "Enable S3" title action
         ->assertSee('S3 storage')
         ->assertSee('Enable S3')
@@ -617,3 +597,84 @@ it('disables Back up now after refresh when the database stops', function () {
 
     expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
 });
+
+it('shows the backup actions in the header bar on every database backup page', function () {
+    config(['cache.default' => 'array', 'app.maintenance.driver' => 'file']);
+    $backup = createBackupForEditValidationTest($this->team);
+    $database = $backup->database;
+    $database->update(['status' => 'running:healthy']);
+    $generalUrl = route('project.database.backup.execution', [
+        'project_uuid' => $database->project()->uuid,
+        'environment_uuid' => $database->environment->uuid,
+        'database_uuid' => $database->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
+
+    foreach (['', '/executions', '/danger'] as $suffix) {
+        expect($this->get($generalUrl.$suffix)->assertOk()->getContent())
+            ->toMatch('/x-teleport="#resource-action-hud-slot".*?wire:click="toggleEnabled".*?Disable backup.*?wire:click="backupNow"/s');
+    }
+});
+
+it('hides the header Back up now button from team members', function () {
+    config(['cache.default' => 'array', 'app.maintenance.driver' => 'file']);
+    $backup = createBackupForEditValidationTest($this->team);
+    $database = $backup->database;
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    $this->get(route('project.database.backup.executions', [
+        'project_uuid' => $database->project()->uuid,
+        'environment_uuid' => $database->environment->uuid,
+        'database_uuid' => $database->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]))
+        ->assertOk()
+        ->assertDontSee('wire:click="backupNow"', false);
+});
+
+it('denies Back up now for team members', function () {
+    Queue::fake();
+    $backup = createBackupForEditValidationTest($this->team);
+    $backup->database->update(['status' => 'running:healthy']);
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+    ])
+        ->call('backupNow')
+        ->assertNoRedirect();
+
+    Queue::assertNotPushed(DatabaseBackupJob::class);
+});
+
+it('syncs the backup form when the header toggles the schedule', function () {
+    $backup = createBackupForEditValidationTest($this->team, ['enabled' => true]);
+
+    $component = Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+    ])->assertSet('backupEnabled', true);
+
+    $backup->update(['enabled' => false]);
+
+    $component->dispatch('backupEnabledChanged')
+        ->assertSet('backupEnabled', false)
+        ->call('submit');
+
+    expect((bool) $backup->fresh()->enabled)->toBeFalse();
+});
+
+it('toggles the schedule from the form and notifies the page header', function () {
+    $backup = createBackupForEditValidationTest($this->team, ['enabled' => true]);
+
+    Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+    ])
+        ->call('toggleEnabled')
+        ->assertSet('backupEnabled', false)
+        ->assertDispatched('backupEnabledChanged');
+
+    expect((bool) $backup->fresh()->enabled)->toBeFalse();
+});
diff --git a/tests/Feature/BackupExecutionTimestampsTest.php b/tests/Feature/BackupExecutionTimestampsTest.php
new file mode 100644
index 0000000000..87b594e3b5
--- /dev/null
+++ b/tests/Feature/BackupExecutionTimestampsTest.php
@@ -0,0 +1,80 @@
+<?php
+
+use App\Livewire\Project\Database\BackupExecutions as DatabaseBackupExecutions;
+use App\Livewire\Project\Service\BackupExecutions as ServiceBackupExecutions;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Carbon;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file']);
+    Server::flushIdentityMap();
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['server_timezone' => 'Europe/Budapest']);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->service = Service::factory()->create([
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+    ]);
+    $database = ServiceDatabase::create([
+        'service_id' => $this->service->id,
+        'name' => 'timestamps-db',
+        'image' => 'postgres:16-alpine',
+        'custom_type' => 'postgresql',
+    ]);
+    $this->backup = ScheduledDatabaseBackup::create([
+        'team_id' => $team->id,
+        'frequency' => '0 0 * * *',
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+    ]);
+
+    $this->travelTo(Carbon::parse('2026-10-16 14:00:00', 'UTC'));
+    ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $this->backup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/timestamps.dmp',
+        'finished_at' => Carbon::parse('2026-10-16 14:30:05', 'UTC'),
+    ]);
+    $this->travelTo(Carbon::parse('2026-10-16 18:00:00', 'UTC'));
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+});
+
+it('shows the exact finish time of database backup executions in the server timezone', function () {
+    Livewire::test(DatabaseBackupExecutions::class, ['backup' => $this->backup])
+        ->call('refreshBackupExecutions')
+        ->assertSee('2026-10-16 16:30:05 CEST')
+        ->assertSee('Started: 2026-10-16 16:00:00 CEST', false)
+        ->assertSee('3 hours ago');
+});
+
+it('shows the exact start time of service backup executions in the server timezone', function () {
+    Livewire::test(ServiceBackupExecutions::class, ['service' => $this->service])
+        ->assertSee('2026-10-16 16:00:00 CEST')
+        ->assertSee('4 hours ago');
+});
diff --git a/tests/Feature/BackupNowAvailabilityTest.php b/tests/Feature/BackupNowAvailabilityTest.php
index 3d03994201..c1a35d979b 100644
--- a/tests/Feature/BackupNowAvailabilityTest.php
+++ b/tests/Feature/BackupNowAvailabilityTest.php
@@ -114,16 +114,23 @@ it('checks current database status before queuing from a stale page', function (
     Queue::assertNotPushed(DatabaseBackupJob::class);
 })->with('database backup controls');
 
-it('refreshes service backup buttons when the service status check completes', function () {
+it('refreshes service backup buttons when the service status changes', function (string $componentClass, string $event) {
     $database = $this->databases['service'];
     $database->update(['status' => 'exited:unhealthy']);
-    $component = Livewire::test(Index::class, ['service' => $this->service]);
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $this->backups['service']->fresh(), 'availableS3Storages' => collect()];
+    $component = Livewire::test($componentClass, $parameters);
+    $disabledButton = '/<button\s+disabled[^>]*wire:click(\.stop)?="backupNow/s';
     $database->update(['status' => 'running:healthy']);
 
-    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
-    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+    $component->dispatch('echo-private:team.'.currentTeam()->id.','.$event);
+    expect($component->html())->not->toMatch($disabledButton);
 
     $database->update(['status' => 'exited:unhealthy']);
-    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
-    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
-});
+    $component->dispatch('echo-private:team.'.currentTeam()->id.','.$event);
+    expect($component->html())->toMatch($disabledButton);
+})->with([
+    'service list' => Index::class,
+    'service settings' => BackupEdit::class,
+])->with(['ServiceChecked', 'ServiceStatusChanged']);
diff --git a/tests/Feature/BackupS3DestinationsFormTest.php b/tests/Feature/BackupS3DestinationsFormTest.php
index 211360408a..61098268f7 100644
--- a/tests/Feature/BackupS3DestinationsFormTest.php
+++ b/tests/Feature/BackupS3DestinationsFormTest.php
@@ -107,7 +107,7 @@ beforeEach(function () {
 it('saves two S3 destinations for a database backup schedule', function () {
     $backup = createDatabaseBackupForDestinationsFormTest($this->database);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->assertSee('First S3')
         ->assertSee('Second S3')
         ->assertSet('s3StorageIds', [$this->firstStorage->id])
@@ -282,7 +282,7 @@ it('shows the copy status of each destination in the execution lists', function
     }
 
     Livewire::test(BackupExecutions::class, ['backup' => $databaseBackup])
-        ->assertSeeInOrder(['First S3 Available', 'Second S3 Failed'])
+        ->assertSeeInOrder(['First S3', 'Second S3 failed'])
         ->assertSee('Access denied')
         ->assertSee('Delete the selected backup permanently from every S3 storage');
 
@@ -304,12 +304,12 @@ it('keeps a selected destination that is unusable for a while when other setting
     $volumeBackup->syncS3Storages([$this->firstStorage->id, $this->secondStorage->id]);
     $this->secondStorage->update(['is_usable' => false]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $databaseBackup->fresh(), 'availableS3Storages' => $this->team->s3s, 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $databaseBackup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->assertSee('Second S3 (unavailable)')
         ->set('timeout', 7200)
         ->call('submit')
         ->assertHasNoErrors();
-    Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application, 'section' => 's3'])
+    Livewire::test(VolumeBackups::class, ['storage' => $this->volume, 'resource' => $this->application])
         ->assertSee('Second S3 (unavailable)')
         ->set('stopDuringBackup', true)
         ->call('save')
diff --git a/tests/Feature/BackupS3DownloadFallbackTest.php b/tests/Feature/BackupS3DownloadFallbackTest.php
new file mode 100644
index 0000000000..5eccab54b6
--- /dev/null
+++ b/tests/Feature/BackupS3DownloadFallbackTest.php
@@ -0,0 +1,183 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file']);
+    Server::flushIdentityMap();
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->otherTeam = Team::factory()->create();
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $environment = Environment::factory()->create([
+        'project_id' => Project::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+    $database = StandalonePostgresql::create([
+        'name' => 's3-download-pg',
+        'image' => 'postgres:16-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+
+    $this->primaryS3 = createS3ForDownloadFallbackTest($this->team, 'primary');
+    $this->replicaS3 = createS3ForDownloadFallbackTest($this->team, 'replica');
+
+    $this->databaseBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $this->primaryS3->id,
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+    ]);
+    $this->databaseExecution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $this->databaseBackup->id,
+        'status' => 'success',
+        'database_name' => 'postgres',
+        'filename' => '/data/coolify/backups/databases/team/pg/pg-dump-postgres-1.dmp',
+        'local_storage_deleted' => true,
+    ]);
+
+    $this->volumeBackup = $volume->scheduledBackups()->create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+    ]);
+    $this->volumeExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $this->volumeBackup->id,
+        's3_storage_id' => $this->primaryS3->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/team/app/volume-app-data-1.tar.gz',
+        'local_storage_deleted' => true,
+    ]);
+});
+
+function createS3ForDownloadFallbackTest(Team $team, string $name, bool $isUsable = true): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => "{$name}-{$team->id}-bucket",
+        'endpoint' => 'https://1.1.1.1',
+        'team_id' => $team->id,
+        'is_usable' => $isUsable,
+    ]);
+}
+
+function signInForDownloadFallbackTest($testCase, Team $team, string $role = 'owner'): void
+{
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+    $testCase->actingAs($user);
+    session(['currentTeam' => $team]);
+}
+
+/**
+ * @return array{0: string, 1: ScheduledDatabaseBackupExecution|ScheduledVolumeBackupExecution}
+ */
+function downloadFallbackTarget($testCase, string $type): array
+{
+    return $type === 'database'
+        ? ['download.backup', $testCase->databaseExecution]
+        : ['download.volume-backup', $testCase->volumeExecution];
+}
+
+function assertPresignedBackupRedirect($response, S3Storage $storage, string $filename): void
+{
+    $location = $response->assertRedirect()->headers->get('Location');
+    $url = parse_url($location);
+    parse_str($url['query'], $query);
+
+    expect("{$url['scheme']}://{$url['host']}{$url['path']}")->toBe("https://1.1.1.1/{$storage->bucket}".$filename)
+        ->and($query)->toHaveKeys(['X-Amz-Signature', 'X-Amz-Expires'])
+        ->and((int) $query['X-Amz-Expires'])->toBeLessThanOrEqual(15 * 60)
+        ->and($query['response-content-disposition'])->toContain('attachment; filename="'.basename($filename).'"');
+}
+
+it('redirects to a presigned URL of the primary S3 copy when no local copy exists', function (string $type) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->replicaS3->id, 's3_uploaded' => true]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    assertPresignedBackupRedirect($this->get(route($route, $execution->id)), $this->primaryS3, $execution->filename);
+})->with(['database', 'volume']);
+
+it('uses a replica when the primary S3 copy is deleted or its storage is unusable', function (string $type, bool $primaryDeleted) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    if (! $primaryDeleted) {
+        $this->primaryS3->update(['is_usable' => false]);
+    }
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => true, 's3_storage_deleted' => $primaryDeleted]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->replicaS3->id, 's3_uploaded' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    assertPresignedBackupRedirect($this->get(route($route, $execution->id)), $this->replicaS3, $execution->filename);
+})->with(['database', 'volume'])->with(['primary deleted' => true, 'primary unusable' => false]);
+
+it('keeps the not found message when no usable S3 copy exists', function (string $type, string $message) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => false]);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->replicaS3->id, 's3_uploaded' => true, 's3_storage_deleted' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    $this->get(route($route, $execution->id))->assertNotFound()->assertJson(['message' => $message]);
+})->with([
+    'database' => ['database', 'Backup not available locally, but available on S3.'],
+    'volume' => ['volume', 'Backup not found locally on the server.'],
+]);
+
+it('never uses an S3 storage of another team', function (string $type) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $foreignS3 = createS3ForDownloadFallbackTest($this->otherTeam, 'foreign');
+    $execution->s3Replicas()->create(['s3_storage_id' => $foreignS3->id, 's3_uploaded' => true]);
+    signInForDownloadFallbackTest($this, $this->team);
+
+    $this->get(route($route, $execution->id))->assertNotFound();
+})->with(['database', 'volume']);
+
+it('forbids members and other teams from getting a presigned URL', function (string $type, string $user) {
+    [$route, $execution] = downloadFallbackTarget($this, $type);
+    $execution->s3Replicas()->create(['s3_storage_id' => $this->primaryS3->id, 's3_uploaded' => true]);
+    $user === 'member'
+        ? signInForDownloadFallbackTest($this, $this->team, 'member')
+        : signInForDownloadFallbackTest($this, $this->otherTeam);
+
+    $this->get(route($route, $execution->id))->assertForbidden();
+})->with(['database', 'volume'])->with(['member', 'other team owner']);
diff --git a/tests/Feature/BackupS3DownloadTest.php b/tests/Feature/BackupS3DownloadTest.php
new file mode 100644
index 0000000000..a04d90950e
--- /dev/null
+++ b/tests/Feature/BackupS3DownloadTest.php
@@ -0,0 +1,287 @@
+<?php
+
+use App\Jobs\DeleteFileDownloadJob;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Livewire\Project\Database\BackupExecutions;
+use App\Livewire\Project\Service\BackupExecutions as ServiceBackupExecutions;
+use App\Livewire\Project\Shared\Storages\VolumeBackups;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+const BACKUP_S3_DOWNLOAD_FILE = '/data/coolify/backups/databases/orders/pg-dump-orders-1.dmp';
+
+beforeEach(function () {
+    config(['app.maintenance.driver' => 'file', 'constants.ssh.mux_enabled' => false]);
+    Storage::fake('ssh-keys');
+    Server::flushIdentityMap();
+    Once::flush();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Team::factory()->create(['id' => 0]);
+    $this->downloadStorage = S3Storage::create([
+        'name' => 'Downloads',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'downloads',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => 0,
+    ]);
+    InstanceSettings::find(0)->update(['file_download_s3_storage_id' => $this->downloadStorage->id]);
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->otherTeam = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $privateKey->id]);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $environment->id,
+        'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'database_id' => $this->database->id,
+        'database_type' => $this->database->getMorphClass(),
+    ]);
+    $this->execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $this->backup->id,
+        'status' => 'success',
+        'filename' => BACKUP_S3_DOWNLOAD_FILE,
+    ]);
+    $this->service = Service::factory()->create([
+        'server_id' => $this->server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+    ]);
+
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'admin']);
+    $this->user->teams()->attach($this->otherTeam, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    Bus::fake([PrepareFileDownloadJob::class]);
+});
+
+function fakeBackupFileSize(int|string $size): void
+{
+    Process::fake(['*' => Process::result(output: (string) $size)]);
+}
+
+it('uploads a database backup through S3 for an admin of its team after a team switch', function () {
+    fakeBackupFileSize(1024);
+    $component = Livewire::test(BackupExecutions::class, ['backup' => $this->backup]);
+    session(['currentTeam' => $this->otherTeam]);
+
+    $component->call('download_file', $this->execution->id)
+        ->assertDispatched('info')
+        ->assertNotDispatched('open-backup-download')
+        ->assertCount('pendingDownloads', 1);
+
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->container === null
+        && $job->path === BACKUP_S3_DOWNLOAD_FILE
+        && $job->serverId === $this->server->id
+        && $job->downloadName === 'pg-dump-orders-1.dmp'
+        && $job->s3StorageId === $this->downloadStorage->id
+        && $job->userId === $this->user->id);
+});
+
+it('streams through the download route when no download storage is set', function () {
+    InstanceSettings::find(0)->update(['file_download_s3_storage_id' => null]);
+    Once::flush();
+    Process::fake();
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id)
+        ->assertDispatched('open-backup-download', url: route('download.backup', $this->execution->id));
+
+    Process::assertNothingRan();
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('streams through the download route when the backup is larger than one S3 upload', function () {
+    fakeBackupFileSize(FileDownloadStorageService::MAX_SIZE + 1);
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id)
+        ->assertDispatched('open-backup-download', url: route('download.backup', $this->execution->id));
+
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('lets the download route answer when the backup file is not on the server', function () {
+    fakeBackupFileSize('');
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id)
+        ->assertDispatched('open-backup-download', url: route('download.backup', $this->execution->id));
+
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('refuses team members', function () {
+    Process::fake();
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    $component = Livewire::test(BackupExecutions::class, ['backup' => $this->backup]);
+
+    $component->call('download_file', $this->execution->id)
+        ->assertNotDispatched('open-backup-download');
+
+    Process::assertNothingRan();
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('does not download an execution of another backup', function () {
+    Process::fake();
+    $foreignBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->otherTeam->id,
+        'frequency' => 'daily',
+        'database_id' => $this->database->id + 1000,
+        'database_type' => $this->database->getMorphClass(),
+    ]);
+    $foreignExecution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $foreignBackup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/databases/other/secret.dmp',
+    ]);
+
+    Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $foreignExecution->id)
+        ->assertDispatched('error', 'Backup execution not found.')
+        ->assertNotDispatched('open-backup-download');
+
+    Process::assertNothingRan();
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('uploads a volume backup through S3 and refuses members', function () {
+    fakeBackupFileSize(2048);
+    $application = Application::factory()->create([
+        'environment_id' => $this->database->environment_id,
+        'destination_id' => $this->database->destination_id,
+        'destination_type' => $this->database->destination_type,
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create(['team_id' => $this->team->id, 'frequency' => 'daily']);
+    $execution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $backup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/volumes/app/archive.tar.gz',
+    ]);
+    $component = Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application]);
+    session(['currentTeam' => $this->otherTeam]);
+
+    $component->call('downloadBackup', $execution->id)->assertCount('pendingDownloads', 1);
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->container === null
+        && $job->path === '/data/coolify/backups/volumes/app/archive.tar.gz'
+        && $job->serverId === $this->server->id);
+
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    $component->call('downloadBackup', $execution->id)->assertForbidden();
+    Bus::assertDispatchedTimes(PrepareFileDownloadJob::class, 1);
+});
+
+it('uploads a service database backup through S3', function () {
+    fakeBackupFileSize(1024);
+    $serviceDatabase = ServiceDatabase::create([
+        'service_id' => $this->service->id,
+        'name' => 'service-db',
+        'image' => 'postgres:16-alpine',
+        'custom_type' => 'postgresql',
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->team->id,
+        'frequency' => 'daily',
+        'database_id' => $serviceDatabase->id,
+        'database_type' => $serviceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'filename' => '/data/coolify/backups/service/db.dmp',
+    ]);
+
+    Livewire::test(ServiceBackupExecutions::class, ['service' => $this->service])
+        ->call('downloadExecution', $execution->uuid)
+        ->assertCount('pendingDownloads', 1);
+
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->container === null
+        && $job->path === '/data/coolify/backups/service/db.dmp');
+});
+
+it('opens a finished link only for the user who asked for it', function () {
+    fakeBackupFileSize(1024);
+    $component = Livewire::test(BackupExecutions::class, ['backup' => $this->backup])
+        ->call('download_file', $this->execution->id);
+    $downloadId = $component->get('pendingDownloads')[0];
+
+    Cache::put(PrepareFileDownloadJob::cacheKey($downloadId), ['user_id' => $this->user->id + 1, 'status' => 'ready', 'url' => 'https://s3.example.com/other']);
+    $component->call('checkDownloads')->assertNotDispatched('open-backup-download')->assertCount('pendingDownloads', 1);
+
+    Cache::put(PrepareFileDownloadJob::cacheKey($downloadId), ['user_id' => $this->user->id, 'status' => 'ready', 'url' => 'https://s3.example.com/get']);
+    $component->call('checkDownloads')
+        ->assertDispatched('open-backup-download', url: 'https://s3.example.com/get')
+        ->assertCount('pendingDownloads', 0);
+});
+
+it('uploads the backup file from the server host with curl', function () {
+    Bus::fake([DeleteFileDownloadJob::class]);
+    Process::fake(['*' => Process::result(output: '')]);
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('uploadUrl')->andReturn(['url' => 'https://s3.example.com/put?X-Amz-Signature=abc&x=1', 'headers' => ['Content-Disposition' => 'attachment']]);
+    $downloads->shouldReceive('downloadUrl')->andReturn('https://s3.example.com/get');
+
+    (new PrepareFileDownloadJob('dl-host', $this->user->id, $this->server->id, null, BACKUP_S3_DOWNLOAD_FILE, false, 'pg.dmp', $this->downloadStorage->id))->handle($downloads);
+
+    expect(Cache::get(PrepareFileDownloadJob::cacheKey('dl-host')))->toMatchArray(['status' => 'ready', 'url' => 'https://s3.example.com/get']);
+    Process::assertRan(fn ($process) => str_contains($process->command, 'curl -fsS')
+        && str_contains($process->command, BACKUP_S3_DOWNLOAD_FILE)
+        && str_contains($process->command, 'X-Amz-Signature=abc&x=1')
+        && ! str_contains($process->command, 'docker exec'));
+});
+
+it('builds host file commands that the non-root sudo parser keeps whole', function () {
+    $nonRoot = Server::factory()->make(['user' => 'deploy']);
+    $upload = FileDownloadStorageService::buildHostFileUploadCommand("/data/it's.dmp", 'https://s3.example.com/put?a=1&b=2', ['Content-Disposition' => 'attachment']);
+    $size = FileDownloadStorageService::buildHostFileSizeCommand("/data/it's.dmp");
+
+    expect(parseCommandsByLineForSudo(collect([$upload, $size]), $nonRoot))->toBe(['sudo '.$upload, 'sudo '.$size])
+        ->and(fn () => FileDownloadStorageService::buildHostFileSizeCommand('/data/a;rm -rf /'))->toThrow(Exception::class);
+});
diff --git a/tests/Feature/BackupS3StorageListResourceTeamTest.php b/tests/Feature/BackupS3StorageListResourceTeamTest.php
index 90f87493b4..d4b61b16b4 100644
--- a/tests/Feature/BackupS3StorageListResourceTeamTest.php
+++ b/tests/Feature/BackupS3StorageListResourceTeamTest.php
@@ -112,7 +112,7 @@ test('database backup page offers only usable S3 storages of the database team',
         'database_id' => $this->postgres->id,
         'database_type' => $this->postgres->getMorphClass(),
     ]);
-    $url = route('project.database.backup.s3', [
+    $url = route('project.database.backup.execution', [
         'project_uuid' => $this->project->uuid,
         'environment_uuid' => $this->environment->uuid,
         'database_uuid' => $this->postgres->uuid,
diff --git a/tests/Feature/BitbucketPullRequestWebhookRoutingTest.php b/tests/Feature/BitbucketPullRequestWebhookRoutingTest.php
new file mode 100644
index 0000000000..f186c30c36
--- /dev/null
+++ b/tests/Feature/BitbucketPullRequestWebhookRoutingTest.php
@@ -0,0 +1,105 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+function createBitbucketPullRequestWebhookApplication(): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create([
+        'name' => 'bitbucket-pr-webhook-app',
+        'git_repository' => 'https://bitbucket.org/test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function sendBitbucketPullRequestWebhook(Application $application, string $event, string $destinationBranch)
+{
+    $body = json_encode([
+        'repository' => [
+            'full_name' => 'test-org/test-repo',
+            'uuid' => '{repository-uuid}',
+        ],
+        'pullrequest' => [
+            'id' => 42,
+            'title' => 'Stacked change',
+            'links' => ['html' => ['href' => 'https://bitbucket.org/test-org/test-repo/pull-requests/42']],
+            'source' => [
+                'branch' => ['name' => 'feature/child'],
+                'commit' => ['hash' => 'abc1234def5678'],
+                'repository' => ['uuid' => '{repository-uuid}'],
+            ],
+            'destination' => [
+                'branch' => ['name' => $destinationBranch],
+                'repository' => ['uuid' => '{repository-uuid}'],
+            ],
+        ],
+    ], JSON_THROW_ON_ERROR);
+
+    return test()->call('POST', '/webhooks/source/bitbucket/events/manual', [], [], [], [
+        'HTTP_X-Event-Key' => $event,
+        'HTTP_X-Hub-Signature' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_bitbucket),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+}
+
+it('cleans up the preview of a closed pull request after the destination branch changes', function (string $event) {
+    $application = createBitbucketPullRequestWebhookApplication();
+    $preview = ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://bitbucket.org/test-org/test-repo/pull-requests/42',
+        'git_type' => 'bitbucket',
+    ]);
+
+    CleanupPreviewDeployment::shouldRun()
+        ->once()
+        ->withArgs(fn (Application $cleanedApplication, int $pullRequestId, ApplicationPreview $cleanedPreview): bool => $cleanedApplication->is($application)
+            && $pullRequestId === 42
+            && $cleanedPreview->is($preview))
+        ->andReturn([
+            'cancelled_deployments' => 0,
+            'killed_containers' => 0,
+            'status' => 'success',
+        ]);
+
+    $response = sendBitbucketPullRequestWebhook($application, $event, 'feature/parent');
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('Preview deployment closed.');
+})->with(['pullrequest:fulfilled', 'pullrequest:rejected']);
+
+it('continues to filter opened pull requests by destination branch', function () {
+    Queue::fake();
+    $application = createBitbucketPullRequestWebhookApplication();
+    $application->settings->update(['is_preview_deployments_enabled' => true]);
+
+    $response = sendBitbucketPullRequestWebhook($application, 'pullrequest:created', 'feature/parent');
+
+    $response->assertOk();
+    expect(ApplicationPreview::where('application_id', $application->id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/ContainerFilesystemServiceTest.php b/tests/Feature/ContainerFilesystemServiceTest.php
new file mode 100644
index 0000000000..3d89dfdb26
--- /dev/null
+++ b/tests/Feature/ContainerFilesystemServiceTest.php
@@ -0,0 +1,381 @@
+<?php
+
+use App\Data\FileEntry;
+use App\Models\LocalFileVolume;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Services\ContainerFilesystemService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Storage::fake('ssh-keys');
+    // Disable SSH multiplexing so each instant_remote_process is exactly one
+    // faked Process call (mux setup would run extra calls and desync sequences).
+    config(['constants.ssh.mux_enabled' => false]);
+});
+
+function fsService(): ContainerFilesystemService
+{
+    $server = Server::factory()->make(['id' => 999]);
+
+    return new ContainerFilesystemService($server, 'app-123');
+}
+
+function fsServer(): Server
+{
+    $team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+
+    return Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+        'ip' => '203.0.113.10',
+    ]);
+}
+
+it('sorts directories before files, then by name case-insensitively', function () {
+    $entries = [
+        new FileEntry('README.md', 'file', 10, 100),
+        new FileEntry('src', 'dir', 0, 100),
+        new FileEntry('.env', 'file', 5, 100),
+        new FileEntry('assets', 'dir', 0, 100),
+    ];
+
+    $names = array_map(fn (FileEntry $e) => $e->name, FileEntry::sort($entries));
+
+    expect($names)->toBe(['assets', 'src', '.env', 'README.md']);
+});
+
+it('builds a listing command with a single stat call, escaped path and container name', function () {
+    $cmd = fsService()->buildListCommand('/var/www/html');
+
+    expect($cmd)
+        ->toContain('docker exec')
+        ->toContain('app-123')
+        ->toContain('stat -c')
+        ->toContain(escapeshellarg('/var/www/html'))
+        // Must embed a REAL tab, not a literal backslash-t: stat -c does not
+        // expand \t, so a literal escape would break the tab-delimited parse.
+        ->toContain("%F\t%s")
+        ->not->toContain('%F\\t%s')
+        // find batches names, so a huge folder cannot overflow the argument limit like a glob.
+        ->toContain('find . ! -name . -prune -exec stat -c')
+        ->not->toContain('* .*');
+});
+
+it('rejects an unsafe listing path', function () {
+    fsService()->buildListCommand('/tmp/$(reboot)');
+})->throws(Exception::class);
+
+it('parses a tab-delimited listing into sorted FileEntry rows', function () {
+    $raw = implode("\n", [
+        "file\t10\t1700000000\tREADME.md",
+        "dir\t0\t1700000001\tsrc",
+        "file\t5\t1700000002\t.env",
+    ]);
+
+    $entries = fsService()->parseListing($raw);
+
+    expect($entries)->toHaveCount(3);
+    expect($entries[0]->name)->toBe('src');
+    expect($entries[0]->type)->toBe('dir');
+    expect($entries[1]->name)->toBe('.env');
+    expect($entries[2]->name)->toBe('README.md');
+});
+
+it('strips the ./ prefix that find adds to listed names', function () {
+    $raw = implode("\n", [
+        "directory\t0\t1\t755\troot\troot\t./src",
+        "regular file\t5\t2\t644\troot\troot\t./.env",
+    ]);
+
+    $names = array_map(fn ($entry) => $entry->name, fsService()->parseListing($raw));
+
+    expect($names)->toBe(['src', '.env']);
+});
+
+it('parses an empty listing to an empty array', function () {
+    expect(fsService()->parseListing(null))->toBe([]);
+    expect(fsService()->parseListing(''))->toBe([]);
+});
+
+it('lists a directory by running the built command over SSH', function () {
+    Process::fake(['*' => Process::result(output: "dir\t0\t1\tsrc\nfile\t10\t2\tREADME.md")]);
+
+    $server = fsServer();
+    $entries = (new ContainerFilesystemService($server, 'app-123'))->list('/app');
+
+    expect($entries)->toHaveCount(2);
+    expect($entries[0]->name)->toBe('src');
+});
+
+it('falls back to / when the container has no WorkingDir', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+
+    $server = fsServer();
+    expect((new ContainerFilesystemService($server, 'app-123'))->defaultRoot())->toBe('/');
+});
+
+it('refuses to read a file larger than the edit cap', function () {
+    // The combined read command emits TOOBIG in a single round trip.
+    Process::fake(['*' => Process::result(output: 'TOOBIG')]);
+
+    $server = fsServer();
+    (new ContainerFilesystemService($server, 'app-123'))->read('/app/big.bin');
+})->throws(RuntimeException::class);
+
+it('refuses to read a binary file', function () {
+    Process::fake(['*' => Process::result(output: 'BINARY')]);
+
+    $server = fsServer();
+    (new ContainerFilesystemService($server, 'app-123'))->read('/app/a.bin');
+})->throws(RuntimeException::class);
+
+it('reads an editable text file in a single round trip', function () {
+    // "OK" header line then the base64 payload, from one docker exec.
+    Process::fake(['*' => Process::result(output: "OK\n".base64_encode("hello world\n"))]);
+
+    $server = fsServer();
+    $content = (new ContainerFilesystemService($server, 'app-123'))->read('/app/a.txt');
+
+    expect($content)->toBe("hello world\n");
+});
+
+it('treats an empty file as editable text', function () {
+    // Empty file => "OK" header with no payload.
+    Process::fake(['*' => Process::result(output: 'OK')]);
+
+    $server = fsServer();
+
+    expect((new ContainerFilesystemService($server, 'app-123'))->read('/app/empty.txt'))->toBe('');
+});
+
+it('writes content near or above the shell argument limit via docker cp', function (int $size) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $server = fsServer();
+
+    (new ContainerFilesystemService($server, 'app-123'))->write('/app/big.txt', str_repeat('a', $size));
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'docker cp'));
+})->with([96 * 1024, 200_000]);
+
+it('base64-encodes content in the write command', function () {
+    $cmd = fsService()->buildWriteCommand('/app/a.txt', "hi\n");
+
+    expect($cmd)
+        ->toContain('base64 -d')
+        ->toContain(base64_encode("hi\n"))
+        ->toContain(escapeshellarg('/app/a.txt'));
+});
+
+it('builds mkdir, rename and delete commands with escaped paths', function () {
+    $svc = fsService();
+
+    expect($svc->buildMkdirCommand('/app/new dir'))
+        ->toContain('mkdir -p')
+        ->toContain(escapeshellarg('/app/new dir'));
+    expect($svc->buildRenameCommand('/app/a', '/app/b'))
+        ->toContain('mv')
+        ->toContain(escapeshellarg('/app/a'))
+        ->toContain(escapeshellarg('/app/b'));
+    expect($svc->buildDeleteCommand('/app/x'))
+        ->toContain('rm -rf')
+        ->toContain(escapeshellarg('/app/x'));
+});
+
+it('rejects unsafe paths in mutating builders', function () {
+    fsService()->buildDeleteCommand('/app/$(reboot)');
+})->throws(Exception::class);
+
+it('parses the 7-field stat listing with owner and group, mapping the file type', function () {
+    $raw = implode("\n", [
+        "directory\t4096\t1700000000\t755\troot\troot\t.",
+        "directory\t4096\t1700000000\t755\troot\troot\t..",
+        "regular file\t497\t1700000001\t644\twww-data\twww-data\t50x.html",
+        "directory\t4096\t1700000002\t755\tapp\tapp\tassets",
+        "symbolic link\t11\t1700000003\t777\troot\troot\tlink",
+    ]);
+
+    $entries = fsService()->parseListing($raw);
+
+    // The stat . and .. rows are dropped.
+    expect($entries)->toHaveCount(3);
+    expect($entries[0]->name)->toBe('assets');
+    expect($entries[0]->type)->toBe('dir');
+    expect($entries[0]->owner)->toBe('app');
+    expect($entries[0]->group)->toBe('app');
+    expect($entries[1]->name)->toBe('50x.html');
+    expect($entries[1]->type)->toBe('file');
+    expect($entries[1]->owner)->toBe('www-data');
+    expect($entries[2]->name)->toBe('link');
+    expect($entries[2]->type)->toBe('symlink');
+});
+
+it('parses permissions from the 5-field listing format', function () {
+    $raw = "file\t497\t1700000000\t644\t50x.html\ndir\t0\t1700000001\t755\tassets";
+
+    $entries = fsService()->parseListing($raw);
+
+    expect($entries[0]->name)->toBe('assets');
+    expect($entries[0]->perms)->toBe('755');
+    expect($entries[1]->name)->toBe('50x.html');
+    expect($entries[1]->perms)->toBe('644');
+});
+
+it('builds a create-file command that does not truncate an existing file', function () {
+    $cmd = fsService()->buildCreateFileCommand('/app/new file.txt');
+
+    expect($cmd)
+        ->toContain('[ -e')
+        ->toContain(': >')
+        ->toContain(escapeshellarg('/app/new file.txt'));
+});
+
+it('builds a chmod command with a validated octal mode', function () {
+    $cmd = fsService()->buildChmodCommand('/app/x.sh', '0755');
+
+    expect($cmd)
+        ->toContain('chmod 0755 --')
+        ->toContain(escapeshellarg('/app/x.sh'));
+});
+
+it('rejects a non-octal chmod mode', function () {
+    fsService()->buildChmodCommand('/app/x.sh', 'rwx');
+})->throws(InvalidArgumentException::class);
+
+it('rejects an unsafe path in the chmod builder', function () {
+    fsService()->buildChmodCommand('/app/$(reboot)', '644');
+})->throws(Exception::class);
+
+it('uploads by scp-ing to the server then docker cp into the container', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $server = fsServer();
+    $local = tempnam(sys_get_temp_dir(), 'up');
+    file_put_contents($local, 'data');
+
+    (new ContainerFilesystemService($server, 'app-123'))->upload($local, '/app/plugins/x.jar');
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'docker cp')
+        && str_contains($process->command, 'app-123'));
+    @unlink($local);
+});
+
+it('rejects failed or corrupt read responses', function (string $output) {
+    Process::fake(['*' => Process::result(output: $output)]);
+    (new ContainerFilesystemService(fsServer(), 'app-123'))->read('/app/a.txt');
+})->with(['', 'ERROR', "OK\n!!!"])->throws(RuntimeException::class);
+
+it('executes read guards for real file bytes through the non-root sudo parser', function (string $content, bool $editable) {
+    $server = fsServer();
+    $server->update(['user' => 'deploy']);
+    $path = tempnam(sys_get_temp_dir(), 'fs-read-');
+    file_put_contents($path, $content);
+    Process::fake(function ($process) {
+        $lines = explode("\n", $process->command);
+        $body = implode("\n", array_slice($lines, 1, -1));
+        $local = new Symfony\Component\Process\Process([
+            'bash', '-c',
+            'sudo() { "$@"; }; docker() { shift 2; "$@"; }; export -f sudo docker;'."\n".$body,
+        ]);
+        $local->run();
+
+        return Process::result(output: $local->getOutput(), errorOutput: $local->getErrorOutput(), exitCode: $local->getExitCode());
+    });
+    try {
+        $service = new ContainerFilesystemService($server, 'app-123');
+        if ($editable) {
+            expect($service->read($path))->toBe($content);
+        } else {
+            expect(fn () => $service->read($path))->toThrow(RuntimeException::class);
+        }
+    } finally {
+        @unlink($path);
+    }
+})->with([
+    'empty' => ['', true],
+    'newline only' => ["\n\n", true],
+    'text' => ["hello\n", true],
+    'binary' => ["hello\0world", false],
+]);
+
+it('rejects a symlink to an oversized file before reading its content', function () {
+    $server = fsServer();
+    $path = tempnam(sys_get_temp_dir(), 'fs-size-');
+    $link = $path.'-link';
+    $handle = fopen($path, 'w');
+    ftruncate($handle, LocalFileVolume::MAX_CONTENT_SIZE + 1);
+    fclose($handle);
+    symlink($path, $link);
+    Process::fake(function ($process) {
+        $body = implode("\n", array_slice(explode("\n", $process->command), 1, -1));
+        $local = new Symfony\Component\Process\Process(['bash', '-c', 'sudo() { "$@"; }; docker() { shift 2; "$@"; }; export -f sudo docker;'."\n".$body]);
+        $local->run();
+
+        return Process::result(output: $local->getOutput(), exitCode: $local->getExitCode());
+    });
+    try {
+        expect(fn () => (new ContainerFilesystemService($server, 'app-123'))->read($link))
+            ->toThrow(RuntimeException::class, 'File is not editable');
+    } finally {
+        @unlink($link);
+        @unlink($path);
+    }
+});
+
+it('reads download type and size in one round trip', function (string $output, bool $isDir, int $size) {
+    Process::fake(['*' => Process::result(output: $output)]);
+
+    $info = (new ContainerFilesystemService(fsServer(), 'app-123'))->downloadInfo('/app/target');
+
+    expect($info)->toBe(['isDir' => $isDir, 'size' => $size]);
+    Process::assertRanTimes(fn () => true, 1);
+})->with([
+    'file' => ['file 497', false, 497],
+    'folder in KiB' => ['dir 4', true, 4096],
+]);
+
+it('rejects a download target that does not exist', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+
+    (new ContainerFilesystemService(fsServer(), 'app-123'))->downloadInfo('/app/missing');
+})->throws(RuntimeException::class, 'File not found.');
+
+it('builds download commands that write to stdout instead of a temp file', function () {
+    $svc = fsService();
+
+    expect($svc->buildDownloadCommand("/app/it's.txt", false))
+        ->toBe("docker exec 'app-123' cat -- ".escapeshellarg("/app/it's.txt"));
+    expect($svc->buildDownloadCommand('/app/dir', true))
+        ->toBe("docker exec 'app-123' tar czf - -C '/app/dir' .");
+});
+
+it('streams the remote command output to the writer in chunks', function () {
+    $server = fsServer();
+    $svc = new class($server, 'app-123') extends ContainerFilesystemService
+    {
+        public ?string $remoteCommand = null;
+
+        protected function sshCommand(string $command): string
+        {
+            $this->remoteCommand = $command;
+
+            return 'head -c 200000 /dev/zero';
+        }
+    };
+    $received = '';
+    $chunks = 0;
+
+    $svc->streamDownload('/app/a.bin', false, function (string $chunk) use (&$received, &$chunks) {
+        $received .= $chunk;
+        $chunks++;
+    });
+
+    expect($svc->remoteCommand)->toEndWith("docker exec 'app-123' cat -- '/app/a.bin'");
+    expect(strlen($received))->toBe(200000);
+    expect($chunks)->toBeGreaterThan(1);
+});
diff --git a/tests/Feature/CoolifyDefaultEnvironmentVariablesTest.php b/tests/Feature/CoolifyDefaultEnvironmentVariablesTest.php
new file mode 100644
index 0000000000..8b67751f30
--- /dev/null
+++ b/tests/Feature/CoolifyDefaultEnvironmentVariablesTest.php
@@ -0,0 +1,246 @@
+<?php
+
+use App\Actions\Database\StartDragonfly;
+use App\Actions\Database\StartPostgresql;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Project\Shared\EnvironmentVariable\All;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::query()->firstOrCreate(['id' => 0]);
+    Bus::fake();
+
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = $this->server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop $live']);
+    $this->environment = Environment::factory()->create(['project_id' => $project->id, 'name' => 'staging']);
+});
+
+function coolifyDefaultsPostgres(array $attributes = []): StandalonePostgresql
+{
+    return StandalonePostgresql::forceCreate([
+        'uuid' => 'coolify-defaults-db',
+        'name' => 'Main database',
+        'image' => 'postgres:16-alpine',
+        'postgres_password' => 'password',
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        ...$attributes,
+    ]);
+}
+
+/**
+ * @return array<int, string>
+ */
+function coolifyDefaultsDatabaseEnvironment(object $action, $database): array
+{
+    $action->database = $database->fresh();
+
+    return (new ReflectionMethod($action, 'generate_environment_variables'))->invoke($action);
+}
+
+/**
+ * @return array<int, string>
+ */
+function coolifyDefaultsApplicationEnv(Application $application, bool $forBuildTime = false, ?Server $deploymentServer = null): array
+{
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class);
+    $queue->shouldReceive('addLogEntry')->andReturnNull();
+
+    $properties = [
+        'application' => $application->fresh(),
+        'application_deployment_queue' => $queue,
+        'build_pack' => 'nixpacks',
+        'mainServer' => $deploymentServer ?? $application->destination->server,
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+        'branch' => 'main',
+        'container_name' => 'coolify-defaults-app',
+        'saved_outputs' => collect(),
+    ];
+    foreach ($properties as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    if ($forBuildTime) {
+        return collect($reflection->getMethod('generate_coolify_env_variables')->invoke($job, true))
+            ->map(fn ($value, $key) => "{$key}={$value}")->values()->all();
+    }
+
+    return collect($reflection->getMethod('generate_runtime_environment_variables')->invoke($job))->all();
+}
+
+function coolifyDefaultsApplication(): Application
+{
+    return Application::factory()->create([
+        'name' => 'My web app',
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+    ]);
+}
+
+function coolifyDefaultsService(string $environmentYaml = ''): Service
+{
+    $service = Service::factory()->create([
+        'name' => 'blog',
+        'environment_id' => test()->environment->id,
+        'server_id' => test()->server->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  app:\n    image: nginx:latest\n{$environmentYaml}",
+    ]);
+    ServiceApplication::create(['name' => 'app', 'service_id' => $service->id]);
+
+    return $service;
+}
+
+test('a database gets the same Coolify variables as other resources, with compose-safe values', function () {
+    $environment = coolifyDefaultsDatabaseEnvironment(new StartPostgresql, coolifyDefaultsPostgres());
+
+    expect($environment)
+        ->toContain('COOLIFY_RESOURCE_UUID=coolify-defaults-db')
+        ->toContain('COOLIFY_CONTAINER_NAME=coolify-defaults-db')
+        ->toContain('COOLIFY_APP_NAME=Main database')
+        ->toContain('COOLIFY_PROJECT_NAME=Shop $$live')
+        ->toContain('COOLIFY_ENVIRONMENT_NAME=staging')
+        ->toContain("COOLIFY_SERVER_IP={$this->server->ip}");
+});
+
+test('a Dragonfly database also gets the Coolify variables', function () {
+    $database = StandaloneDragonfly::forceCreate([
+        'uuid' => 'coolify-defaults-dragonfly',
+        'name' => 'Cache',
+        'image' => 'docker.dragonflydb.io/dragonflydb/dragonfly',
+        'dragonfly_password' => 'password',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    expect(coolifyDefaultsDatabaseEnvironment(new StartDragonfly, $database))
+        ->toContain('COOLIFY_RESOURCE_UUID=coolify-defaults-dragonfly')
+        ->toContain('COOLIFY_APP_NAME=Cache');
+});
+
+test('a database variable that the user defines wins over the Coolify variable', function () {
+    $database = coolifyDefaultsPostgres();
+    $database->runtime_environment_variables()->create(['key' => 'COOLIFY_APP_NAME', 'value' => 'custom']);
+
+    $appNames = collect(coolifyDefaultsDatabaseEnvironment(new StartPostgresql, $database))
+        ->filter(fn ($variable) => str_starts_with($variable, 'COOLIFY_APP_NAME='));
+
+    expect($appNames->values()->all())->toBe(['COOLIFY_APP_NAME=custom']);
+});
+
+test('a database without the option gets no default variables but keeps its identity variables', function () {
+    $environment = coolifyDefaultsDatabaseEnvironment(new StartPostgresql, coolifyDefaultsPostgres(['include_coolify_default_variables' => false]));
+
+    expect(collect($environment)->first(fn ($variable) => str_starts_with($variable, 'COOLIFY_APP_NAME=')))->toBeNull()
+        ->and(collect($environment)->first(fn ($variable) => str_starts_with($variable, 'COOLIFY_SERVER_IP=')))->toBeNull()
+        ->and($environment)->toContain('COOLIFY_RESOURCE_UUID=coolify-defaults-db');
+});
+
+test('an application gets the default variables as quoted lines in its runtime .env file', function () {
+    $environment = coolifyDefaultsApplicationEnv(coolifyDefaultsApplication());
+
+    expect($environment)
+        ->toContain('COOLIFY_APP_NAME="My web app"')
+        ->toContain('COOLIFY_PROJECT_NAME="Shop \\$live"')
+        ->toContain('COOLIFY_ENVIRONMENT_NAME="staging"')
+        ->toContain("COOLIFY_SERVER_IP=\"{$this->server->ip}\"");
+});
+
+test('an application on an additional server gets the IP of the server it runs on', function () {
+    $additionalServer = Server::factory()->create(['team_id' => $this->team->id, 'ip' => '203.0.113.7']);
+
+    expect(coolifyDefaultsApplicationEnv(coolifyDefaultsApplication(), deploymentServer: $additionalServer))
+        ->toContain('COOLIFY_SERVER_IP="203.0.113.7"');
+});
+
+test('an application build does not get the default variables', function () {
+    $environment = coolifyDefaultsApplicationEnv(coolifyDefaultsApplication(), forBuildTime: true);
+
+    expect(collect($environment)->first(fn ($variable) => str_starts_with($variable, 'COOLIFY_APP_NAME=')))->toBeNull()
+        ->and(collect($environment)->first(fn ($variable) => str_starts_with($variable, 'COOLIFY_RESOURCE_UUID=')))->not->toBeNull();
+});
+
+test('an application without the option gets no default variables', function () {
+    $application = coolifyDefaultsApplication();
+    $application->settings->update(['include_coolify_default_variables' => false]);
+
+    $environment = coolifyDefaultsApplicationEnv($application);
+
+    expect(collect($environment)->first(fn ($variable) => str_starts_with($variable, 'COOLIFY_APP_NAME=')))->toBeNull();
+});
+
+test('a service variable defined in the compose file wins over the Coolify variable', function () {
+    $service = coolifyDefaultsService("    environment:\n      COOLIFY_APP_NAME: custom\n");
+
+    $environment = data_get(serviceParser($service), 'services.app.environment');
+
+    expect($environment['COOLIFY_APP_NAME'])->toBe('custom')
+        ->and($environment['COOLIFY_PROJECT_NAME'])->toBe('Shop $$live');
+});
+
+test('a service without the option gets no default variables', function () {
+    $service = coolifyDefaultsService();
+    $service->forceFill(['include_coolify_default_variables' => false])->save();
+
+    $environment = collect(data_get(serviceParser($service->fresh()), 'services.app.environment'));
+
+    expect($environment->has('COOLIFY_APP_NAME'))->toBeFalse()
+        ->and($environment->has('COOLIFY_RESOURCE_UUID'))->toBeTrue();
+});
+
+test('a team admin turns the option off from the environment variables page', function (string $resourceType) {
+    $user = User::factory()->create();
+    $this->team->members()->attach($user, ['role' => 'admin']);
+    $this->actingAs($user);
+    $resource = match ($resourceType) {
+        'application' => coolifyDefaultsApplication(),
+        'service' => coolifyDefaultsService(),
+        'database' => coolifyDefaultsPostgres(),
+    };
+
+    Livewire::test(All::class, ['resource' => $resource])
+        ->assertSet('include_coolify_default_variables', true)
+        ->set('include_coolify_default_variables', false)
+        ->call('saveCoolifyDefaultVariables');
+
+    $owner = $resource instanceof Application ? $resource->settings->fresh() : $resource->fresh();
+    expect($owner->include_coolify_default_variables)->toBeFalse();
+})->with(['application', 'service', 'database']);
+
+test('a team member cannot change the option', function () {
+    $user = User::factory()->create();
+    $this->team->members()->attach($user, ['role' => 'member']);
+    $this->actingAs($user);
+    $database = coolifyDefaultsPostgres();
+
+    Livewire::test(All::class, ['resource' => $database])
+        ->set('include_coolify_default_variables', false)
+        ->call('saveCoolifyDefaultVariables');
+
+    expect($database->fresh()->include_coolify_default_variables)->toBeTrue();
+});
diff --git a/tests/Feature/DashboardCanvasTest.php b/tests/Feature/DashboardCanvasTest.php
new file mode 100644
index 0000000000..9204b3e77a
--- /dev/null
+++ b/tests/Feature/DashboardCanvasTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'name' => 'web-server']);
+    $this->environment = Environment::factory()->create([
+        'project_id' => Project::factory()->create(['team_id' => $this->team->id])->id,
+    ]);
+});
+
+function dashboardCanvasApp(Environment $environment, Server $server, string $name): Application
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+
+    return Application::factory()->create([
+        'name' => $name,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function dashboardCanvasDeployment(Application $application, Server $server, ApplicationDeploymentStatus $status): ApplicationDeploymentQueue
+{
+    return ApplicationDeploymentQueue::query()->forceCreate([
+        'application_id' => (string) $application->id,
+        'application_name' => $application->name,
+        'deployment_uuid' => (string) str()->uuid(),
+        'deployment_url' => '/deployment/'.$status->value,
+        'server_id' => $server->id,
+        'server_name' => $server->name,
+        'status' => $status->value,
+    ]);
+}
+
+function dashboardCanvasSession(object $test, User $user, Team $team): object
+{
+    return $test->actingAs($user)->withSession(['currentTeam' => $team])
+        ->withHeader('X-Canvas-Team', (string) $team->id);
+}
+
+test('the dashboard canvas marks applications with an active deployment and lists recent deployments', function () {
+    $deploying = dashboardCanvasApp($this->environment, $this->server, 'storefront');
+    $queued = dashboardCanvasApp($this->environment, $this->server, 'orders-api');
+    $idle = dashboardCanvasApp($this->environment, $this->server, 'docs');
+    dashboardCanvasDeployment($deploying, $this->server, ApplicationDeploymentStatus::IN_PROGRESS);
+    dashboardCanvasDeployment($queued, $this->server, ApplicationDeploymentStatus::QUEUED);
+    dashboardCanvasDeployment($idle, $this->server, ApplicationDeploymentStatus::FINISHED);
+
+    $response = dashboardCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/dashboard/canvas')
+        ->assertOk()
+        ->assertJsonPath('title', 'Dashboard')
+        ->assertJsonPath('zones.0.id', $this->server->uuid);
+    $nodes = collect($response->json('nodes'))->keyBy('id');
+
+    expect($nodes[$deploying->uuid]['deployment'])->toBe(['status' => 'in_progress', 'link' => '/deployment/in_progress', 'pull_request_id' => null])
+        ->and($nodes[$queued->uuid]['deployment']['status'])->toBe('queued')
+        ->and($nodes[$idle->uuid])->not->toHaveKey('deployment')
+        // The deployment panel lists running and queued deployments first, then the finished ones.
+        ->and(collect($response->json('deployments'))->map(fn (array $row) => [$row['application'], $row['status']])->all())->toBe([
+            [$deploying->uuid, 'in_progress'],
+            [$queued->uuid, 'queued'],
+            [$idle->uuid, 'finished'],
+        ]);
+});
+
+test('the dashboard canvas never shows another team servers, resources, or deployments', function () {
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $outsider = User::factory()->create();
+    $otherTeam->members()->attach($outsider->id, ['role' => 'owner']);
+    $this->team->members()->attach($outsider->id, ['role' => 'member']);
+    $app = dashboardCanvasApp($this->environment, $this->server, 'storefront');
+    dashboardCanvasDeployment($app, $this->server, ApplicationDeploymentStatus::IN_PROGRESS);
+
+    $response = dashboardCanvasSession($this, $outsider, $otherTeam)
+        ->getJson('/canvas/api/dashboard/canvas')
+        ->assertOk();
+
+    expect($response->json('zones'))->toBe([])
+        ->and($response->json('nodes'))->toBe([])
+        ->and($response->json('deployments'))->toBe([]);
+});
+
+test('the dashboard opens the canvas again when the user left it there', function () {
+    $cookie = "coolify_{$this->admin->id}_dashboard_view";
+
+    dashboardCanvasSession($this, $this->admin, $this->team)
+        ->withoutVite()
+        ->get(route('dashboard.canvas'))
+        ->assertOk()
+        ->assertSee('data-endpoint="/dashboard/canvas"', false)
+        ->assertCookie($cookie, 'canvas');
+
+    dashboardCanvasSession($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'canvas')
+        ->get(route('dashboard'))
+        ->assertRedirect(route('dashboard.canvas'));
+
+    // The list link on the canvas opens the list and makes it the remembered view.
+    dashboardCanvasSession($this, $this->admin, $this->team)
+        ->withCookie($cookie, 'canvas')
+        ->get(route('dashboard', ['view' => 'list']))
+        ->assertOk()
+        ->assertCookie($cookie, 'list');
+});
diff --git a/tests/Feature/DashboardDeploymentsTest.php b/tests/Feature/DashboardDeploymentsTest.php
index 6ef6f05ab0..1fa548da4f 100644
--- a/tests/Feature/DashboardDeploymentsTest.php
+++ b/tests/Feature/DashboardDeploymentsTest.php
@@ -55,7 +55,6 @@ function createDashboardDeployment(array $overrides = []): ApplicationDeployment
 
 it('hides the deployments section when there is nothing to show', function () {
     Livewire::test(ActiveDeployments::class)
-        ->assertDontSee('Active and recent deployment activity')
         ->assertDontSee('Running or queued right now')
         ->assertDontSee('Latest completed deployments')
         ->assertDontSee('No active deployments')
diff --git a/tests/Feature/DashboardServerMetricsChartTest.php b/tests/Feature/DashboardServerMetricsChartTest.php
index eecae59f24..f5e1522757 100644
--- a/tests/Feature/DashboardServerMetricsChartTest.php
+++ b/tests/Feature/DashboardServerMetricsChartTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Dashboard;
+use App\Livewire\Dashboard\ServerMetricsChart;
 use App\Livewire\Server\Index as ServerIndex;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
@@ -8,12 +9,14 @@ use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Queue;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    Server::flushIdentityMap();
     Queue::fake();
     InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
 
@@ -63,3 +66,41 @@ it('renders dashboard metrics charts on the server index grid', function () {
         ->assertSeeHtml("dashboard-server-metrics-{$enabledServer->uuid}")
         ->assertDontSeeHtml("dashboard-server-metrics-{$disabledServer->uuid}");
 });
+
+it('does not run SSH for an unreachable server when loading dashboard metrics', function () {
+    Process::fake();
+
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $server->settings->update(['is_metrics_enabled' => true, 'is_reachable' => false]);
+
+    Livewire::test(ServerMetricsChart::class, ['server' => $server->fresh()])
+        ->call('loadData')
+        ->assertNotDispatched("dashboard-server-metrics-{$server->uuid}");
+
+    Process::assertNothingRan();
+});
+
+it('loads dashboard metrics over SSH for a reachable server', function () {
+    Process::fake(['*' => Process::result(output: '[{"time":1700000000000,"percent":12.5,"usedPercent":40}]')]);
+
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $server->settings->update(['is_metrics_enabled' => true, 'is_reachable' => true, 'is_usable' => true]);
+
+    Livewire::test(ServerMetricsChart::class, ['server' => $server->fresh()])
+        ->call('loadData')
+        ->assertDispatched(
+            "dashboard-server-metrics-{$server->uuid}",
+            fn (string $name, array $params) => $params[0] == [
+                'cpu' => [[1700000000000, 12.5]],
+                'memory' => [[1700000000000, 40]],
+            ],
+        );
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'coolify-sentinel'));
+});
diff --git a/tests/Feature/DashboardViewModeTest.php b/tests/Feature/DashboardViewModeTest.php
new file mode 100644
index 0000000000..008907103e
--- /dev/null
+++ b/tests/Feature/DashboardViewModeTest.php
@@ -0,0 +1,55 @@
+<?php
+
+use App\Livewire\Dashboard;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cookie;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('shows the projects and servers sections as tables by default', function () {
+    Livewire::test(Dashboard::class)
+        ->assertSee("viewMode: 'table'", false)
+        ->assertDontSee("viewMode: 'grid'", false);
+});
+
+it('remembers the view of each dashboard section on its own', function () {
+    Livewire::test(Dashboard::class)->call('saveListView', 'dashboard_projects', 'grid');
+
+    expect(Cookie::queued("coolify_{$this->user->id}_dashboard_projects_view")?->getValue())->toBe('grid')
+        ->and(Cookie::queued("coolify_{$this->user->id}_dashboard_servers_view"))->toBeNull();
+
+    $this->withCookie("coolify_{$this->user->id}_dashboard_projects_view", 'grid')
+        ->get(route('dashboard'))
+        ->assertOk()
+        ->assertSee("viewMode: 'grid'", false)
+        ->assertSee("viewMode: 'table'", false);
+});
+
+it('links to all projects only when the dashboard hides some of them', function () {
+    Project::factory()->count(8)->create(['team_id' => $this->team->id]);
+
+    Livewire::test(Dashboard::class)->assertDontSee(route('project.index'), false);
+
+    Project::factory()->create(['team_id' => $this->team->id]);
+
+    Livewire::test(Dashboard::class)->assertSee(route('project.index'), false);
+});
diff --git a/tests/Feature/DatabaseStartContentFilesTest.php b/tests/Feature/DatabaseStartContentFilesTest.php
index 644e129ccd..88de7023b8 100644
--- a/tests/Feature/DatabaseStartContentFilesTest.php
+++ b/tests/Feature/DatabaseStartContentFilesTest.php
@@ -97,3 +97,23 @@ it('writes the MongoDB server.pem before the certificate owner change mounts it'
     expect($commands)->toContain('Writing 1 missing configuration file.')
         ->and(strpos($commands, 'Writing 1 missing configuration file.'))->toBeLessThan(strpos($commands, '--entrypoint chown'));
 });
+
+dataset('database-start-actions-with-custom-config-files', [
+    'postgresql' => ['create_standalone_postgresql', StartPostgresql::class, 'postgres_conf', 'custom-postgres.conf'],
+    'mysql' => ['create_standalone_mysql', StartMysql::class, 'mysql_conf', 'custom-config.cnf'],
+    'mariadb' => ['create_standalone_mariadb', StartMariadb::class, 'mariadb_conf', 'custom-config.cnf'],
+    'mongodb' => ['create_standalone_mongodb', StartMongodb::class, 'mongo_conf', 'mongod.conf'],
+]);
+
+it('makes the custom config file readable by the container user before the container starts', function (string $createDatabase, string $startAction, string $column, string $file) {
+    $database = $createDatabase($this->environment->id, $this->destination);
+    $database->update([$column => "# custom\n"]);
+
+    $startAction::run($database->fresh(), new Activity);
+
+    $path = $database->workdir()."/{$file}";
+    $commands = implode("\n", $this->executor->commands);
+    expect($commands)->toContain("chmod 644 {$path}")
+        ->and(strpos($commands, "tee {$path}"))->toBeLessThan(strpos($commands, "chmod 644 {$path}"))
+        ->and(strpos($commands, "chmod 644 {$path}"))->toBeLessThan(strpos($commands, 'docker-compose.yml up -d'));
+})->with('database-start-actions-with-custom-config-files');
diff --git a/tests/Feature/DatabaseUpdateApiTest.php b/tests/Feature/DatabaseUpdateApiTest.php
new file mode 100644
index 0000000000..b6c65041e9
--- /dev/null
+++ b/tests/Feature/DatabaseUpdateApiTest.php
@@ -0,0 +1,84 @@
+<?php
+
+use App\Actions\Database\RestartDatabase;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->database = create_standalone_redis($environment->id, $destination, ['redis_password' => 'OldPassword123']);
+
+    Queue::fake();
+});
+
+function patchDatabase(array $payload, array $abilities = ['write', 'deploy'])
+{
+    $plainTextToken = Str::random(40);
+    $token = test()->user->tokens()->create([
+        'name' => 'database-update-test',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => $abilities,
+        'team_id' => test()->team->id,
+    ]);
+
+    return test()->withHeaders(['Authorization' => 'Bearer '.$token->getKey().'|'.$plainTextToken])
+        ->patchJson('/api/v1/databases/'.test()->database->uuid, $payload);
+}
+
+test('PATCH changes the Redis password', function () {
+    patchDatabase(['redis_password' => 'NewPassword456'])->assertOk();
+
+    $database = StandaloneRedis::query()->findOrFail($this->database->id);
+    expect($database->redis_password)->toBe('NewPassword456')
+        ->and($database->runtime_environment_variables()->where('key', 'REDIS_PASSWORD')->count())->toBe(1);
+});
+
+test('PATCH with instant_deploy restarts the database after the update', function () {
+    patchDatabase(['name' => 'renamed', 'instant_deploy' => true])->assertOk();
+
+    expect($this->database->refresh()->name)->toBe('renamed');
+    RestartDatabase::assertPushed(1);
+});
+
+test('PATCH without instant_deploy does not restart the database', function () {
+    patchDatabase(['name' => 'renamed', 'instant_deploy' => false], ['write'])->assertOk();
+
+    RestartDatabase::assertNotPushed();
+});
+
+test('PATCH with instant_deploy needs the deploy ability', function () {
+    patchDatabase(['name' => 'renamed', 'instant_deploy' => true], ['write'])->assertForbidden();
+
+    expect($this->database->refresh()->name)->not->toBe('renamed');
+    RestartDatabase::assertNotPushed();
+});
+
+test('PATCH rejects an instant_deploy value that is not a boolean', function () {
+    patchDatabase(['instant_deploy' => 'abc'])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors('instant_deploy');
+
+    RestartDatabase::assertNotPushed();
+});
diff --git a/tests/Feature/DeploymentComposeStdinWriteTest.php b/tests/Feature/DeploymentComposeStdinWriteTest.php
new file mode 100644
index 0000000000..a6b2809ce8
--- /dev/null
+++ b/tests/Feature/DeploymentComposeStdinWriteTest.php
@@ -0,0 +1,101 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Process\PendingProcess;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+class ComposeStdinWriteDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+}
+
+/**
+ * Linux limits one exec argument to 128 KiB (MAX_ARG_STRLEN), so a large generated compose file
+ * must reach the server over SSH stdin, not inside the command (issue #11737).
+ */
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+    config(['constants.ssh.mux_enabled' => false, 'constants.ssh.max_retries' => 1]);
+
+    $this->processes = collect();
+    Process::fake(function (PendingProcess $process) {
+        $this->processes->push(['command' => $process->command, 'input' => $process->input]);
+
+        return Process::result();
+    });
+
+    $team = Team::factory()->create();
+    $this->server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+    $destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'build_pack' => 'dockercompose',
+    ]);
+    $queue = ApplicationDeploymentQueue::create([
+        'deployment_uuid' => 'compose-stdin-deployment',
+        'application_id' => $application->id,
+        'server_id' => $this->server->id,
+        'status' => 'in_progress',
+    ]);
+
+    $this->compose = 'services:'.collect(range(1, 400))
+        ->map(fn (int $i) => "\n  service{$i}:\n    image: nginx\n    labels:\n      - coolify.test=".str_repeat('x', 500))
+        ->implode('');
+    $this->configurationDir = $application->workdir();
+
+    $this->job = new ComposeStdinWriteDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    foreach ([
+        'application' => $application->fresh(),
+        'application_deployment_queue' => $queue,
+        'server' => $this->server,
+        'mainServer' => $this->server,
+        'deployment_uuid' => 'compose-stdin-deployment',
+        'configuration_dir' => $this->configurationDir,
+        'pull_request_id' => 0,
+        'preserveRepository' => false,
+        'use_build_server' => false,
+        'generated_docker_compose' => $this->compose,
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($this->job, $value);
+    }
+    $this->writeConfigurations = fn () => $reflection->getMethod('write_deployment_configurations')->invoke($this->job);
+});
+
+it('writes a compose file larger than one exec argument over stdin', function (string $user, string $tee) {
+    $this->server->update(['user' => $user]);
+    expect(strlen(base64_encode($this->compose)))->toBeGreaterThan(128 * 1024);
+
+    ($this->writeConfigurations)();
+
+    $composeWrite = $this->processes->firstWhere('input', $this->compose);
+    expect($composeWrite)->not->toBeNull()
+        ->and($composeWrite['command'])->toEndWith(escapeshellarg("{$tee} {$this->configurationDir}/docker-compose.yaml > /dev/null"));
+    $this->processes->each(fn (array $process) => expect(strlen($process['command']))->toBeLessThan(8 * 1024));
+})->with([
+    'root' => ['root', 'tee'],
+    'non-root' => ['cooluser', 'sudo tee'],
+]);
diff --git a/tests/Feature/DeploymentSensitiveCommandFailureTest.php b/tests/Feature/DeploymentSensitiveCommandFailureTest.php
index c6d104c9cb..a879ee286e 100644
--- a/tests/Feature/DeploymentSensitiveCommandFailureTest.php
+++ b/tests/Feature/DeploymentSensitiveCommandFailureTest.php
@@ -256,6 +256,33 @@ it('keeps the command in the error message for failed commands that are not sens
         ->not->toContain('[command hidden because it contains sensitive data]');
 });
 
+it('explains how to fix a Docker network that Docker Engine reports with an IPv6 gateway prefix', function () {
+    [$job] = makeSensitiveCommandFailureJob();
+
+    Process::fake(['*' => Process::result(errorOutput: 'ParseAddr("fde4:75c5:b9d4::1/64"): unexpected character, want colon (at "/64")', exitCode: 1)]);
+
+    $exception = captureDeploymentException(fn () => $job->execute_remote_command([
+        'command' => 'docker compose up -d',
+    ]));
+
+    expect($exception->getMessage())
+        ->toContain('ParseAddr("fde4:75c5:b9d4::1/64")')
+        ->toContain('systemctl restart docker')
+        ->toContain('28.0.1');
+});
+
+it('does not add the Docker network hint to other failures', function () {
+    [$job] = makeSensitiveCommandFailureJob();
+
+    Process::fake(['*' => Process::result(errorOutput: 'ParseAddr("fde4:75c5:b9d4::1 "): unexpected character', exitCode: 1)]);
+
+    $exception = captureDeploymentException(fn () => $job->execute_remote_command([
+        'command' => 'docker compose up -d',
+    ]));
+
+    expect($exception->getMessage())->not->toContain('systemctl restart docker');
+});
+
 it('redacts locked values from the error output of failed commands', function () {
     [$job] = makeSensitiveCommandFailureJob([
         ['key' => 'LOCKED_SECRET', 'value' => SENSITIVE_FAILURE_SECRET, 'is_shown_once' => true],
diff --git a/tests/Feature/DeploymentsIndicatorTest.php b/tests/Feature/DeploymentsIndicatorTest.php
index faa6262ad2..38758c6b51 100644
--- a/tests/Feature/DeploymentsIndicatorTest.php
+++ b/tests/Feature/DeploymentsIndicatorTest.php
@@ -74,3 +74,42 @@ it('does not show deployments of another team', function () {
         ->assertDontSee('Indicator App')
         ->assertDontSee('Active deployments');
 });
+
+it('hides the indicator on the page of the only application that is deploying', function () {
+    $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertDontSee('aria-label="Active deployments"', false);
+});
+
+it('keeps the indicator on an application page when another application is deploying', function () {
+    $otherApplication = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'name' => 'Other App',
+    ]);
+
+    ApplicationDeploymentQueue::create([
+        'application_id' => $otherApplication->id,
+        'application_name' => $otherApplication->name,
+        'deployment_uuid' => 'deploy-indicator-'.fake()->uuid(),
+        'deployment_url' => '/deployments/other',
+        'server_id' => $this->server->id,
+        'server_name' => $this->server->name,
+        'status' => ApplicationDeploymentStatus::QUEUED->value,
+        'pull_request_id' => 0,
+    ]);
+
+    $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertSee('2 deployments', false)
+        ->assertSee('aria-label="Active deployments"', false);
+});
diff --git a/tests/Feature/DockerCleanupJobTest.php b/tests/Feature/DockerCleanupJobTest.php
index ff2bee897e..61cc7c5d58 100644
--- a/tests/Feature/DockerCleanupJobTest.php
+++ b/tests/Feature/DockerCleanupJobTest.php
@@ -3,6 +3,7 @@
 use App\Actions\Server\CleanupDocker;
 use App\Events\DockerCleanupDone;
 use App\Jobs\DockerCleanupJob;
+use App\Jobs\ScheduledJobManager;
 use App\Models\Application;
 use App\Models\DockerCleanupExecution;
 use App\Models\Environment;
@@ -17,6 +18,7 @@ use App\Models\User;
 use App\Notifications\Server\DockerCleanupFailed;
 use App\Services\ScheduledJobDeliveryService;
 use App\Support\Actions\UniqueUntilProcessingJobDecorator;
+use Illuminate\Broadcasting\BroadcastEvent;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Queue\Jobs\FakeJob;
@@ -195,6 +197,34 @@ it('leaves a running scheduled cleanup untouched when a manual cleanup fails bef
     Event::assertNotDispatched(DockerCleanupDone::class);
 });
 
+it('fails a cleanup execution whose worker was killed once the server lock has expired, so it does not stay running', function () {
+    Carbon::setTestNow(Carbon::create(2026, 10, 16, 12, 0, 0, 'UTC'));
+    Queue::fake();
+    Notification::fake();
+    Event::fake([DockerCleanupDone::class]);
+    $server = dockerCleanupReachableServer();
+    $server->team->emailNotificationSettings->update(['smtp_enabled' => true, 'docker_cleanup_failure_email_notifications' => true]);
+    $interrupted = DockerCleanupExecution::create(['server_id' => $server->id]);
+    Carbon::setTestNow(now()->addSeconds(CleanupDocker::overlapLockExpiresAfter() - 1));
+    $live = DockerCleanupExecution::create(['server_id' => $server->id]);
+    $finished = DockerCleanupExecution::create(['server_id' => $server->id, 'status' => 'success', 'finished_at' => now()]);
+
+    (new ScheduledJobManager('docker-cleanups'))->handle();
+
+    expect($interrupted->fresh()->status)->toBe('running');
+
+    Carbon::setTestNow(now()->addSeconds(2));
+    (new ScheduledJobManager('docker-cleanups'))->handle();
+    (new ScheduledJobManager('docker-cleanups'))->handle();
+
+    expect($interrupted->fresh()->only(['status', 'message']))->toBe(['status' => 'failed', 'message' => DockerCleanupJob::INTERRUPTED_MESSAGE])
+        ->and($interrupted->fresh()->finished_at)->not->toBeNull()
+        ->and($live->fresh()->only(['status', 'finished_at']))->toBe(['status' => 'running', 'finished_at' => null])
+        ->and($finished->fresh()->status)->toBe('success');
+    Notification::assertSentToTimes($server->team, DockerCleanupFailed::class, 1);
+    Event::assertDispatchedTimes(DockerCleanupDone::class, 1);
+});
+
 it('skips a scheduled cleanup occurrence while another cleanup holds the server lock, so it is not reported missed later', function () {
     Carbon::setTestNow(Carbon::create(2026, 9, 17, 0, 0, 0, 'UTC'));
     Notification::fake();
@@ -533,3 +563,80 @@ it('removes stopped Coolify containers but keeps the proxy, databases, applicati
     expect($command)->toContain('--filter label=coolify.managed=true')
         ->and(trim((string) $output))->toBe('rm helper');
 })->with(['root' => false, 'non-root sudo parser' => true]);
+
+it('broadcasts DockerCleanupDone without the cleanup log so large logs fit the Reverb message size', function () {
+    $server = dockerCleanupReachableServer();
+    $execution = DockerCleanupExecution::create([
+        'server_id' => $server->id,
+        'status' => 'success',
+        'cleanup_log' => str_repeat('x', 50_000),
+    ]);
+    $event = new DockerCleanupDone($execution);
+    $event->broadcastOn();
+
+    $payload = (fn () => $this->getPayloadFromEvent($event))->call(new BroadcastEvent($event), $event);
+
+    expect($payload)->toBe([
+        'executionId' => $execution->id,
+        'serverId' => $server->id,
+        'status' => 'success',
+        'socket' => null,
+    ])->and(strlen(json_encode($payload)))->toBeLessThan(10_000);
+});
+
+/**
+ * Runs a cleanup command with a fake docker on PATH: `docker images` prints $images, `docker rmi`
+ * prints what it is asked to remove, other docker commands print nothing.
+ */
+function dockerCleanupRunImageCommand(string $command, array $images): string
+{
+    $bin = sys_get_temp_dir().'/docker-cleanup-'.bin2hex(random_bytes(4));
+    mkdir($bin);
+    file_put_contents("$bin/images", implode("\n", $images)."\n");
+    file_put_contents("$bin/docker", "#!/bin/sh\nif [ \"\$1\" = images ]; then cat $bin/images; elif [ \"\$1\" = rmi ]; then echo \"\$@\"; fi\n");
+    chmod("$bin/docker", 0755);
+
+    $output = shell_exec('PATH='.escapeshellarg("$bin:".getenv('PATH')).' /bin/sh -c '.escapeshellarg($command));
+
+    array_map('unlink', glob("$bin/*"));
+    rmdir($bin);
+
+    return trim((string) $output);
+}
+
+it('removes old helper, realtime and sentinel images from any registry but keeps the current helper', function () {
+    $command = (new ReflectionMethod(CleanupDocker::class, 'buildCoolifyImageCleanupCommand'))->invoke(new CleanupDocker, '1.0.17');
+
+    $output = dockerCleanupRunImageCommand($command, [
+        'coollabsio/coolify-helper:1.0.17',
+        'ghcr.io/coollabsio/coolify-helper:1.0.17',
+        'coollabsio/coolify-helper:1.0.14',
+        'ghcr.io/coollabsio/coolify-helper:1.0.15',
+        'coollabsio/coolify-helper:1.0.170',
+        'coollabsio/coolify-realtime:1.0.19',
+        'ghcr.io/coollabsio/coolify-realtime:1.0.17',
+        'coollabsio/sentinel:1.0.1',
+        'ghcr.io/coollabsio/sentinel:0.0.22',
+        'coollabsio/sentinel:<none>',
+        'coollabsio/coolify:4.4.6',
+        'postgres:16',
+    ]);
+
+    expect($command)->not->toContain('awk')
+        ->and($output)->toBe('rmi coollabsio/coolify-helper:1.0.14 ghcr.io/coollabsio/coolify-helper:1.0.15 coollabsio/coolify-helper:1.0.170 coollabsio/coolify-realtime:1.0.19 ghcr.io/coollabsio/coolify-realtime:1.0.17 coollabsio/sentinel:1.0.1 ghcr.io/coollabsio/sentinel:0.0.22');
+});
+
+it('removes unused images pulled by digest but keeps application images', function () {
+    $command = (new ReflectionMethod(CleanupDocker::class, 'buildImagePruneCommand'))->invoke(new CleanupDocker, collect(['app-uuid']), '1.0.17');
+
+    $output = dockerCleanupRunImageCommand($command, [
+        'gtstef/filebrowser@sha256:abc',
+        '<none>@<none>',
+        'app-uuid@sha256:def',
+        'app-uuid:v1',
+        'postgres:16',
+    ]);
+
+    expect($command)->toContain('docker images --digests')
+        ->and(explode("\n", $output))->toBe(['rmi gtstef/filebrowser@sha256:abc', 'rmi postgres:16']);
+});
diff --git a/tests/Feature/EnvironmentCanvasTest.php b/tests/Feature/EnvironmentCanvasTest.php
index 8d28c0cea8..d424ee22b6 100644
--- a/tests/Feature/EnvironmentCanvasTest.php
+++ b/tests/Feature/EnvironmentCanvasTest.php
@@ -133,9 +133,9 @@ describe('GET canvas', function () {
                 'kind' => 'nixpacks',
                 'subtitle' => 'Nixpacks · main',
                 'children' => [],
-                'volumes' => ['web-data'],
                 'link' => $application->link(),
                 'logo' => ['src' => resource_logo_url('public-repo'), 'dark' => null, 'fallback' => null, 'padded' => false, 'favicon' => 'https://web.example.com/favicon.ico'],
+                'saved' => ['x' => 10, 'y' => -20],
             ])
             ->and($nodes[$service->uuid])->toEqual([
                 'id' => $service->uuid,
@@ -151,9 +151,9 @@ describe('GET canvas', function () {
                     ['name' => 'ghost', 'type' => 'application', 'status' => 'running:healthy'],
                     ['name' => 'mysql', 'type' => 'database', 'status' => 'running:healthy'],
                 ],
-                'volumes' => [],
                 'link' => $service->link(),
                 'logo' => null,
+                'saved' => null,
             ])
             ->and($nodes[$database->uuid])->toMatchArray([
                 'type' => 'database',
@@ -162,8 +162,8 @@ describe('GET canvas', function () {
                 'urls' => [],
                 'kind' => 'postgresql',
                 'subtitle' => 'PostgreSQL · postgres:17-alpine',
-                'volumes' => ["postgres-data-{$database->uuid}"],
                 'logo' => ['src' => resource_logo_url('postgres'), 'dark' => null, 'fallback' => null, 'padded' => false, 'favicon' => null],
+                'saved' => null,
             ])
             ->and($response->getContent())->not->toContain('canvas-secret-password');
     });
@@ -414,6 +414,18 @@ describe('canvas authorization', function () {
 });
 
 describe('canvas page', function () {
+    test('add resource opens the deploy canvas for this environment', function () {
+        $deployCanvasUrl = route('deploy-canvas', ['project' => $this->project->uuid, 'environment' => $this->environment->uuid]);
+
+        $this->actingAs($this->admin)->withSession(['currentTeam' => $this->team])
+            ->withoutVite()
+            ->get(route('project.environment.canvas', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]))
+            ->assertOk()
+            ->assertSee('data-new="'.e($deployCanvasUrl).'"', false)
+            ->assertSee('href="'.e($deployCanvasUrl).'"', false)
+            ->assertDontSee(route('project.resource.create', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]), false);
+    });
+
     test('a team member can open the canvas page', function () {
         $member = User::factory()->create();
         $this->team->members()->attach($member->id, ['role' => 'member']);
diff --git a/tests/Feature/FileDownloadStorageTest.php b/tests/Feature/FileDownloadStorageTest.php
new file mode 100644
index 0000000000..2cf526c1c0
--- /dev/null
+++ b/tests/Feature/FileDownloadStorageTest.php
@@ -0,0 +1,244 @@
+<?php
+
+use App\Jobs\DeleteFileDownloadJob;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Livewire\Settings\Advanced;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use Aws\CommandInterface;
+use Aws\MockHandler;
+use Aws\Result;
+use Aws\S3\Exception\S3Exception;
+use Aws\S3\S3Client;
+use Illuminate\Filesystem\AwsS3V3Adapter;
+use Illuminate\Filesystem\FilesystemAdapter;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+    $this->rootTeam = Team::factory()->create(['id' => 0]);
+    $this->storage = S3Storage::create([
+        'name' => 'Downloads',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'downloads',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => 0,
+    ]);
+});
+
+function lifecycleStorage(MockHandler $handler): S3Storage
+{
+    $storage = new class extends S3Storage
+    {
+        public S3Client $client;
+
+        public function filesystem(): FilesystemAdapter
+        {
+            $adapter = Mockery::mock(AwsS3V3Adapter::class);
+            $adapter->shouldReceive('getClient')->andReturn($this->client);
+
+            return $adapter;
+        }
+    };
+    $storage->bucket = 'downloads';
+    $storage->client = new S3Client([
+        'region' => 'us-east-1',
+        'version' => 'latest',
+        'credentials' => ['key' => 'k', 'secret' => 's'],
+        'handler' => $handler,
+    ]);
+
+    return $storage;
+}
+
+it('adds the lifecycle rule and keeps the other bucket rules', function () {
+    $put = null;
+    $handler = new MockHandler([
+        new Result(['Rules' => [
+            ['ID' => 'keep-me', 'Filter' => ['Prefix' => 'logs/'], 'Status' => 'Enabled', 'Expiration' => ['Days' => 30]],
+            ['ID' => FileDownloadStorageService::LIFECYCLE_RULE_ID, 'Filter' => ['Prefix' => 'old/'], 'Status' => 'Enabled', 'Expiration' => ['Days' => 9]],
+        ]]),
+        function (CommandInterface $command) use (&$put) {
+            $put = $command->toArray();
+
+            return new Result([]);
+        },
+    ]);
+
+    (new FileDownloadStorageService)->ensureLifecycleRule(lifecycleStorage($handler));
+
+    expect($put['LifecycleConfiguration']['Rules'])->toBe([
+        ['ID' => 'keep-me', 'Filter' => ['Prefix' => 'logs/'], 'Status' => 'Enabled', 'Expiration' => ['Days' => 30]],
+        ['ID' => FileDownloadStorageService::LIFECYCLE_RULE_ID, 'Filter' => ['Prefix' => FileDownloadStorageService::PREFIX], 'Status' => 'Enabled', 'Expiration' => ['Days' => 1]],
+    ]);
+});
+
+it('adds the lifecycle rule to a bucket without a lifecycle configuration', function () {
+    $put = null;
+    $handler = new MockHandler([
+        fn (CommandInterface $command) => new S3Exception('none', $command, ['code' => 'NoSuchLifecycleConfiguration']),
+        function (CommandInterface $command) use (&$put) {
+            $put = $command->toArray();
+
+            return new Result([]);
+        },
+    ]);
+
+    (new FileDownloadStorageService)->ensureLifecycleRule(lifecycleStorage($handler));
+
+    expect($put['LifecycleConfiguration']['Rules'])->toHaveCount(1);
+});
+
+it('fails when the provider rejects the lifecycle rule', function () {
+    $handler = new MockHandler([
+        new Result(['Rules' => []]),
+        fn (CommandInterface $command) => new S3Exception('not implemented', $command, ['code' => 'NotImplemented']),
+    ]);
+
+    (new FileDownloadStorageService)->ensureLifecycleRule(lifecycleStorage($handler));
+})->throws(RuntimeException::class, 'Could not add the auto-delete lifecycle rule');
+
+it('saves the download storage only after the lifecycle rule is added', function (bool $ruleAdded) {
+    $user = User::factory()->create();
+    $this->rootTeam->members()->attach($user->id, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $this->rootTeam]);
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('ensureBucketIsPrivate')->once();
+    $expectation = $downloads->shouldReceive('ensureLifecycleRule')->once();
+    if (! $ruleAdded) {
+        $expectation->andThrow(new RuntimeException('Could not add the auto-delete lifecycle rule'));
+    }
+    app()->instance(FileDownloadStorageService::class, $downloads);
+
+    $component = Livewire::test(Advanced::class)
+        ->set('file_download_storage', 's3:'.$this->storage->id)
+        ->call('instantSave');
+
+    if ($ruleAdded) {
+        $component->assertSet('file_download_storage', 's3:'.$this->storage->id);
+        expect(InstanceSettings::find(0)->file_download_s3_storage_id)->toBe($this->storage->id);
+    } else {
+        $component->assertSet('file_download_storage', 'stream')->assertDispatched('error');
+        expect(InstanceSettings::find(0)->file_download_s3_storage_id)->toBeNull();
+    }
+})->with([true, false]);
+
+it('builds one S3 upload script that the non-root sudo parser keeps whole', function () {
+    $command = (new ContainerFilesystemService(Server::factory()->make(), 'app-123'))
+        ->buildS3UploadCommand("/app/it's.txt", false, 'https://s3.example.com/b/k?X-Amz-Signature=abc&x=1', ['Content-Disposition' => 'attachment; filename="a.txt"']);
+
+    expect($command)->toStartWith('sh -c ')
+        ->and($command)->toContain('mktemp', 'trap', 'curl -fsS', 'X-Amz-Signature=abc&x=1');
+    expect(parseCommandsByLineForSudo(collect([$command]), Server::factory()->make(['user' => 'deploy'])))
+        ->toBe(['sudo '.$command]);
+});
+
+it('uploads to S3, stores the link, and queues the delete', function () {
+    $this->freezeTime();
+    Storage::fake('ssh-keys');
+    config(['constants.ssh.mux_enabled' => false]);
+    Bus::fake([DeleteFileDownloadJob::class]);
+    Process::fake(['*' => Process::result(output: '')]);
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
+    $server = Server::factory()->create(['team_id' => $this->rootTeam->id, 'private_key_id' => $privateKey->id]);
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('uploadUrl')->andReturn(['url' => 'https://s3.example.com/put', 'headers' => []]);
+    $downloads->shouldReceive('downloadUrl')->andReturn('https://s3.example.com/get');
+
+    (new PrepareFileDownloadJob('dl-1', 7, $server->id, 'app-123', '/data/a.txt', false, 'a.txt', $this->storage->id))->handle($downloads);
+
+    expect(Cache::get(PrepareFileDownloadJob::cacheKey('dl-1')))->toBe(['user_id' => 7, 'status' => 'ready', 'url' => 'https://s3.example.com/get']);
+    Process::assertRan(fn ($process) => str_contains($process->command, 'https://s3.example.com/put'));
+    Bus::assertDispatched(DeleteFileDownloadJob::class, fn (DeleteFileDownloadJob $job) => $job->s3StorageId === $this->storage->id
+        && str_starts_with($job->key, FileDownloadStorageService::PREFIX)
+        && $job->delay->equalTo(now()->addHours(6)));
+});
+
+it('makes download links that expire after 15 minutes', function () {
+    $this->storage->update(['endpoint' => 'https://1.1.1.1']);
+    $url = (new FileDownloadStorageService)->downloadUrl($this->storage, FileDownloadStorageService::PREFIX.'abc');
+
+    parse_str((string) parse_url($url, PHP_URL_QUERY), $query);
+    expect((int) $query['X-Amz-Expires'])->toBeBetween(890, 900);
+});
+
+it('stores a failure when the upload fails', function () {
+    Bus::fake([DeleteFileDownloadJob::class]);
+    $this->storage->update(['is_usable' => false]);
+
+    (new PrepareFileDownloadJob('dl-2', 7, 1, 'app-123', '/data/a.txt', false, 'a.txt', $this->storage->id))->handle(new FileDownloadStorageService);
+
+    $result = Cache::get(PrepareFileDownloadJob::cacheKey('dl-2'));
+    expect($result)->toMatchArray(['user_id' => 7, 'status' => 'failed'])
+        ->and($result['message'])->not->toContain('s3.example.com', 'X-Amz');
+});
+
+it('only deletes objects under the download prefix', function () {
+    $downloads = Mockery::mock(FileDownloadStorageService::class);
+    $downloads->shouldReceive('delete')->once()->with(Mockery::type(S3Storage::class), FileDownloadStorageService::PREFIX.'abc');
+
+    (new DeleteFileDownloadJob($this->storage->id, FileDownloadStorageService::PREFIX.'abc'))->handle($downloads);
+    (new DeleteFileDownloadJob($this->storage->id, 'backups/db.dump'))->handle($downloads);
+});
+
+function anonymousListingService(MockHandler $handler): FileDownloadStorageService
+{
+    return new class($handler) extends FileDownloadStorageService
+    {
+        public function __construct(private MockHandler $handler) {}
+
+        protected function anonymousClient(S3Storage $storage): S3Client
+        {
+            return new S3Client(['region' => 'us-east-1', 'version' => 'latest', 'credentials' => false, 'handler' => $this->handler]);
+        }
+    };
+}
+
+it('refuses a bucket that anonymous users can list', function () {
+    $downloads = anonymousListingService(new MockHandler([new Result(['Contents' => []])]));
+
+    $downloads->ensureBucketIsPrivate($this->storage);
+})->throws(RuntimeException::class, 'allows anonymous listing');
+
+it('accepts a bucket that denies anonymous listing', function () {
+    $downloads = anonymousListingService(new MockHandler([
+        fn (CommandInterface $command) => new S3Exception('denied', $command, ['code' => 'AccessDenied']),
+    ]));
+
+    $downloads->ensureBucketIsPrivate($this->storage);
+
+    expect(true)->toBeTrue();
+});
+
+it('refuses the bundled MinIO because servers and browsers cannot reach it', function () {
+    $this->storage->forceFill(['uuid' => 'minio', 'endpoint' => 'http://coolify-minio:9000'])->save();
+
+    (new FileDownloadStorageService)->ensureBucketIsPrivate($this->storage);
+})->throws(RuntimeException::class, 'uses an internal Docker host name');
+
+it('explains an unreachable endpoint instead of accepting it', function () {
+    $downloads = anonymousListingService(new MockHandler([
+        fn (CommandInterface $command) => new S3Exception('cURL error 6: Could not resolve host', $command),
+    ]));
+
+    $downloads->ensureBucketIsPrivate($this->storage);
+})->throws(RuntimeException::class, 'Could not connect to "Downloads"');
diff --git a/tests/Feature/GetPublicIpsTest.php b/tests/Feature/GetPublicIpsTest.php
new file mode 100644
index 0000000000..477a9d3ed0
--- /dev/null
+++ b/tests/Feature/GetPublicIpsTest.php
@@ -0,0 +1,60 @@
+<?php
+
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Process::fake([
+        'curl -4s https://ifconfig.io' => "203.0.113.1\n",
+        'curl -6s https://ifconfig.io' => "2001:db8::1\n",
+    ]);
+});
+
+it('detects the public IPs when the settings are empty', function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    get_public_ips();
+
+    $settings = InstanceSettings::find(0);
+    expect($settings->public_ipv4)->toBe('203.0.113.1')
+        ->and($settings->public_ipv6)->toBe('2001:db8::1');
+});
+
+it('keeps public IPs that are already set', function () {
+    InstanceSettings::forceCreate(['id' => 0, 'public_ipv4' => '203.0.113.21', 'public_ipv6' => '2001:db8::21']);
+
+    get_public_ips();
+
+    $settings = InstanceSettings::find(0);
+    expect($settings->public_ipv4)->toBe('203.0.113.21')
+        ->and($settings->public_ipv6)->toBe('2001:db8::21');
+    Process::assertNothingRan();
+});
+
+it('detects only the address family that is empty', function () {
+    InstanceSettings::forceCreate(['id' => 0, 'public_ipv4' => '203.0.113.21']);
+
+    get_public_ips();
+
+    $settings = InstanceSettings::find(0);
+    expect($settings->public_ipv4)->toBe('203.0.113.21')
+        ->and($settings->public_ipv6)->toBe('2001:db8::1');
+    Process::assertNotRan('curl -4s https://ifconfig.io');
+});
+
+it('still detects IPv6 when the IPv4 lookup returns an invalid address', function () {
+    Process::fake([
+        'curl -4s https://ifconfig.io' => 'not-an-ip',
+        'curl -6s https://ifconfig.io' => "2001:db8::1\n",
+    ]);
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    get_public_ips();
+
+    $settings = InstanceSettings::find(0);
+    expect($settings->public_ipv4)->toBeNull()
+        ->and($settings->public_ipv6)->toBe('2001:db8::1');
+});
diff --git a/tests/Feature/GiteaPullRequestWebhookRoutingTest.php b/tests/Feature/GiteaPullRequestWebhookRoutingTest.php
new file mode 100644
index 0000000000..841b5d577c
--- /dev/null
+++ b/tests/Feature/GiteaPullRequestWebhookRoutingTest.php
@@ -0,0 +1,106 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+function createGiteaPullRequestWebhookApplication(): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create([
+        'name' => 'gitea-pr-webhook-app',
+        'git_repository' => 'https://gitea.example.com/test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function sendGiteaPullRequestWebhook(Application $application, string $action, string $baseBranch)
+{
+    $body = json_encode([
+        'action' => $action,
+        'number' => 42,
+        'repository' => [
+            'id' => 987654321,
+            'full_name' => 'test-org/test-repo',
+        ],
+        'pull_request' => [
+            'html_url' => 'https://gitea.example.com/test-org/test-repo/pulls/42',
+            'title' => 'Stacked change',
+            'head' => [
+                'ref' => 'feature/child',
+                'sha' => 'abc1234def5678',
+                'repo' => ['id' => 987654321],
+            ],
+            'base' => [
+                'ref' => $baseBranch,
+                'repo' => ['id' => 987654321],
+            ],
+        ],
+    ], JSON_THROW_ON_ERROR);
+
+    return test()->call('POST', '/webhooks/source/gitea/events/manual', [], [], [], [
+        'HTTP_X-Gitea-Event' => 'pull_request',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_gitea),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+}
+
+it('cleans up the preview of a closed pull request after the base branch changes', function () {
+    $application = createGiteaPullRequestWebhookApplication();
+    $preview = ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://gitea.example.com/test-org/test-repo/pulls/42',
+        'git_type' => 'gitea',
+    ]);
+
+    CleanupPreviewDeployment::shouldRun()
+        ->once()
+        ->withArgs(fn (Application $cleanedApplication, int $pullRequestId, ApplicationPreview $cleanedPreview): bool => $cleanedApplication->is($application)
+            && $pullRequestId === 42
+            && $cleanedPreview->is($preview))
+        ->andReturn([
+            'cancelled_deployments' => 0,
+            'killed_containers' => 0,
+            'status' => 'success',
+        ]);
+
+    $response = sendGiteaPullRequestWebhook($application, 'closed', 'feature/parent');
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('Preview deployment closed.');
+});
+
+it('continues to filter opened pull requests by base branch', function () {
+    Queue::fake();
+    $application = createGiteaPullRequestWebhookApplication();
+    $application->settings->update(['is_preview_deployments_enabled' => true]);
+
+    $response = sendGiteaPullRequestWebhook($application, 'opened', 'feature/parent');
+
+    $response->assertOk();
+    expect(ApplicationPreview::where('application_id', $application->id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/GithubAppInstallationTokenTest.php b/tests/Feature/GithubAppInstallationTokenTest.php
new file mode 100644
index 0000000000..9ea349c460
--- /dev/null
+++ b/tests/Feature/GithubAppInstallationTokenTest.php
@@ -0,0 +1,121 @@
+<?php
+
+use App\Models\GithubApp;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Sleep;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Sleep::fake();
+
+    $this->team = Team::factory()->create();
+
+    openssl_pkey_export(openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]), $pemKey);
+
+    $this->githubApp = GithubApp::create([
+        'name' => 'Private GitHub App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 12345,
+        'installation_id' => 67890,
+        'private_key_id' => PrivateKey::create([
+            'name' => 'GitHub App Key',
+            'private_key' => $pemKey,
+            'team_id' => $this->team->id,
+        ])->id,
+        'is_public' => false,
+        'team_id' => $this->team->id,
+    ]);
+
+    Http::fake([
+        'https://api.github.com/zen' => fn () => Http::response('Keep it logically awesome.', 200, [
+            'Date' => now()->toRfc7231String(),
+        ]),
+    ]);
+});
+
+function fakeGithubInstallationTokenResponses(mixed $response): void
+{
+    Http::fake(['https://api.github.com/app/installations/*/access_tokens' => $response]);
+}
+
+function fakeTwoGithubInstallationTokens(): void
+{
+    fakeGithubInstallationTokenResponses(Http::sequence()
+        ->push(['token' => 'first-token'], 201)
+        ->push(['token' => 'second-token'], 201));
+}
+
+function githubInstallationTokenRequests(): int
+{
+    return Http::recorded(fn (Request $request): bool => str_ends_with($request->url(), '/access_tokens'))->count();
+}
+
+it('reuses the installation token of the same GitHub App instance', function () {
+    fakeTwoGithubInstallationTokens();
+
+    expect(generateGithubInstallationToken($this->githubApp))->toBe('first-token')
+        ->and(generateGithubInstallationToken($this->githubApp))->toBe('first-token')
+        ->and(githubInstallationTokenRequests())->toBe(1);
+});
+
+it('requests a new installation token after the in-memory token expires', function () {
+    fakeTwoGithubInstallationTokens();
+    generateGithubInstallationToken($this->githubApp);
+
+    $this->travel(51)->minutes();
+
+    expect(generateGithubInstallationToken($this->githubApp))->toBe('second-token')
+        ->and(githubInstallationTokenRequests())->toBe(2);
+});
+
+it('requests a new installation token when the GitHub App installation changes', function () {
+    fakeTwoGithubInstallationTokens();
+    generateGithubInstallationToken($this->githubApp);
+
+    $this->githubApp->installation_id = 11111;
+
+    expect(generateGithubInstallationToken($this->githubApp))->toBe('second-token')
+        ->and(githubInstallationTokenRequests())->toBe(2);
+});
+
+it('does not share the installation token between GitHub App instances', function () {
+    fakeTwoGithubInstallationTokens();
+    generateGithubInstallationToken($this->githubApp);
+
+    expect(generateGithubInstallationToken(GithubApp::find($this->githubApp->id)))->toBe('second-token')
+        ->and(githubInstallationTokenRequests())->toBe(2);
+});
+
+it('retries the installation token request when GitHub returns a server error', function () {
+    fakeGithubInstallationTokenResponses(Http::sequence()
+        ->push('<html>Bad Gateway</html>', 502)
+        ->push(['token' => 'retried-token'], 201));
+
+    expect(generateGithubInstallationToken($this->githubApp))->toBe('retried-token')
+        ->and(githubInstallationTokenRequests())->toBe(2);
+});
+
+it('does not retry the installation token request when GitHub rejects it', function () {
+    fakeGithubInstallationTokenResponses(Http::response(['message' => 'Bad credentials'], 401));
+
+    expect(fn () => generateGithubInstallationToken($this->githubApp))
+        ->toThrow(RuntimeException::class, 'Failed to get installation token for Private GitHub App with error: Bad credentials')
+        ->and(githubInstallationTokenRequests())->toBe(1);
+});
+
+it('reports the HTTP status when GitHub keeps failing without an error message', function () {
+    fakeGithubInstallationTokenResponses(Http::response('<html>Service Unavailable</html>', 503));
+
+    expect(fn () => generateGithubInstallationToken($this->githubApp))
+        ->toThrow(RuntimeException::class, 'Failed to get installation token for Private GitHub App with error: HTTP 503')
+        ->and(githubInstallationTokenRequests())->toBe(3);
+});
diff --git a/tests/Feature/GithubAppMultipleInstallationsWebhookTest.php b/tests/Feature/GithubAppMultipleInstallationsWebhookTest.php
new file mode 100644
index 0000000000..523fe5946f
--- /dev/null
+++ b/tests/Feature/GithubAppMultipleInstallationsWebhookTest.php
@@ -0,0 +1,131 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Testing\TestResponse;
+use Tests\TestCase;
+
+uses(RefreshDatabase::class);
+
+/**
+ * One GitHub App (app_id 1234567890) installed on two accounts, added to
+ * Coolify as two sources that differ only by installation id.
+ */
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Queue::fake();
+
+    $team = Team::factory()->create();
+
+    $createSource = fn (string $name, int $installationId): GithubApp => GithubApp::create([
+        'name' => $name,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'installation_id' => $installationId,
+        'webhook_secret' => 'test-secret',
+        'is_public' => false,
+        'team_id' => $team->id,
+    ]);
+
+    $this->personalSource = $createSource('personal-account', 11111);
+    $this->orgSource = $createSource('organization', 22222);
+
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $this->createApplicationForSource = fn (GithubApp $source, int $repositoryId): Application => Application::create([
+        'name' => "app-{$source->name}",
+        'git_repository' => "{$source->name}/repo",
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'repository_project_id' => $repositoryId,
+        'source_id' => $source->id,
+        'source_type' => GithubApp::class,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function multiInstallationDeployedApplicationIds(): array
+{
+    return ApplicationDeploymentQueue::query()->pluck('application_id')->map(fn (mixed $id): int => (int) $id)->unique()->values()->all();
+}
+
+function sendMultiInstallationGithubPush(TestCase $test, int $repositoryId, ?int $installationId): TestResponse
+{
+    $payload = [
+        'ref' => 'refs/heads/main',
+        'before' => '1111111111111111111111111111111111111111',
+        'after' => '2222222222222222222222222222222222222222',
+        'repository' => ['id' => $repositoryId, 'full_name' => 'owner/repo'],
+        'commits' => [['message' => 'Update', 'added' => [], 'removed' => [], 'modified' => ['README.md']]],
+    ];
+    if ($installationId !== null) {
+        $payload['installation'] = ['id' => $installationId];
+    }
+    $body = json_encode($payload, JSON_THROW_ON_ERROR);
+
+    return $test->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'push',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+}
+
+it('deploys an application of the second installation of a shared GitHub App', function () {
+    $application = ($this->createApplicationForSource)($this->orgSource, 222);
+
+    sendMultiInstallationGithubPush($this, 222, 22222)
+        ->assertOk()
+        ->assertDontSee('No applications found');
+
+    expect(multiInstallationDeployedApplicationIds())->toBe([$application->id]);
+});
+
+it('deploys an application of the first installation of a shared GitHub App', function () {
+    $application = ($this->createApplicationForSource)($this->personalSource, 111);
+
+    sendMultiInstallationGithubPush($this, 111, 11111)->assertOk();
+
+    expect(multiInstallationDeployedApplicationIds())->toBe([$application->id]);
+});
+
+it('falls back to the GitHub App id when no source has the installation id', function () {
+    $application = ($this->createApplicationForSource)($this->personalSource, 111);
+
+    sendMultiInstallationGithubPush($this, 111, 99999)->assertOk();
+    expect(multiInstallationDeployedApplicationIds())->toBe([$application->id]);
+
+    ApplicationDeploymentQueue::query()->delete();
+    sendMultiInstallationGithubPush($this, 111, null)->assertOk();
+    expect(multiInstallationDeployedApplicationIds())->toBe([$application->id]);
+});
+
+it('does not match a source of another GitHub App with the same installation id', function () {
+    GithubApp::query()->whereKey($this->orgSource->id)->update(['app_id' => 999]);
+    ($this->createApplicationForSource)($this->orgSource, 222);
+
+    sendMultiInstallationGithubPush($this, 222, 22222)
+        ->assertOk()
+        ->assertSee("No applications found with branch 'main'", false);
+
+    expect(ApplicationDeploymentQueue::query()->count())->toBe(0);
+});
diff --git a/tests/Feature/GithubAppPushWatchPathsTest.php b/tests/Feature/GithubAppPushWatchPathsTest.php
new file mode 100644
index 0000000000..ddc0985c8a
--- /dev/null
+++ b/tests/Feature/GithubAppPushWatchPathsTest.php
@@ -0,0 +1,169 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Testing\TestResponse;
+use Tests\TestCase;
+
+uses(RefreshDatabase::class);
+
+const PUSH_WATCH_PATHS_BEFORE_SHA = '1111111111111111111111111111111111111111';
+const PUSH_WATCH_PATHS_AFTER_SHA = '2222222222222222222222222222222222222222';
+const PUSH_WATCH_PATHS_COMPARE_URL = 'https://api.github.com/repos/test-org/test-repo/compare/'.PUSH_WATCH_PATHS_BEFORE_SHA.'...'.PUSH_WATCH_PATHS_AFTER_SHA;
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Queue::fake();
+
+    $team = Team::factory()->create();
+
+    openssl_pkey_export(openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]), $pemKey);
+
+    $this->githubApp = GithubApp::create([
+        'name' => 'github-app-push-watch-paths',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'installation_id' => 67890,
+        'webhook_secret' => 'test-secret',
+        'private_key_id' => PrivateKey::create([
+            'name' => 'GitHub App Key',
+            'private_key' => $pemKey,
+            'team_id' => $team->id,
+        ])->id,
+        'is_public' => false,
+        'team_id' => $team->id,
+    ]);
+
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $createApplication = fn (string $name, string $watchPaths): Application => Application::create([
+        'name' => $name,
+        'git_repository' => 'test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'watch_paths' => $watchPaths,
+        'repository_project_id' => 987654321,
+        'source_id' => $this->githubApp->id,
+        'source_type' => GithubApp::class,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $this->payments = $createApplication('payments', 'packages/payments/**');
+    $this->dashboard = $createApplication('dashboard', 'apps/dashboard/**');
+});
+
+/**
+ * A push of a merge commit that names packages/payments/config.yml relative to
+ * its first parent, while the net change of the push is only in apps/dashboard.
+ */
+function sendGithubAppMergePush(TestCase $test, string $before = PUSH_WATCH_PATHS_BEFORE_SHA): TestResponse
+{
+    $body = json_encode([
+        'ref' => 'refs/heads/main',
+        'before' => $before,
+        'after' => PUSH_WATCH_PATHS_AFTER_SHA,
+        'repository' => ['id' => 987654321, 'full_name' => 'test-org/test-repo'],
+        'commits' => [
+            ['message' => 'Merge integration into feature', 'added' => [], 'removed' => [], 'modified' => ['packages/payments/config.yml']],
+            ['message' => 'Update dashboard', 'added' => [], 'removed' => [], 'modified' => ['apps/dashboard/page.tsx']],
+        ],
+    ], JSON_THROW_ON_ERROR);
+
+    return $test->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'push',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+}
+
+function fakeGithubAppPushApi(array $compareResponse): void
+{
+    Http::fake([
+        'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+            'Date' => now()->toRfc7231String(),
+        ]),
+        'https://api.github.com/app/installations/67890/access_tokens' => Http::response([
+            'token' => 'fake-installation-token',
+        ], 201),
+        PUSH_WATCH_PATHS_COMPARE_URL => $compareResponse === []
+            ? Http::response(['message' => 'Server Error'], 500)
+            : Http::response($compareResponse),
+    ]);
+}
+
+function deployedApplicationIds(): array
+{
+    return ApplicationDeploymentQueue::query()->pluck('application_id')->map(fn (mixed $id): int => (int) $id)->sort()->values()->all();
+}
+
+it('checks watch paths against the net files of the push, not the files of each commit', function () {
+    fakeGithubAppPushApi(['status' => 'ahead', 'files' => [['filename' => 'apps/dashboard/page.tsx']]]);
+
+    sendGithubAppMergePush($this)->assertOk();
+
+    expect(deployedApplicationIds())->toBe([$this->dashboard->id]);
+    Http::assertSent(fn (Request $request): bool => $request->url() === PUSH_WATCH_PATHS_COMPARE_URL);
+});
+
+it('triggers watch paths for the previous name of a renamed file', function () {
+    fakeGithubAppPushApi(['status' => 'ahead', 'files' => [
+        ['filename' => 'packages/legacy/config.yml', 'previous_filename' => 'packages/payments/config.yml', 'status' => 'renamed'],
+    ]]);
+
+    sendGithubAppMergePush($this)->assertOk();
+
+    expect(deployedApplicationIds())->toBe([$this->payments->id]);
+});
+
+it('uses the files of the pushed commits when the compare API fails', function () {
+    fakeGithubAppPushApi([]);
+
+    sendGithubAppMergePush($this)->assertOk();
+
+    expect(deployedApplicationIds())->toBe([$this->payments->id, $this->dashboard->id]);
+});
+
+it('uses the files of the pushed commits for a new branch', function () {
+    fakeGithubAppPushApi(['status' => 'ahead', 'files' => []]);
+
+    sendGithubAppMergePush($this, before: str_repeat('0', 40))->assertOk();
+
+    expect(deployedApplicationIds())->toBe([$this->payments->id, $this->dashboard->id]);
+    Http::assertNotSent(fn (Request $request): bool => str_contains($request->url(), '/compare/'));
+});
+
+it('does not call the compare API when no application has watch paths', function () {
+    Application::query()->update(['watch_paths' => null]);
+    fakeGithubAppPushApi(['status' => 'ahead', 'files' => []]);
+
+    sendGithubAppMergePush($this)->assertOk();
+
+    expect(deployedApplicationIds())->toBe([$this->payments->id, $this->dashboard->id]);
+    Http::assertNothingSent();
+});
diff --git a/tests/Feature/GithubRunnerFlowTest.php b/tests/Feature/GithubRunnerFlowTest.php
index d6d0ea49bd..2be3ec6d50 100644
--- a/tests/Feature/GithubRunnerFlowTest.php
+++ b/tests/Feature/GithubRunnerFlowTest.php
@@ -603,11 +603,11 @@ describe('provisioning', function () {
 
     it('does not start runners on the Coolify host', function () {
         Queue::fake();
-        Process::fake();
         $server = runnerTestServer($this->team);
         $server->update(['ip' => 'host.docker.internal']);
         runnerTestConfig($server, $this->githubApp);
         $execution = runnerTestExecution($this->githubApp);
+        Process::fake();
 
         (new ProvisionGithubRunnerJob($execution->id))->handle();
 
@@ -705,6 +705,42 @@ describe('provisioning', function () {
         Queue::assertPushed(CleanupGithubRunnerJob::class, fn ($job) => $job->executionId === $execution->id);
     });
 
+    it('stops provisioning without touching GitHub or the host when the server is transferred meanwhile', function (bool $cancelled) {
+        Queue::fake();
+        Process::fake(['*' => Process::result(output: '29.8.0')]);
+        $server = runnerTestServer($this->team);
+        runnerTestConfig($server, $this->githubApp);
+        $execution = runnerTestExecution($this->githubApp);
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
+            'https://api.github.com/app/installations/*' => Http::response(['token' => 'installation-token'], 201),
+            'https://api.github.com/orgs/acme/actions/runners/42' => Http::response(null, 204),
+            'https://api.github.com/orgs/acme/actions/runners/generate-jitconfig' => function () use ($server, $execution, $cancelled) {
+                // The transfer commits while GitHub registers the runner. Without the cancel, it commits right
+                // after the job read the execution, so only the server shows the transfer.
+                $server->settings()->update(['force_disabled' => true]);
+                $server->forceFill(['server_metadata' => ['transfer' => ['status' => 'transferred']]])->saveQuietly();
+                if ($cancelled) {
+                    $execution->finish(GithubRunnerStatus::Cancelled);
+                }
+
+                return Http::response(['runner' => ['id' => 42], 'encoded_jit_config' => 'SECRET-JIT-CONFIG'], 201);
+            },
+        ]);
+
+        (new ProvisionGithubRunnerJob($execution->id))->handle();
+
+        expect($execution->fresh()->status)->toBe(GithubRunnerStatus::Cancelled)
+            ->and($execution->fresh()->ready_at)->toBeNull();
+        Process::assertDidntRun(fn (PendingProcess $process) => str_contains($process->command, '/home/runner/run.sh'));
+        Queue::assertPushed(CleanupGithubRunnerJob::class, fn ($job) => $job->executionId === $execution->id);
+
+        (new CleanupGithubRunnerJob($execution->id))->handle();
+
+        Process::assertDidntRun(fn (PendingProcess $process) => str_contains($process->command, 'docker rm'));
+        Http::assertNotSent(fn ($request) => $request->method() === 'DELETE');
+    })->with(['the transfer cancelled the execution' => true, 'the transfer commits after the last check' => false]);
+
     it('cleans up cancellation during remote provisioning without marking the runner ready', function (bool $duringStart) {
         Queue::fake();
         runnerTestConfig(runnerTestServer($this->team), $this->githubApp);
@@ -891,6 +927,19 @@ describe('server deletion', function () {
         expect(GithubApp::find($this->githubApp->id))->toBeNull();
     });
 
+    it('keeps the GitHub runners of a transferred server registered when it deletes the archive', function () {
+        Queue::fake();
+        $running = runnerTestExecution($this->githubApp, ['status' => GithubRunnerStatus::Running, 'server_id' => $this->server->id, 'github_runner_config_id' => $this->config->id, 'runner_id' => 42]);
+        $this->server->update(['server_metadata' => ['transfer' => ['status' => 'transferred']]]);
+
+        $this->server->delete();
+        DeleteServer::run($this->server->id);
+
+        expect(Server::withTrashed()->find($this->server->id))->toBeNull()
+            ->and(GithubRunnerExecution::whereKey($running->id)->exists())->toBeFalse();
+        Queue::assertNotPushed(DeregisterGithubRunnerJob::class);
+    });
+
     it('removes the runner from GitHub and ignores GitHub errors', function (int $status) {
         Http::fake([
             'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
diff --git a/tests/Feature/GitlabMergeRequestWebhookRoutingTest.php b/tests/Feature/GitlabMergeRequestWebhookRoutingTest.php
new file mode 100644
index 0000000000..4f55c86e4a
--- /dev/null
+++ b/tests/Feature/GitlabMergeRequestWebhookRoutingTest.php
@@ -0,0 +1,155 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\GitlabApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+function createGitlabMergeRequestWebhookApplication(array $overrides = []): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create(array_merge([
+        'name' => 'gitlab-mr-webhook-app',
+        'git_repository' => 'https://gitlab.com/test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ], $overrides));
+}
+
+function createGitlabMergeRequestWebhookSource(): GitlabApp
+{
+    return GitlabApp::create([
+        'name' => 'gitlab-app-webhook-test',
+        'api_url' => 'https://gitlab.com/api/v4',
+        'html_url' => 'https://gitlab.com',
+        'webhook_token' => 'test-webhook-token',
+        'team_id' => Team::factory()->create()->id,
+    ]);
+}
+
+function gitlabMergeRequestPayload(string $action, string $targetBranch): array
+{
+    return [
+        'object_kind' => 'merge_request',
+        'project' => [
+            'id' => 987654321,
+            'path_with_namespace' => 'test-org/test-repo',
+        ],
+        'object_attributes' => [
+            'action' => $action,
+            'iid' => 42,
+            'url' => 'https://gitlab.com/test-org/test-repo/-/merge_requests/42',
+            'title' => 'Stacked change',
+            'source_branch' => 'feature/child',
+            'target_branch' => $targetBranch,
+            'source_project_id' => 987654321,
+            'target_project_id' => 987654321,
+            'last_commit' => [
+                'id' => 'abc1234def5678',
+                'message' => 'Stacked change',
+            ],
+        ],
+    ];
+}
+
+function expectGitlabPreviewCleanup(Application $application): void
+{
+    $preview = ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://gitlab.com/test-org/test-repo/-/merge_requests/42',
+        'git_type' => 'gitlab',
+    ]);
+
+    CleanupPreviewDeployment::shouldRun()
+        ->once()
+        ->withArgs(fn (Application $cleanedApplication, int $pullRequestId, ApplicationPreview $cleanedPreview): bool => $cleanedApplication->is($application)
+            && $pullRequestId === 42
+            && $cleanedPreview->is($preview))
+        ->andReturn([
+            'cancelled_deployments' => 0,
+            'killed_containers' => 0,
+            'status' => 'success',
+        ]);
+}
+
+it('cleans up the preview of a closed GitLab App merge request after the target branch changes', function (string $action) {
+    $gitlabApp = createGitlabMergeRequestWebhookSource();
+    $application = createGitlabMergeRequestWebhookApplication([
+        'repository_project_id' => 987654321,
+        'source_id' => $gitlabApp->id,
+        'source_type' => GitlabApp::class,
+    ]);
+    expectGitlabPreviewCleanup($application);
+
+    $response = $this->postJson('/webhooks/source/gitlab/events', gitlabMergeRequestPayload($action, 'feature/parent'), [
+        'X-Gitlab-Token' => 'test-webhook-token',
+    ]);
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('Preview deployment closed.');
+})->with(['close', 'merge']);
+
+it('cleans up the preview of a closed manual merge request after the target branch changes', function (string $action) {
+    $application = createGitlabMergeRequestWebhookApplication();
+    expectGitlabPreviewCleanup($application);
+
+    $response = $this->postJson('/webhooks/source/gitlab/events/manual', gitlabMergeRequestPayload($action, 'feature/parent'), [
+        'X-Gitlab-Event' => 'Merge Request Hook',
+        'X-Gitlab-Token' => $application->manual_webhook_secret_gitlab,
+    ]);
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('Preview deployment closed.');
+})->with(['close', 'merge']);
+
+it('continues to filter opened merge requests by target branch', function (string $endpoint) {
+    Queue::fake();
+
+    if ($endpoint === 'app') {
+        $gitlabApp = createGitlabMergeRequestWebhookSource();
+        $application = createGitlabMergeRequestWebhookApplication([
+            'repository_project_id' => 987654321,
+            'source_id' => $gitlabApp->id,
+            'source_type' => GitlabApp::class,
+        ]);
+        $application->settings->update(['is_preview_deployments_enabled' => true]);
+
+        $response = $this->postJson('/webhooks/source/gitlab/events', gitlabMergeRequestPayload('open', 'feature/parent'), [
+            'X-Gitlab-Token' => 'test-webhook-token',
+        ]);
+    } else {
+        $application = createGitlabMergeRequestWebhookApplication();
+        $application->settings->update(['is_preview_deployments_enabled' => true]);
+
+        $response = $this->postJson('/webhooks/source/gitlab/events/manual', gitlabMergeRequestPayload('open', 'feature/parent'), [
+            'X-Gitlab-Event' => 'Merge Request Hook',
+            'X-Gitlab-Token' => $application->manual_webhook_secret_gitlab,
+        ]);
+    }
+
+    $response->assertOk();
+    expect(ApplicationPreview::where('application_id', $application->id)->exists())->toBeFalse();
+})->with(['app', 'manual']);
diff --git a/tests/Feature/HelperVersionTest.php b/tests/Feature/HelperVersionTest.php
index 64ef8466a7..6c203887fb 100644
--- a/tests/Feature/HelperVersionTest.php
+++ b/tests/Feature/HelperVersionTest.php
@@ -2,8 +2,10 @@
 
 use App\Jobs\CheckHelperImageJob;
 use App\Models\InstanceSettings;
+use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Notification;
 
 uses(RefreshDatabase::class);
 
@@ -36,3 +38,18 @@ it('does not use a stored helper version older than the bundled version', functi
 
     expect(getHelperVersion())->toBe('1.0.17');
 });
+
+it('keeps the stored helper version and does not notify when the CDN is unavailable', function () {
+    Team::factory()->create(['id' => 0])->discordNotificationSettings()->update(['discord_enabled' => true]);
+    InstanceSettings::findOrFail(0)->update(['helper_version' => '1.0.17']);
+    Notification::fake();
+    Http::preventStrayRequests();
+    Http::fake([
+        'https://cdn.example.com/coolify/versions.json' => Http::response('error code: 1200', 503),
+    ]);
+
+    (new CheckHelperImageJob)->handle();
+
+    expect(InstanceSettings::findOrFail(0)->helper_version)->toBe('1.0.17');
+    Notification::assertNothingSent();
+});
diff --git a/tests/Feature/HorizonConfigurationTest.php b/tests/Feature/HorizonConfigurationTest.php
index 52d5742a3c..864a2f0657 100644
--- a/tests/Feature/HorizonConfigurationTest.php
+++ b/tests/Feature/HorizonConfigurationTest.php
@@ -185,7 +185,6 @@ test('webhook jobs run on the webhooks queue on cloud and on high on self-hosted
         beforeSha: null,
         afterSha: null,
         commitSha: 'abc123',
-        authorAssociation: null,
         fullName: 'coollabsio/coolify',
     );
 
diff --git a/tests/Feature/HostingerApiTest.php b/tests/Feature/HostingerApiTest.php
index bdb5c309e4..08454fb5a9 100644
--- a/tests/Feature/HostingerApiTest.php
+++ b/tests/Feature/HostingerApiTest.php
@@ -192,6 +192,57 @@ it('turns paid Hostinger backups off when the API request does not enable them',
         && $request['setup']['enable_backups'] === false);
 });
 
+it('requires the deploy ability to run a post-install script or add SSH keys on a Hostinger VPS', function (array $extra) {
+    Http::fake();
+    $writeToken = $this->user->createToken('write-token', ['read', 'write'])->plainTextToken;
+
+    $this->withToken($writeToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_uuid' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'private_key_uuid' => $this->privateKey->uuid,
+            ...$extra,
+        ])
+        ->assertForbidden()
+        ->assertJsonFragment(['message' => 'Missing required permissions: deploy']);
+
+    Http::assertNothingSent();
+    $this->assertDatabaseMissing('servers', ['team_id' => $this->team->id]);
+})->with([
+    'post-install script' => [['post_install_script_id' => 73]],
+    'extra SSH keys' => [['public_key_ids' => [42]]],
+]);
+
+it('lets a deploy token run a post-install script on a Hostinger VPS', function () {
+    Http::fake([
+        'https://developers.hostinger.com/api/vps/v1/virtual-machines' => Http::response([
+            'virtual_machine' => [
+                'id' => 17923,
+                'state' => 'creating',
+                'ipv4' => [['address' => '203.0.113.10']],
+            ],
+        ]),
+    ]);
+    $deployToken = $this->user->createToken('deploy-token', ['read', 'write', 'deploy'])->plainTextToken;
+
+    $this->withToken($deployToken)
+        ->postJson('/api/v1/servers/hostinger', [
+            'cloud_provider_token_uuid' => $this->hostingerToken->uuid,
+            'item_id' => 'hostingercom-vps-kvm1-usd-1m',
+            'data_center_id' => 19,
+            'template_id' => 1130,
+            'private_key_uuid' => $this->privateKey->uuid,
+            'post_install_script_id' => 73,
+        ])
+        ->assertCreated();
+
+    Http::assertSent(fn ($request) => $request->method() === 'POST'
+        && $request->url() === 'https://developers.hostinger.com/api/vps/v1/virtual-machines'
+        && $request['setup']['post_install_script_id'] === 73);
+});
+
 it('keeps a charged Hostinger VPS when the purchase returns an error through the API', function () {
     $listRequests = 0;
     Http::fake([
diff --git a/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php b/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php
index 2cbac04a38..551e0cef0f 100644
--- a/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php
+++ b/tests/Feature/InstanceBackupMultipleS3DestinationsTest.php
@@ -93,7 +93,7 @@ it('saves several S3 destinations for the instance backup and drops storages of
     // The session team can change in another tab after the page loads.
     session(['currentTeam' => ['id' => $this->otherTeam->id]]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $this->backup->fresh(), 'availableS3Storages' => collect(), 'section' => 's3'])
+    Livewire::test(BackupEdit::class, ['backup' => $this->backup->fresh(), 'availableS3Storages' => collect()])
         ->set('saveS3', true)
         ->set('s3StorageIds', [$this->firstStorage->id, $this->secondStorage->id, $this->foreignStorage->id])
         ->call('submit')
diff --git a/tests/Feature/Livewire/FileBrowserTest.php b/tests/Feature/Livewire/FileBrowserTest.php
new file mode 100644
index 0000000000..34698719d5
--- /dev/null
+++ b/tests/Feature/Livewire/FileBrowserTest.php
@@ -0,0 +1,770 @@
+<?php
+
+use App\Http\Controllers\FileBrowserDownloadController;
+use App\Jobs\PrepareFileDownloadJob;
+use App\Livewire\Project\Shared\FileBrowser;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ContainerFilesystemService;
+use App\Services\FileDownloadStorageService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Process\Factory;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Illuminate\Support\Str;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    Storage::fake('ssh-keys');
+    InstanceSettings::forceCreate(['id' => 0]);
+    config(['constants.ssh.mux_enabled' => false]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+    $this->environment = $this->project->environments()->first();
+});
+
+it('blocks non-admin members from the file browser', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->assertForbidden();
+});
+
+it('shows a stopped state when the container is not running', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'exited',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->assertSet('containerRunning', false)
+        ->assertSee('Start the container to browse its files');
+});
+
+it('loads the default directory in a deferred request for a running database', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/var/lib/postgresql'))   // defaultRoot inspect
+        ->push(Process::result(output: "dir\t0\t1\tdata\nfile\t10\t2\tpostgresql.conf"))]); // list
+
+    $database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->assertSet('containerRunning', true)
+        ->assertSet('currentPath', '/var/lib/postgresql')
+        ->assertSet('container', $database->uuid)
+        ->assertSee('data')
+        ->assertSee('postgresql.conf');
+});
+
+function fbRunningDatabase($environment, $destination): StandalonePostgresql
+{
+    return StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+it('creates a directory and re-lists', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                    // defaultRoot
+        ->push(Process::result(output: ''))                          // initial list (empty)
+        ->push(Process::result(output: ''))                          // mkdir
+        ->push(Process::result(output: "dir\t0\t1\tplugins"))]);     // re-list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('createDirectory', 'plugins')
+        ->assertSee('plugins');
+});
+
+it('creates a file and re-lists', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                     // defaultRoot
+        ->push(Process::result(output: ''))                           // initial list (empty)
+        ->push(Process::result(output: ''))                           // createFile
+        ->push(Process::result(output: "file\t0\t1\t644\tconfig.yml"))]); // re-list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('createFile', 'config.yml')
+        ->assertSee('config.yml');
+});
+
+it('changes permissions and re-lists', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                        // defaultRoot
+        ->push(Process::result(output: "file\t10\t1\t644\tapp.sh"))     // initial list
+        ->push(Process::result(output: ''))                             // chmod
+        ->push(Process::result(output: "file\t10\t1\t755\tapp.sh"))]);  // re-list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->assertSee('644')
+        ->call('chmodEntry', 'app.sh', '755')
+        ->assertSee('755');
+});
+
+it('sets the editor language and content from the file when opening', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                       // defaultRoot
+        ->push(Process::result(output: "file\t12\t1\t644\tconfig.yml")) // initial list
+        ->push(Process::result(output: "OK\n".base64_encode("a: 1\n")))]); // single-round-trip read
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'config.yml')
+        ->assertSet('editorOpen', true)
+        ->assertSet('editorLanguage', 'yaml')
+        ->assertSet('editorContent', "a: 1\n")
+        ->assertDispatched('load-file-editor', content: "a: 1\n", language: 'yaml');
+});
+
+it('resolves a Monaco language for common extension-less files', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                      // defaultRoot
+        ->push(Process::result(output: "file\t12\t1\t644\tDockerfile")) // initial list
+        ->push(Process::result(output: "OK\n".base64_encode("FROM alpine\n")))]); // read
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'Dockerfile')
+        ->assertSet('editorLanguage', 'dockerfile');
+});
+
+it('refuses to open a binary or oversized file in the editor', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))                     // defaultRoot
+        ->push(Process::result(output: "file\t99999999\t1\tbig.bin")) // initial list
+        ->push(Process::result(output: 'TOOBIG'))]);                 // single-round-trip read
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'big.bin')
+        ->assertSet('editingPath', null);
+});
+
+it('rejects client changes to container access state', function (string $property, mixed $value) {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))   // defaultRoot
+        ->push(Process::result(output: ''))]);      // initial list
+
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->set($property, $value);
+})->with([
+    ['container', 'someone-elses-container'],
+    ['type', 'service'],
+    ['containerRunning', false],
+    ['availableContainers', ['someone-elses-container']],
+])->throws(CannotUpdateLockedPropertyException::class);
+
+it('rechecks resource access before file operations', function (string $action, array $arguments) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])->call('loadFiles');
+    $otherTeam = Team::factory()->create();
+    $this->project->update(['team_id' => $otherTeam->id]);
+    $component->call($action, ...$arguments)->assertForbidden();
+})->with([
+    ['open', ['folder']],
+    ['goTo', ['/data']],
+    ['refresh', []],
+    ['loadFiles', []],
+    ['selectContainer', ['unknown']],
+    ['saveEditor', []],
+    ['deleteEntry', ['config.yml']],
+    ['download', ['config.yml']],
+]);
+
+it('rejects a client attempt to replace the editor path', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->set('editingPath', '/etc/passwd');
+})->throws(CannotUpdateLockedPropertyException::class);
+
+it('rejects unsafe child names without deleting the current folder', function (string $name) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('deleteEntry', $name)
+        ->assertDispatched('error');
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'rm -rf'));
+})->with(['', '.', '..', '../data', 'a/b', 'a\\b']);
+
+it('saves the opened file and clears editor state', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "OK\n".base64_encode('before')))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: ''))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', "it's.txt")
+        ->set('editorContent', 'after')
+        ->call('saveEditor')
+        ->assertSet('editingPath', null)
+        ->assertSet('editorOpen', false)
+        ->assertSet('editorContent', '')
+        ->assertDispatched('success', 'Saved.');
+});
+
+it('clears the editor when selecting a container', function () {
+    Process::fake(['*' => Process::result(output: 'OK')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'config.yml')
+        ->assertSet('editorOpen', true)
+        ->call('selectContainer', $database->uuid)
+        ->assertSet('editingPath', null)
+        ->assertSet('editorOpen', false);
+});
+
+it('renames and deletes files with apostrophes', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('renameEntry', "it's.txt", "that's.txt")
+        ->assertDispatched('success', 'Renamed.')
+        ->call('deleteEntry', "that's.txt")
+        ->assertDispatched('success', 'Deleted.');
+});
+
+it('uploads a file and clears the upload state', function () {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->set('upload', UploadedFile::fake()->create("it's.txt", 1, 'text/plain'))
+        ->call('uploadFile')
+        ->assertSet('upload', null)
+        ->assertDispatched('success', 'Uploaded.');
+});
+
+it('issues a one-time download token and redirects to the streaming route', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'dir 4'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'folder')
+        ->assertRedirectContains('/files/download/');
+
+    $token = Str::afterLast($component->effects['redirect'], '/');
+    expect(Cache::get(FileBrowserDownloadController::cacheKey($token)))->toMatchArray([
+        'user_id' => $this->admin->id,
+        'container' => $database->uuid,
+        'path' => '/data/folder',
+        'name' => 'folder.tar.gz',
+        'is_dir' => true,
+    ]);
+});
+
+it('refuses downloads above the size cap', function () {
+    $overCapKb = intdiv(ContainerFilesystemService::MAX_DOWNLOAD_SIZE, 1024) + 1;
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "dir {$overCapKb}"))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'folder')
+        ->assertNoRedirect()
+        ->assertDispatched('error');
+});
+
+it('only lets the token owner use a download token, and only once', function () {
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $download = [
+        'user_id' => $this->admin->id,
+        'resource_type' => $database::class,
+        'resource_id' => $database->id,
+        'server_id' => $this->server->id,
+        'container' => $database->uuid,
+        'path' => '/data/a.txt',
+        'name' => 'a.txt',
+        'is_dir' => false,
+    ];
+    $otherAdmin = User::factory()->create();
+    $otherAdmin->teams()->attach($this->team, ['role' => 'admin']);
+
+    Cache::put(FileBrowserDownloadController::cacheKey('token-a'), $download, 60);
+    $this->actingAs($otherAdmin)->withSession(['currentTeam' => $this->team])
+        ->get(route('project.files.download', 'token-a'))
+        ->assertNotFound();
+    expect(Cache::has(FileBrowserDownloadController::cacheKey('token-a')))->toBeFalse();
+
+    $this->actingAs($this->admin)->withSession(['currentTeam' => $this->team])
+        ->get(route('project.files.download', 'unknown'))
+        ->assertNotFound();
+});
+
+it('blocks members from the download route', function () {
+    $this->actingAs($this->member)->withSession(['currentTeam' => $this->team])
+        ->get(route('project.files.download', 'any'))
+        ->assertForbidden();
+});
+
+it('denies resources outside the current team even when the user belongs to both teams', function () {
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $otherTeam = Team::factory()->create();
+    $this->member->teams()->attach($otherTeam, ['role' => 'admin']);
+    $this->actingAs($this->member);
+    session(['currentTeam' => $otherTeam]);
+    Process::fake();
+    Livewire::test(FileBrowser::class, ['resource' => $database])->assertForbidden();
+    Process::assertNothingRan();
+});
+
+it('does not use a container that stopped after mounting', function (string $action, array $arguments) {
+    Process::fake(['*' => Process::result(output: '')]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])->call('loadFiles');
+    $database->update(['status' => 'exited']);
+    $component->call($action, ...$arguments);
+})->with([
+    ['open', ['folder']],
+    ['goTo', ['/data']],
+    ['refresh', []],
+])->throws(RuntimeException::class, 'Container is not running.');
+
+it('lists files for a running application and excludes stopped and preview containers', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+    $containers = collect([
+        ['ID' => 'base', 'Names' => 'app-base', 'State' => 'running', 'Labels' => 'coolify.pullRequestId=0'],
+        ['ID' => 'stopped', 'Names' => 'app-stopped', 'State' => 'exited', 'Labels' => 'coolify.pullRequestId=0'],
+        ['ID' => 'preview', 'Names' => 'app-preview', 'State' => 'running', 'Labels' => 'coolify.pullRequestId=42'],
+    ])->map(fn ($container) => json_encode($container))->implode("\n");
+    Process::fake(function ($process) use ($containers) {
+        $output = match (true) {
+            str_contains($process->command, 'docker ps') => $containers,
+            str_contains($process->command, 'docker inspect') => '/app',
+            default => "file\t12\t1\t644\tconfig.yml",
+        };
+
+        return Process::result(output: $output);
+    });
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->call('loadFiles')
+        ->assertSet('availableContainers', ['app-base'])
+        ->assertSet('container', 'app-base')
+        ->assertSet('currentPath', '/app')
+        ->assertSee('config.yml')
+        ->call('refresh')
+        ->assertSet('container', 'app-base')
+        ->assertSee('config.yml');
+});
+
+it('renders before SSH starts and loads files in a later request', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: "file\t0\t1\t644\tconfig.yml"))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database]);
+    Process::assertNothingRan();
+    $component->assertSet('filesLoaded', false)
+        ->assertSet('container', null)
+        ->call('loadFiles')
+        ->assertSet('filesLoaded', true)
+        ->assertSet('currentPath', '/data')
+        ->assertSee('config.yml');
+});
+
+it('does not start SSH if the resource stops before deferred loading', function () {
+    Process::fake();
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database]);
+    $database->update(['status' => 'exited']);
+
+    $component->call('loadFiles')
+        ->assertSet('filesLoaded', true)
+        ->assertSet('containerRunning', false);
+    Process::assertNothingRan();
+});
+
+it('allows retrying a failed initial container lookup', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+    $fail = true;
+    Process::fake(function ($process) use (&$fail) {
+        if (str_contains($process->command, 'docker ps')) {
+            if ($fail) {
+                $fail = false;
+
+                return Process::result(errorOutput: 'Permission denied', exitCode: 1);
+            }
+
+            return Process::result(output: json_encode([
+                'ID' => 'base', 'Names' => 'app-base', 'State' => 'running', 'Labels' => '',
+            ]));
+        }
+
+        return Process::result(output: str_contains($process->command, 'docker inspect') ? '/app' : '');
+    });
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $application])
+        ->call('loadFiles')
+        ->assertSet('filesLoaded', false)
+        ->assertSet('loadFailed', true)
+        ->assertSet('container', null)
+        ->call('loadFiles')
+        ->assertSet('filesLoaded', true)
+        ->assertSet('loadFailed', false)
+        ->assertSet('container', 'app-base');
+});
+
+function fbConfigureDownloadStorage(): S3Storage
+{
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::create([
+        'name' => 'Downloads',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'downloads',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => 0,
+    ]);
+    InstanceSettings::find(0)->update(['file_download_s3_storage_id' => $storage->id]);
+    Once::flush();
+
+    return $storage;
+}
+
+it('queues an S3 upload instead of streaming when download storage is set', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    $storage = fbConfigureDownloadStorage();
+    $overStreamCapKb = intdiv(ContainerFilesystemService::MAX_DOWNLOAD_SIZE, 1024) + 1;
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "dir {$overStreamCapKb}"))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'folder')
+        ->assertNoRedirect()
+        ->assertDispatched('info');
+
+    expect($component->get('pendingDownloads'))->toHaveCount(1);
+    Bus::assertDispatched(PrepareFileDownloadJob::class, fn (PrepareFileDownloadJob $job) => $job->downloadId === $component->get('pendingDownloads')[0]
+        && $job->userId === $this->admin->id
+        && $job->path === '/data/folder'
+        && $job->isDir
+        && $job->downloadName === 'folder.tar.gz'
+        && $job->s3StorageId === $storage->id);
+});
+
+it('refuses S3 downloads above the S3 size cap', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file '.(FileDownloadStorageService::MAX_SIZE + 1)))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'big.bin')
+        ->assertDispatched('error');
+    Bus::assertNotDispatched(PrepareFileDownloadJob::class);
+});
+
+it('opens a finished S3 download once and ignores entries of other users', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file 10'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'a.txt');
+    $downloadId = $component->get('pendingDownloads')[0];
+    $cacheKey = PrepareFileDownloadJob::cacheKey($downloadId);
+
+    Cache::put($cacheKey, ['user_id' => $this->member->id, 'status' => 'ready', 'url' => 'https://s3.example.com/other'], 60);
+    $component->call('checkDownloads')
+        ->assertNotDispatched('open-file-download')
+        ->assertSet('pendingDownloads', [$downloadId]);
+
+    Cache::put($cacheKey, ['user_id' => $this->admin->id, 'status' => 'ready', 'url' => 'https://s3.example.com/get'], 60);
+    $component->call('checkDownloads')
+        ->assertDispatched('open-file-download', url: 'https://s3.example.com/get')
+        ->assertSet('pendingDownloads', []);
+    expect(Cache::has($cacheKey))->toBeFalse();
+});
+
+it('does not hand out S3 links after the user lost access to the resource', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file 10'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('download', 'a.txt');
+    Cache::put(PrepareFileDownloadJob::cacheKey($component->get('pendingDownloads')[0]), ['user_id' => $this->admin->id, 'status' => 'ready', 'url' => 'https://s3.example.com/get'], 60);
+
+    $this->project->update(['team_id' => Team::factory()->create()->id]);
+
+    $component->call('checkDownloads')
+        ->assertForbidden()
+        ->assertNotDispatched('open-file-download');
+});
+
+it('limits how many S3 downloads a user can start', function () {
+    Bus::fake([PrepareFileDownloadJob::class]);
+    fbConfigureDownloadStorage();
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: 'file 10'))
+        ->push(Process::result(output: 'file 10'))
+        ->push(Process::result(output: 'file 10'))
+        ->push(Process::result(output: 'file 10'))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])->call('loadFiles');
+
+    foreach (range(1, 4) as $attempt) {
+        $component->call('download', 'a.txt');
+    }
+
+    expect($component->get('pendingDownloads'))->toHaveCount(3);
+    Bus::assertDispatchedTimes(PrepareFileDownloadJob::class, 3);
+    $component->assertDispatched('error', 'Too many downloads are in progress. Wait for them to finish, then try again.');
+});
+
+it('blocks navigation before a container is selected', function (string $action, array $arguments) {
+    Process::fake();
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database]);
+
+    expect(fn () => $component->call($action, ...$arguments))
+        ->toThrow(RuntimeException::class, 'Container is not running.');
+    expect($component->instance()->currentPath)->toBe('');
+    Process::assertNothingRan();
+})->with([
+    ['open', ['folder']],
+    ['goTo', ['/data']],
+    ['refresh', []],
+]);
+
+it('reduces upload names to one filename component', function (string $name, string $expected) {
+    $component = new FileBrowser;
+    $sanitize = new ReflectionMethod(FileBrowser::class, 'sanitizeUploadName');
+
+    expect($sanitize->invoke($component, $name))->toBe($expected);
+})->with([
+    ['../../etc/cron.d/payload', 'payload'],
+    ['..\\..\\etc\\cron.d\\payload', 'payload'],
+    ['../nested\\folder/payload', 'payload'],
+    ["it's.txt", "it's.txt"],
+    ['.env', '.env'],
+    ['my file.txt', 'my file.txt'],
+]);
+
+it('rejects empty and all-dot upload names', function (string $name) {
+    $component = new FileBrowser;
+    $sanitize = new ReflectionMethod(FileBrowser::class, 'sanitizeUploadName');
+
+    expect(fn () => $sanitize->invoke($component, $name))
+        ->toThrow(RuntimeException::class, 'Invalid file name.');
+})->with(['', '/', '\\', '.', '..', '...', '../..', '..\\..']);
+
+it('refuses to save an opened file after its container identity changes', function () {
+    Process::fake(['*' => Process::sequence()
+        ->push(Process::result(output: '/data'))
+        ->push(Process::result(output: ''))
+        ->push(Process::result(output: "OK\n".base64_encode('before')))]);
+    $database = fbRunningDatabase($this->environment, $this->destination);
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+    $component = Livewire::test(FileBrowser::class, ['resource' => $database])
+        ->call('loadFiles')
+        ->call('openEditor', 'config.yml')
+        ->set('editorContent', 'after');
+
+    $database->update(['uuid' => (string) Str::uuid()]);
+    Process::swap(new Factory);
+    Process::fake();
+
+    expect(fn () => $component->call('saveEditor'))
+        ->toThrow(RuntimeException::class, 'Container is not running.');
+    expect($component->instance()->editingPath)->toBe('/data/config.yml');
+    Process::assertNothingRan();
+});
diff --git a/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php b/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php
index 5091fc9b2c..130b4c5ebe 100644
--- a/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php
+++ b/tests/Feature/Livewire/Fleet/MetricsChartPayloadTest.php
@@ -9,6 +9,7 @@ use App\Models\User;
 use App\Services\SentinelMetricsClient;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Concurrency;
+use Illuminate\Support\Facades\Queue;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -63,6 +64,8 @@ class DenseTestableMetrics extends Metrics
 }
 
 beforeEach(function () {
+    // The settings hook starts Sentinel when metrics turn on. A sync queue would run it and make a real SSH call.
+    Queue::fake();
     Concurrency::setDefaultInstance('sync');
     InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
     $user = User::factory()->create();
diff --git a/tests/Feature/Livewire/Fleet/MetricsDataTest.php b/tests/Feature/Livewire/Fleet/MetricsDataTest.php
index d70df7e9b0..90693900af 100644
--- a/tests/Feature/Livewire/Fleet/MetricsDataTest.php
+++ b/tests/Feature/Livewire/Fleet/MetricsDataTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Actions\Server\StartSentinel;
 use App\Livewire\Fleet\Metrics;
 use App\Models\Application;
 use App\Models\Environment;
@@ -13,6 +14,8 @@ use App\Models\User;
 use App\Services\SentinelMetricsClient;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Concurrency;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
 use Livewire\Livewire;
 use Tests\Support\ConcurrentMetricsClient;
 
@@ -72,6 +75,8 @@ class ProcessTestableMetrics extends Metrics
 }
 
 beforeEach(function () {
+    // The settings hook starts Sentinel when metrics turn on. A sync queue would run it and make a real SSH call.
+    Queue::fake();
     Concurrency::setDefaultInstance('sync');
     StubMetricsClient::$summaries = [];
     StubMetricsClient::$containers = [];
@@ -380,3 +385,65 @@ it('repairs the Sentinel token before creating worker clients', function () {
     expect(ServerSetting::isValidSentinelToken($token))->toBeTrue();
     expect($token)->not->toBe('invalid token');
 });
+
+/** A server that Coolify can reach, with metrics off. */
+function reachableServerWithoutMetrics(int $teamId, PrivateKey $privateKey): Server
+{
+    $server = Server::factory()->create(['team_id' => $teamId, 'private_key_id' => $privateKey->id]);
+    $server->settings->forceFill(['is_reachable' => true, 'is_usable' => true])->saveQuietly();
+
+    return $server;
+}
+
+it('enables metrics on each eligible server of the team from the empty state', function () {
+    $first = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $second = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $build = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $build->settings->update(['server_role' => 'build', 'is_build_server' => true]);
+    $unreachable = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
+    $foreign = reachableServerWithoutMetrics(Team::factory()->create()->id, $this->privateKey);
+
+    $component = Livewire::test(TestableMetrics::class)
+        ->assertSee('Enable metrics on 2 servers')
+        ->call('enableMetrics');
+
+    expect($first->settings->fresh()->is_metrics_enabled)->toBeTruthy();
+    expect($second->settings->fresh()->is_metrics_enabled)->toBeTruthy();
+    expect($build->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    expect($unreachable->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    expect($foreign->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    StartSentinel::assertPushed(2);
+
+    expect(array_column($component->get('serverRows'), 'uuid'))->toEqualCanonicalizing([$first->uuid, $second->uuid]);
+    $component->assertDontSee('No server metrics yet');
+});
+
+it('keeps enabling metrics on the other servers when one server fails', function () {
+    $broken = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $healthy = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    DB::statement("CREATE TRIGGER fail_settings_update BEFORE UPDATE ON server_settings WHEN NEW.server_id = {$broken->id} BEGIN SELECT RAISE(ABORT, 'write failed'); END");
+
+    Livewire::test(TestableMetrics::class)
+        ->call('enableMetrics')
+        ->assertDispatched('success', fn (string $event, array $params) => str_contains($params[0], 'Metrics enabled on 1 server.'))
+        ->assertDispatched('error', fn (string $event, array $params) => str_contains($params[0], $broken->name));
+
+    expect($broken->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    expect($healthy->settings->fresh()->is_metrics_enabled)->toBeTruthy();
+    StartSentinel::assertPushed(1);
+});
+
+it('does not let a team member enable metrics', function () {
+    $server = reachableServerWithoutMetrics($this->team->id, $this->privateKey);
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(TestableMetrics::class)
+        ->assertSee('No server metrics yet')
+        ->assertDontSee('Enable metrics on '.$server->name)
+        ->call('enableMetrics');
+
+    expect($server->settings->fresh()->is_metrics_enabled)->toBeFalsy();
+    StartSentinel::assertNotPushed();
+});
diff --git a/tests/Feature/Livewire/ServerTransferUiTest.php b/tests/Feature/Livewire/ServerTransferUiTest.php
index e77cefc76e..614e92de9f 100644
--- a/tests/Feature/Livewire/ServerTransferUiTest.php
+++ b/tests/Feature/Livewire/ServerTransferUiTest.php
@@ -1,26 +1,47 @@
 <?php
 
+use App\Actions\Server\DeleteServer;
+use App\Jobs\DeleteResourceJob;
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Jobs\ReleaseManagedDnsRecordsJob;
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Livewire\Server\Delete;
 use App\Livewire\Server\Transfer;
-use App\Livewire\Server\TransferImport;
+use App\Models\Application;
+use App\Models\DnsProviderZone;
 use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferClaimer;
-use App\Services\ServerTransfer\ServerTransferExporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    config(['app.env' => 'local']);
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    config(['app.env' => 'production']);
+    $this->withoutVite();
 
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
+    // The default password of UserFactory.
+    $this->userPassword = 'password'; // ggignore
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
     $this->actingAs($this->user);
     session(['currentTeam' => $this->team]);
@@ -34,47 +55,53 @@ beforeEach(function () {
     ]);
 });
 
-test('server transfer pages are unavailable outside development mode', function (string $uri) {
-    config(['app.env' => 'production']);
-
-    $this->get($uri)->assertNotFound();
-})->with([
-    '/servers/import',
-    fn () => '/server/'.$this->server->uuid.'/transfer',
-]);
-
-test('server transfer links are hidden outside development mode', function () {
-    config(['app.env' => 'production']);
-
-    $this->get('/servers')
-        ->assertOk()
-        ->assertDontSee('/servers/import');
-
-    $this->get('/server/'.$this->server->uuid)
-        ->assertOk()
-        ->assertDontSee('Transfer', escape: false);
+test('server transfer page is available in production', function () {
+    $this->get('/server/'.$this->server->uuid.'/transfer')->assertOk();
 });
 
-test('transfer state is hidden outside development mode', function (bool $managementDisabled) {
-    app(ServerTransferClaimer::class)->markTransferred($this->server, managementDisabled: $managementDisabled);
-    config(['app.env' => 'production']);
-
-    $this->get('/servers')
+test('server transfer link is shown to admins in production', function () {
+    $this->get('/server/'.$this->server->uuid)
         ->assertOk()
-        ->assertDontSee('Transferable')
-        ->assertDontSee('Transferred away');
+        ->assertSee('/server/'.$this->server->uuid.'/transfer', escape: false);
+});
+
+test('taking back a transferred server needs a typed confirmation', function () {
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://target.example.com');
 
     $this->get('/server/'.$this->server->uuid)
         ->assertOk()
-        ->assertDontSee('Transfer', escape: false)
-        ->assertDontSee('/transfer"', escape: false)
-        ->assertDontSee('another instance')
-        ->assertDontSee('Enable management')
-        ->assertDontSee('Disable management');
-})->with([
-    'management disabled' => [true],
-    'transferred away' => [false],
-]);
+        ->assertSee('Take back a transferred server?')
+        ->assertSee('Changes made on https://target.example.com after', escape: false);
+});
+
+test('team members cannot open the transfer page', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertRedirect(route('server.index'));
+
+    $this->get('/server/'.$this->server->uuid)
+        ->assertOk()
+        ->assertDontSee('/server/'.$this->server->uuid.'/transfer', escape: false);
+});
+
+test('a member who owns another team cannot use that role to transfer the server', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $otherTeam = Team::factory()->create();
+    $otherTeam->members()->attach($member->id, ['role' => 'owner']);
+    $this->actingAs($member);
+
+    session(['currentTeam' => $this->team]);
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertRedirect(route('server.index'));
+
+    session(['currentTeam' => $otherTeam]);
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertStatus(404);
+});
 
 test('transfer page renders for owned server', function () {
     Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
@@ -82,29 +109,14 @@ test('transfer page renders for owned server', function () {
         ->assertSee('Transfer server')
         ->assertSee('Target instance URL')
         ->assertSee('Target API token')
-        ->assertSee('Transfer server')
-        ->assertSee('Manual transfer');
-});
-
-test('transfer import page renders for admin', function () {
-    Livewire::test(TransferImport::class)
-        ->assertOk()
-        ->assertSee('Transfer file')
-        ->assertSee('Dry run')
-        ->assertSee('Import server');
-});
-
-test('export bundle streams download from livewire', function () {
-    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
-        ->call('exportBundle')
-        ->assertFileDownloaded('server-transfer-'.$this->server->uuid.'.json');
+        ->assertDontSee('Manual transfer')
+        ->assertDontSee('Passphrase');
 });
 
 test('transfer page badge shows the management state of the server', function (string $state, string $label, array $hidden) {
     $claimer = app(ServerTransferClaimer::class);
     match ($state) {
         'managed' => null,
-        'disabled' => $claimer->markTransferred($this->server, managementDisabled: true),
         'transferred' => $claimer->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test'),
     };
 
@@ -112,53 +124,194 @@ test('transfer page badge shows the management state of the server', function (s
         ->assertSee($label)
         ->assertDontSee($hidden);
 })->with([
-    'managed' => ['managed', 'Managed here', ['Transferable', 'Transferred away']],
-    'management disabled' => ['disabled', 'Transferable', ['Transferred away', 'Managed here']],
-    'transferred' => ['transferred', 'Transferred away', ['Transferable', 'Managed here']],
+    'managed' => ['managed', 'Managed here', ['Transferred away']],
+    'transferred' => ['transferred', 'Transferred away', ['Managed here']],
 ]);
 
-test('export bundle is encrypted only when a passphrase is set', function (?string $passphrase, string $fileName) {
+test('transfer to another instance runs in a queued job', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+
     Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
-        ->set('passphrase', $passphrase)
-        ->call('exportBundle')
-        ->assertFileDownloaded('server-transfer-'.$this->server->uuid.$fileName);
+        ->set('targetUrl', 'https://8.8.8.8')
+        ->set('targetToken', 'target-token')
+        ->call('migrateServer')
+        ->assertHasNoErrors()
+        ->assertSet('targetToken', '')
+        ->assertSee('Transfer in progress');
+
+    Queue::assertPushed(MigrateServerToInstanceJob::class);
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.status'))->toBe('running');
+});
+
+test('transfer page shows the error of a failed transfer', function () {
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => 'failed',
+        'target_url' => 'https://8.8.8.8',
+        'error' => 'Target import failed (HTTP 401): Unauthenticated.',
+    ]]])->save();
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Transfer failed')
+        ->assertSee('Target import failed (HTTP 401): Unauthenticated.');
+});
+
+test('a transferred server cannot delete its cloud provider machine', function () {
+    Queue::fake();
+    $this->server->forceFill(['hetzner_server_id' => 4242])->save();
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    $component = Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid]);
+    expect(collect($component->viewData('checkboxes'))->pluck('id'))->not->toContain('delete_from_hetzner');
+
+    $component->call('delete', $this->userPassword, ['delete_from_hetzner']);
+
+    DeleteServer::assertPushed(fn ($action, array $parameters) => $parameters[1] === false && $parameters[2] === 4242);
+});
+
+test('a transferred server does not show Hostinger VPS deletion guidance', function () {
+    $this->server->forceFill(['hostinger_virtual_machine_id' => 4242])->save();
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid])
+        ->assertDontSee('Hostinger deletes')
+        ->assertDontSee('hpanel.hostinger.com');
+});
+
+test('a managed server can still delete its cloud provider machine', function () {
+    $this->server->forceFill(['hetzner_server_id' => 4242])->save();
+
+    $component = Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid]);
+
+    expect(collect($component->viewData('checkboxes'))->pluck('id'))->toContain('delete_from_hetzner');
+});
+
+test('deleting a transferred server deletes its resources from this instance only', function () {
+    Queue::fake();
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create([
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    $component = Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid]);
+    expect(collect($component->viewData('checkboxes'))->pluck('id'))->not->toContain('force_delete_resources');
+
+    $component->call('delete', $this->userPassword);
+
+    Queue::assertPushed(DeleteResourceJob::class, fn (DeleteResourceJob $job) => $job->resource->is($application) && $job->deleteFromCoolifyOnly);
+    expect(Server::find($this->server->id))->toBeNull();
+});
+
+test('deleting a transferred server forgets the DNS records of its resources without releasing them at the provider', function () {
+    Queue::fake();
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create(['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    // An archive that still tracks a record, for example from a transfer before records were forgotten at claim time.
+    $this->server->forceFill(['server_metadata' => ['transfer' => ['status' => 'transferred']]])->save();
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $token->id]);
+    $record = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id]);
+    $record->addReference($application);
+
+    Livewire::test(Delete::class, ['server_uuid' => $this->server->uuid])->call('delete', $this->userPassword);
+    (new DeleteResourceJob($application->fresh(), deleteFromCoolifyOnly: true))->handle();
+
+    Queue::assertNotPushed(ReleaseManagedDnsRecordsJob::class);
+    expect(ManagedDnsRecord::find($record->id))->toBeNull()
+        ->and(Application::withTrashed()->find($application->id))->toBeNull();
+});
+
+test('deleting an application from Coolify only does not touch the server', function () {
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create([
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    Process::fake();
+
+    (new DeleteResourceJob($application, deleteFromCoolifyOnly: true))->handle();
+
+    Process::assertNothingRan();
+    expect(Application::withTrashed()->find($application->id))->toBeNull();
+});
+
+test('transfer with a token that the target does not accept shows an error and does not start', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'Unauthenticated.'], 401)]);
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->set('targetUrl', 'https://8.8.8.8')
+        ->set('targetToken', 'wrong-token')
+        ->call('migrateServer')
+        ->assertDispatched('error')
+        ->assertDontSee('Transfer in progress')
+        ->assertSee('A check failed. The transfer did not start.')
+        ->assertSee('OK: this instance can connect to the server over SSH.')
+        ->assertSee('FAILED: the target instance accepts the API token.')
+        ->assertSee('See the transfer log below for details.')
+        ->assertDontSee('checks failed:');
+
+    Queue::assertNotPushed(MigrateServerToInstanceJob::class);
+});
+
+test('transfer page links to the server on the target and lists the steps after a finished transfer', function () {
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => 'succeeded',
+        'target_url' => 'https://8.8.8.8',
+        'checklist' => ['Set the webhook URL of GitHub App <b>deploy-bot</b> to https://8.8.8.8/webhooks/source/github/events.'],
+        'target_server_url' => 'https://8.8.8.8/server/abc',
+    ]]])->save();
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Transfer finished')
+        ->assertSee('Finish the transfer on the target')
+        ->assertSee('href="https://8.8.8.8/server/abc"', escape: false)
+        ->assertSee('Set the webhook URL of GitHub App <b>deploy-bot</b> to https://8.8.8.8/webhooks/source/github/events.')
+        ->assertDontSee('<b>deploy-bot</b>', escape: false);
+});
+
+test('transfer page hides the post-transfer checklist', function (string $status, array $checklist) {
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => $status,
+        'target_url' => 'https://8.8.8.8',
+        'error' => 'Target import failed (HTTP 401): Unauthenticated.',
+        'checklist' => $checklist,
+    ]]])->save();
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertDontSee('Finish the transfer on the target')
+        ->assertDontSee('Set the webhook URL');
 })->with([
-    'null' => [null, '.json'],
-    'empty string' => ['', '.json'],
-    'only spaces' => ['   ', '.json'],
-    'set' => ['secret-pass', '.encrypted.json'],
+    'finished transfer without steps' => ['succeeded', []],
+    'failed transfer' => ['failed', ['Set the webhook URL of GitHub App deploy-bot.']],
 ]);
 
-test('import dry run from pasted json', function () {
-    $bundle = app(ServerTransferExporter::class)->export($this->server);
+test('the transfer page of an archive offers a transfer back instead of a transfer', function () {
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake(['https://8.8.8.8/api/v1/servers/*/migrate' => Http::response(['migration' => ['status' => 'running']], 202)]);
 
-    // Free IP for dry-run validation on same team would still report existing server
-    Livewire::test(TransferImport::class)
-        ->set('bundleJson', json_encode($bundle))
-        ->call('dryRun')
-        ->assertSet('lastResult.dry_run', true)
-        ->assertSet('lastResult.server_uuid', $this->server->uuid)
-        ->assertSee('Dry run result')
-        ->assertSee('Nothing written');
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->assertSet('managerUrl', 'https://8.8.8.8')
+        ->assertDontSee('Transfer to another instance')
+        ->set('managerToken', 'token-of-b')
+        ->call('transferBack')
+        ->assertDispatched('success')
+        ->assertSee('Transfer back started');
+
+    Http::assertSentCount(1);
 });
 
-test('import creates server after source removal', function () {
-    $bundle = app(ServerTransferExporter::class)->export($this->server);
-    $uuid = $this->server->uuid;
+test('team members cannot start a transfer back', function () {
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake();
+    $component = Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid]);
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
 
-    $this->server->forceDelete();
-    $this->privateKey->delete();
+    $component->set('managerToken', 'token-of-b')->call('transferBack');
 
-    Livewire::test(TransferImport::class)
-        ->set('bundleJson', json_encode($bundle))
-        ->set('preserveUuids', true)
-        ->set('adoptMode', true)
-        ->call('importBundle')
-        ->assertSet('importedServerUuid', $uuid)
-        ->assertSet('lastResult.dry_run', false)
-        ->assertSet('lastResult.claimed', true);
-
-    $server = Server::where('uuid', $uuid)->first();
-    expect($server)->not->toBeNull()
-        ->and(data_get($server->server_metadata, 'transfer.status'))->toBe('claimed');
+    Http::assertNothingSent();
 });
diff --git a/tests/Feature/LoginAndMcpAccessTest.php b/tests/Feature/LoginAndMcpAccessTest.php
index 5d0325f291..b99dbd7627 100644
--- a/tests/Feature/LoginAndMcpAccessTest.php
+++ b/tests/Feature/LoginAndMcpAccessTest.php
@@ -18,14 +18,15 @@ it('limits login attempts by normalized email independent of IP', function () {
         ->and($firstLimits[1]->key)->toBe($secondLimits[1]->key);
 });
 
-it('keeps MCP independent from the REST API access check', function () {
+it('keeps MCP independent from the REST API switch but applies the IP allow-list', function () {
     $mcp = Route::getRoutes()->match(Request::create('/mcp', 'POST'));
     $enable = Route::getRoutes()->match(Request::create('/api/v1/mcp/enable', 'POST'));
     $disable = Route::getRoutes()->match(Request::create('/api/v1/mcp/disable', 'POST'));
 
     expect($mcp->gatherMiddleware())->not->toContain(ApiAllowed::class)
+        ->and($mcp->gatherMiddleware())->toContain('api.ip.allowed')
         ->and($enable->gatherMiddleware())->not->toContain(ApiAllowed::class)
         ->and($disable->gatherMiddleware())->not->toContain(ApiAllowed::class)
-        ->and($enable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', 'api.ability:write')
-        ->and($disable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', 'api.ability:write');
+        ->and($enable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', 'api.ip.allowed', 'api.ability:write')
+        ->and($disable->gatherMiddleware())->toContain('auth:sanctum', 'api.token.team', 'api.ip.allowed', 'api.ability:write');
 });
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
index 55f788ddca..b1376df7cf 100644
--- a/tests/Feature/Mcp/McpEndpointTest.php
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -125,14 +125,21 @@ test('MCP endpoint works when the REST API is disabled', function () {
     mcpListTools($token)->assertOk();
 });
 
-test('MCP endpoint enforces the allowed API IPs', function () {
-    InstanceSettings::query()->where('id', 0)->update(['is_api_enabled' => false, 'allowed_ips' => '192.0.2.10']);
+test('MCP endpoint rejects a token from an IP outside the allow-list', function () {
+    InstanceSettings::query()->where('id', 0)->update(['allowed_ips' => '192.0.2.10']);
     Once::flush();
     $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
 
-    mcpListTools($token)->assertForbidden();
+    mcpListTools($token)
+        ->assertForbidden()
+        ->assertJson(['message' => 'You are not allowed to access the API.']);
+});
+
+test('MCP endpoint accepts a token from an IP inside the allow-list', function () {
+    InstanceSettings::query()->where('id', 0)->update(['is_api_enabled' => false, 'allowed_ips' => '192.0.2.10, 127.0.0.0/8']);
+    Once::flush();
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
 
-    $this->withServerVariables(['REMOTE_ADDR' => '192.0.2.10']);
     mcpListTools($token)->assertOk();
 });
 
diff --git a/tests/Feature/Mcp/McpToggleApiTest.php b/tests/Feature/Mcp/McpToggleApiTest.php
index 2af122e26d..109c5bbbd9 100644
--- a/tests/Feature/Mcp/McpToggleApiTest.php
+++ b/tests/Feature/Mcp/McpToggleApiTest.php
@@ -107,7 +107,7 @@ test('root token can enable MCP server when the REST API is disabled', function
 });
 
 test('MCP switch routes enforce the allowed API IPs', function (string $path) {
-    InstanceSettings::query()->where('id', 0)->update(['allowed_ips' => '192.0.2.10']);
+    InstanceSettings::query()->where('id', 0)->update(['is_api_enabled' => false, 'allowed_ips' => '192.0.2.10']);
     Once::flush();
     $token = makeRootMcpToken($this->user);
 
diff --git a/tests/Feature/NavbarSubmenuTest.php b/tests/Feature/NavbarSubmenuTest.php
new file mode 100644
index 0000000000..b336b46a80
--- /dev/null
+++ b/tests/Feature/NavbarSubmenuTest.php
@@ -0,0 +1,133 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+});
+
+function renderNavbarAt(string $path, bool $mobile = false): string
+{
+    app()->instance('request', Request::create($path));
+
+    return (string) test()->blade($mobile ? '<x-navbar />' : '<x-navbar desktop />');
+}
+
+function loginNavbarUser(string $role): void
+{
+    test()->team->members()->attach(test()->user->id, ['role' => $role]);
+    test()->actingAs(test()->user);
+    session(['currentTeam' => test()->team]);
+}
+
+test('a submenu page opens its submenu with the current page active', function () {
+    loginNavbarUser('owner');
+
+    $html = renderNavbarAt('/metrics');
+
+    expect($html)
+        ->toContain('Back to the main menu')
+        ->toMatch('#aria-current="page"[^>]*>\s*<svg[^>]*>.*?</svg>\s*<span[^>]*>Metrics</span>#s');
+});
+
+test('a page outside every submenu starts on the main menu', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/servers'))->not->toContain('data-active-submenu="');
+});
+
+test('a submenu entry links to its first visible page', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/servers'))->toContain('href="'.route('analytics').'"');
+});
+
+test('the registries page is hidden from members in the integrations submenu', function () {
+    loginNavbarUser('member');
+
+    expect(renderNavbarAt('/sources'))
+        ->toContain('Destinations')
+        ->not->toContain('href="'.route('registries.index').'"');
+});
+
+test('the team submenu lists the team pages by role', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/team/members'))
+        ->toContain('href="'.route('team.member.index').'"')
+        ->toContain('href="'.route('team.audit-log').'"')
+        ->toContain('href="'.route('team.danger-zone').'"');
+});
+
+test('members do not see the audit log or danger zone in the team submenu', function () {
+    loginNavbarUser('member');
+
+    expect(renderNavbarAt('/team'))
+        ->toContain('href="'.route('team.member.index').'"')
+        ->not->toContain('href="'.route('team.audit-log').'"')
+        ->not->toContain('href="'.route('team.danger-zone').'"');
+});
+
+test('notifications and keys & tokens open their own submenus', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/notifications/discord'))
+        ->toContain('href="'.route('notifications.slack').'"')
+        ->toMatch('#aria-current="page"[^>]*>.*?discord\.svg#s');
+
+    expect(renderNavbarAt('/security/api-tokens'))
+        ->toContain('href="'.route('security.private-key.index').'"')
+        ->toContain('Back to the main menu');
+});
+
+test('the admin link belongs to the main menu, not to submenus', function () {
+    config()->set('app.env', 'local');
+    $root = User::factory()->create(['id' => 0]);
+    test()->team->members()->attach($root->id, ['role' => 'owner']);
+    test()->actingAs($root);
+    session(['currentTeam' => test()->team]);
+
+    expect(renderNavbarAt('/team'))
+        ->toMatch('#<li\s+x-show="!submenu"\s+x-cloak[^>]*>\s*<a title="Admin"#');
+});
+
+test('shared variables open their own submenu', function () {
+    loginNavbarUser('owner');
+
+    expect(renderNavbarAt('/shared-variables/servers'))
+        ->toContain('Back to the main menu')
+        ->toContain('href="'.route('shared-variables.team.index').'"')
+        ->toMatch('#aria-current="page"[^>]*>\s*<svg[^>]*>.*?</svg>\s*<span[^>]*>Servers</span>#s');
+});
+
+test('instance settings open their own submenu for instance admins', function () {
+    config()->set('app.env', 'local');
+    $root = User::factory()->create(['id' => 0]);
+    test()->team->members()->attach($root->id, ['role' => 'owner']);
+    test()->actingAs($root);
+    session(['currentTeam' => test()->team]);
+
+    expect(renderNavbarAt('/settings/email'))
+        ->toContain('Back to the main menu')
+        ->toContain('href="'.route('settings.oauth').'"')
+        ->toMatch('#aria-current="page"[^>]*>\s*<svg[^>]*>.*?</svg>\s*<span[^>]*>Email</span>#s');
+});
+
+test('a parent entry opens its submenu in place on mobile and desktop', function () {
+    loginNavbarUser('owner');
+
+    foreach ([renderNavbarAt('/servers', mobile: true), renderNavbarAt('/servers')] as $html) {
+        expect($html)
+            ->toContain('x-show="submenu === \'Monitoring\'"')
+            ->toMatch('#<button type="button" title="Monitoring" @click="submenu = \'Monitoring\'#')
+            ->not->toMatch('#<a title="Monitoring"#');
+    }
+});
diff --git a/tests/Feature/ProcessGithubPullRequestWebhookTest.php b/tests/Feature/ProcessGithubPullRequestWebhookTest.php
index 667a7643f0..8a5199e942 100644
--- a/tests/Feature/ProcessGithubPullRequestWebhookTest.php
+++ b/tests/Feature/ProcessGithubPullRequestWebhookTest.php
@@ -8,6 +8,7 @@ use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\GithubApp;
 use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
@@ -53,7 +54,7 @@ it('cleans up a closed pull request preview when pull request comment cleanup fa
             'status' => 'success',
         ]);
 
-    $job = new class(applicationId: $this->application->id, githubAppId: null, action: 'closed', pullRequestId: 42, pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42', pullRequestTitle: null, beforeSha: null, afterSha: null, commitSha: 'HEAD', authorAssociation: 'OWNER', fullName: 'example/repo') extends ProcessGithubPullRequestWebhook
+    $job = new class(applicationId: $this->application->id, githubAppId: null, action: 'closed', pullRequestId: 42, pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42', pullRequestTitle: null, beforeSha: null, afterSha: null, commitSha: 'HEAD', fullName: 'example/repo') extends ProcessGithubPullRequestWebhook
     {
         protected function dispatchPullRequestClosedUpdate(Application $application, ApplicationPreview $preview): void
         {
@@ -97,7 +98,6 @@ it('skips a synchronized GitHub pull request preview when the head commit messag
         beforeSha: 'before-sha',
         afterSha: 'after-sha',
         commitSha: 'after-sha',
-        authorAssociation: 'OWNER',
         fullName: 'example/repo',
     );
 
@@ -147,7 +147,6 @@ it('deploys a synchronized GitHub pull request preview when the head commit mess
         beforeSha: 'before-sha',
         afterSha: 'after-sha',
         commitSha: 'after-sha',
-        authorAssociation: 'OWNER',
         fullName: 'example/repo',
     );
 
@@ -194,7 +193,6 @@ it('skips a GitHub pull request preview when the opened or reopened head commit
         beforeSha: null,
         afterSha: null,
         commitSha: 'head-sha',
-        authorAssociation: 'OWNER',
         fullName: 'example/repo',
     );
 
@@ -204,5 +202,270 @@ it('skips a GitHub pull request preview when the opened or reopened head commit
         ->and(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeFalse();
 
     Http::assertSent(fn (Request $request): bool => $request->url() === 'https://api.github.com/repos/example/repo/commits/head-sha');
-    Http::assertNotSent(fn (Request $request): bool => $request->url() === 'https://api.github.com/repos/example/repo/pulls/42/files');
+    Http::assertNotSent(fn (Request $request): bool => str_contains($request->url(), '/repos/example/repo/pulls/42/files'));
 })->with(['opened', 'reopened']);
+
+it('deploys an opened GitHub pull request preview when a watched file is beyond the first page of changed files', function () {
+    Queue::fake();
+
+    $this->application->update(['watch_paths' => 'apps/app/**']);
+    $this->application->settings->update([
+        'is_preview_deployments_enabled' => true,
+    ]);
+
+    $githubApp = GithubApp::create([
+        'name' => 'Public GitHub',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => true,
+        'team_id' => $this->team->id,
+    ]);
+
+    $firstPage = collect(range(1, 100))->map(fn (int $i): array => ['filename' => ".github/workflows/workflow-{$i}.yml"])->all();
+
+    Http::fake([
+        'https://api.github.com/repos/example/repo/commits/head-sha' => Http::response([
+            'commit' => ['message' => 'feat: add app'],
+        ]),
+        'https://api.github.com/repos/example/repo/pulls/42/files?per_page=100&page=1' => Http::response($firstPage),
+        'https://api.github.com/repos/example/repo/pulls/42/files?per_page=100&page=2' => Http::response([
+            ['filename' => 'apps/app/index.ts'],
+        ]),
+    ]);
+
+    $job = new ProcessGithubPullRequestWebhook(
+        applicationId: $this->application->id,
+        githubAppId: $githubApp->id,
+        action: 'opened',
+        pullRequestId: 42,
+        pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42',
+        pullRequestTitle: 'Add feature',
+        beforeSha: null,
+        afterSha: null,
+        commitSha: 'head-sha',
+        fullName: 'example/repo',
+    );
+
+    $job->handle();
+
+    expect(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeTrue()
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeTrue();
+
+    Http::assertSentCount(3);
+});
+
+it('deploys a GitHub pull request preview when the full list of changed files is unknown', function (string $action, array $filesResponse) {
+    Queue::fake();
+
+    $this->application->update(['watch_paths' => 'apps/app/**']);
+    $this->application->settings->update([
+        'is_preview_deployments_enabled' => true,
+    ]);
+
+    $githubApp = GithubApp::create([
+        'name' => 'Public GitHub',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => true,
+        'team_id' => $this->team->id,
+    ]);
+
+    Http::fake([
+        'https://api.github.com/repos/example/repo/commits/*' => Http::response([
+            'commit' => ['message' => 'feat: add app'],
+        ]),
+        ...$filesResponse,
+    ]);
+
+    $job = new ProcessGithubPullRequestWebhook(
+        applicationId: $this->application->id,
+        githubAppId: $githubApp->id,
+        action: $action,
+        pullRequestId: 42,
+        pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42',
+        pullRequestTitle: 'Add feature',
+        beforeSha: 'before-sha',
+        afterSha: 'after-sha',
+        commitSha: 'after-sha',
+        fullName: 'example/repo',
+    );
+
+    $job->handle();
+
+    expect(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeTrue()
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeTrue();
+})->with([
+    'opened with a GitHub API error' => fn () => ['opened', [
+        'https://api.github.com/repos/example/repo/pulls/42/files*' => Http::response(['message' => 'Server Error'], 500),
+    ]],
+    'synchronize with a GitHub API error' => fn () => ['synchronize', [
+        'https://api.github.com/repos/example/repo/compare/*' => Http::response(['message' => 'Server Error'], 500),
+    ]],
+    'synchronize with a truncated compare file list' => fn () => ['synchronize', [
+        'https://api.github.com/repos/example/repo/compare/*' => Http::response([
+            'files' => collect(range(1, 300))->map(fn (int $i): array => ['filename' => "docs/page-{$i}.md"])->all(),
+        ]),
+    ]],
+]);
+
+it('skips an opened GitHub pull request preview when no changed file matches the watch paths', function () {
+    Queue::fake();
+
+    $this->application->update(['watch_paths' => 'apps/app/**']);
+    $this->application->settings->update([
+        'is_preview_deployments_enabled' => true,
+    ]);
+
+    $githubApp = GithubApp::create([
+        'name' => 'Public GitHub',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => true,
+        'team_id' => $this->team->id,
+    ]);
+
+    Http::fake([
+        'https://api.github.com/repos/example/repo/commits/head-sha' => Http::response([
+            'commit' => ['message' => 'docs: update readme'],
+        ]),
+        'https://api.github.com/repos/example/repo/pulls/42/files*' => Http::response([
+            ['filename' => 'README.md'],
+        ]),
+    ]);
+
+    $job = new ProcessGithubPullRequestWebhook(
+        applicationId: $this->application->id,
+        githubAppId: $githubApp->id,
+        action: 'opened',
+        pullRequestId: 42,
+        pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42',
+        pullRequestTitle: 'Update docs',
+        beforeSha: null,
+        afterSha: null,
+        commitSha: 'head-sha',
+        fullName: 'example/repo',
+    );
+
+    $job->handle();
+
+    expect(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeFalse()
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeFalse();
+});
+
+it('uses one GitHub App installation token for all GitHub API calls of a pull request job', function () {
+    Queue::fake();
+
+    $this->application->update(['watch_paths' => 'apps/app/**']);
+    $this->application->settings->update([
+        'is_preview_deployments_enabled' => true,
+    ]);
+
+    openssl_pkey_export(openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]), $pemKey);
+
+    $githubApp = GithubApp::create([
+        'name' => 'Private GitHub App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 12345,
+        'installation_id' => 67890,
+        'private_key_id' => PrivateKey::create([
+            'name' => 'GitHub App Key',
+            'private_key' => $pemKey,
+            'team_id' => $this->team->id,
+        ])->id,
+        'is_public' => false,
+        'team_id' => $this->team->id,
+    ]);
+
+    $firstPage = collect(range(1, 100))->map(fn (int $i): array => ['filename' => ".github/workflows/workflow-{$i}.yml"])->all();
+
+    Http::fake([
+        'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+            'Date' => now()->toRfc7231String(),
+        ]),
+        'https://api.github.com/app/installations/67890/access_tokens' => Http::response([
+            'token' => 'fake-installation-token',
+        ], 201),
+        'https://api.github.com/repos/example/repo/commits/head-sha' => Http::response([
+            'commit' => ['message' => 'feat: add app'],
+        ]),
+        'https://api.github.com/repos/example/repo/pulls/42/files?per_page=100&page=1' => Http::response($firstPage),
+        'https://api.github.com/repos/example/repo/pulls/42/files?per_page=100&page=2' => Http::response([
+            ['filename' => 'apps/app/index.ts'],
+        ]),
+    ]);
+
+    $job = new ProcessGithubPullRequestWebhook(
+        applicationId: $this->application->id,
+        githubAppId: $githubApp->id,
+        action: 'opened',
+        pullRequestId: 42,
+        pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42',
+        pullRequestTitle: 'Add feature',
+        beforeSha: null,
+        afterSha: null,
+        commitSha: 'head-sha',
+        fullName: 'example/repo',
+    );
+
+    $job->handle();
+
+    expect(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBeTrue();
+
+    $tokenRequests = Http::recorded(fn (Request $request): bool => str_ends_with($request->url(), '/access_tokens'));
+    $repositoryRequests = Http::recorded(fn (Request $request): bool => str_contains($request->url(), '/repos/example/repo/'));
+
+    expect($tokenRequests)->toHaveCount(1)
+        ->and($repositoryRequests)->toHaveCount(3)
+        ->and($repositoryRequests->every(fn (array $pair): bool => $pair[0]->hasHeader('Authorization', 'Bearer fake-installation-token')))->toBeTrue();
+});
+
+it('deploys an opened GitHub pull request preview by fork status, not by author association', function (bool $isForkPullRequest, bool $isPublicEnabled, bool $deploys) {
+    Queue::fake();
+
+    $this->application->settings->update([
+        'is_preview_deployments_enabled' => true,
+        'is_pr_deployments_public_enabled' => $isPublicEnabled,
+    ]);
+
+    Http::fake([
+        'https://api.github.com/repos/example/repo/commits/head-sha' => Http::response([
+            'commit' => ['message' => 'feat: add app'],
+        ]),
+        'https://api.github.com/repos/example/repo/pulls/42/files*' => Http::response([
+            ['filename' => 'README.md'],
+        ]),
+    ]);
+
+    $job = new ProcessGithubPullRequestWebhook(
+        applicationId: $this->application->id,
+        githubAppId: GithubApp::create([
+            'name' => 'Public GitHub',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'is_public' => true,
+            'team_id' => $this->team->id,
+        ])->id,
+        action: 'opened',
+        pullRequestId: 42,
+        pullRequestHtmlUrl: 'https://github.com/example/repo/pull/42',
+        pullRequestTitle: 'Add feature',
+        beforeSha: null,
+        afterSha: 'head-sha',
+        commitSha: 'head-sha',
+        fullName: 'example/repo',
+        isForkPullRequest: $isForkPullRequest,
+    );
+
+    $job->handle();
+
+    expect(ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBe($deploys)
+        ->and(ApplicationDeploymentQueue::where('application_id', $this->application->id)->where('pull_request_id', 42)->exists())->toBe($deploys);
+})->with([
+    'same-repository branch with public deployments off' => [false, false, true],
+    'fork with public deployments off' => [true, false, false],
+    'fork with public deployments on' => [true, true, true],
+]);
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index 442ed159b2..f668a58372 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -100,7 +100,7 @@ it('loads an S3 profile picture from the configured CDN', function () {
     expect(profile_avatar_url($user))->toBe("https://avatars.example.com/media/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
 });
 
-it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
+it('falls back to the authenticated proxy route for an S3 profile picture when the CDN is not configured', function () {
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -118,7 +118,9 @@ it('loads an S3 profile picture directly from S3 when the CDN is not configured'
         'avatar_s3_storage_id' => $storage->id,
     ]);
 
-    expect(profile_avatar_url($user))->toBe("https://s3.example.com/avatars/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+    // Direct S3-compatible endpoints (e.g. Cloudflare R2) require authenticated requests,
+    // so without a CDN the browser must use the app's authenticated proxy route.
+    expect(profile_avatar_url($user))->toBe(route('profile.avatar', ['v' => $user->updated_at->timestamp]));
 });
 
 it('does not use an unrelated S3 storage URL for a profile picture', function () {
diff --git a/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php b/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php
index 514ebac4c3..ec7f1423d0 100644
--- a/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php
+++ b/tests/Feature/ProjectAndEnvironmentSettingsButtonTest.php
@@ -35,7 +35,7 @@ test('project show page header links to project settings', function () {
     $editUrl = route('project.edit', ['project_uuid' => $this->project->uuid]);
 
     Livewire::test(ProjectShow::class, ['project_uuid' => $this->project->uuid])
-        ->assertSee('Settings')
+        ->assertSee('Open settings for Test Project', false)
         ->assertSee('Project settings', false)
         ->assertSeeHtml($editUrl);
 });
@@ -51,7 +51,22 @@ test('environment resources page header links to environment settings', function
         'environment_uuid' => $this->environment->uuid,
     ]))
         ->assertSuccessful()
-        ->assertSee('Settings')
+        ->assertSee('Open settings for '.$this->environment->name, false)
         ->assertSee('Environment settings', false)
         ->assertSee($editUrl, false);
 });
+
+test('empty environment resources page header links to the canvas', function () {
+    $canvasUrl = route('project.environment.canvas', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+    ]);
+
+    $this->get(route('project.resource.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertSee('No resources yet')
+        ->assertSee($canvasUrl, false);
+});
diff --git a/tests/Feature/ProjectCanvasTest.php b/tests/Feature/ProjectCanvasTest.php
index ecf6237cf0..d198517f46 100644
--- a/tests/Feature/ProjectCanvasTest.php
+++ b/tests/Feature/ProjectCanvasTest.php
@@ -73,9 +73,12 @@ test('the project canvas shows the resources of every environment, grouped by en
         ->assertOk()
         ->assertJsonPath('title', 'Shop')
         ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('can_move', false)
+        ->assertJsonPath('can_move_groups', true)
         ->assertJsonPath('layout', 'server')
         ->assertJsonPath('links.0.id', $link->uuid)
-        ->assertJsonPath('positions', [$live->uuid => ['x' => 40, 'y' => 80]]);
+        // Auto-placed: a position saved on one environment canvas does not fit next to the other environments.
+        ->assertJsonPath('positions', []);
 
     expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['web-server'])
         ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['name'] => $node['context']])->sortKeys()->all())->toBe([
@@ -98,7 +101,14 @@ test('members see the project canvases but cannot edit them', function () {
     projectCanvasSession($this, $member, $this->team)
         ->getJson('/canvas/api/projects/canvas')
         ->assertOk()
-        ->assertJsonPath('can_edit', false);
+        ->assertJsonPath('can_edit', false)
+        ->assertJsonPath('can_move_groups', false);
+    projectCanvasSession($this, $member, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertJsonPath('can_move_groups', false);
+    projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/projects/canvas')
+        ->assertJsonPath('can_move_groups', true);
 });
 
 test('the project canvas is out of reach from another team', function () {
@@ -159,11 +169,63 @@ test('the projects canvas shows every project of the team as a zone, grouped by
 
     expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['Blog', 'Shop'])
         ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['name'] => [$node['zone'], $node['context']]])->sortKeys()->all())->toBe([
+            'No resources yet' => [$this->project->uuid, 'production'],
             'storefront' => [$this->project->uuid, 'staging'],
             'wordpress' => [$blog->uuid, 'production'],
         ]);
 });
 
+test('the project canvases show empty environments and projects as placeholder cards', function () {
+    projectCanvasApp($this->staging, $this->server, 'storefront');
+    $bare = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Bare']);
+    $bare->environments()->delete();
+
+    $project = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertOk();
+    $placeholder = collect($project->json('nodes'))->firstWhere('type', 'empty');
+
+    // Next to the other environments: on the server of the project's resources.
+    expect(collect($project->json('zones'))->pluck('name')->all())->toBe(['web-server'])
+        ->and($placeholder)->toMatchArray([
+            'id' => "empty:{$this->production->uuid}",
+            'zone' => $this->server->uuid,
+            'context' => 'production',
+            // Admins add the first resource on the deploy canvas, with the environment chosen.
+            'link' => route('deploy-canvas', ['project' => $this->project->uuid, 'environment' => $this->production->uuid]),
+            'context_link' => route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->production->uuid]),
+            'environment' => ['uuid' => $this->production->uuid, 'name' => 'production'],
+        ]);
+
+    // Members cannot add resources: the card opens the environment page.
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $memberView = projectCanvasSession($this, $member, $this->team)
+        ->getJson("/canvas/api/projects/{$this->project->uuid}/canvas")
+        ->assertOk();
+    expect(collect($memberView->json('nodes'))->firstWhere('type', 'empty')['link'])
+        ->toBe(route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->production->uuid]));
+
+    // A project without resources has no server: its environments get their own zone.
+    $alone = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/projects/{$bare->uuid}/canvas")
+        ->assertOk();
+    expect(collect($alone->json('zones'))->pluck('name')->all())->toBe(['Empty environments'])
+        ->and($alone->json('nodes.0.name'))->toBe('No environments yet');
+
+    $team = projectCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/projects/canvas')
+        ->assertOk();
+
+    // A project without environments gets one placeholder in its zone.
+    expect(collect($team->json('nodes'))->firstWhere('zone', $bare->uuid))->toMatchArray([
+        'type' => 'empty',
+        'name' => 'No environments yet',
+        'link' => route('project.show', ['project_uuid' => $bare->uuid]),
+        'environment' => null,
+    ]);
+});
+
 test('the projects page reopens the canvas when the user left it on the canvas view', function () {
     projectCanvasSession($this, $this->admin, $this->team)
         ->get(route('project.canvas.index'))
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index 99a6c0ac5b..ff4615ccb4 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -129,7 +129,7 @@ it('loads an S3 project icon from the configured CDN', function () {
         ->assertViewHas('projectsJs', fn (array $projects): bool => $projects[0]['iconUrl'] === "https://avatars.example.com/media/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
 });
 
-it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
+it('falls back to the authenticated proxy route for an S3 project icon when the CDN is not configured', function () {
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -147,7 +147,12 @@ it('loads an S3 project icon directly from S3 when the CDN is not configured', f
         'icon_s3_storage_id' => $storage->id,
     ])->save();
 
-    expect(project_icon_url($this->project))->toBe("https://s3.example.com/avatars/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+    // Direct S3-compatible endpoints (e.g. Cloudflare R2) require authenticated requests,
+    // so without a CDN the browser must use the app's authenticated proxy route.
+    expect(project_icon_url($this->project))->toBe(route('project.icon', [
+        'project_uuid' => $this->project->uuid,
+        'v' => $this->project->updated_at->timestamp,
+    ]));
 });
 
 it('does not use an unusable S3 storage URL for a project icon', function () {
diff --git a/tests/Feature/PublicGitRepositorySshUrlTest.php b/tests/Feature/PublicGitRepositorySshUrlTest.php
index 80df73a9f6..6822925105 100644
--- a/tests/Feature/PublicGitRepositorySshUrlTest.php
+++ b/tests/Feature/PublicGitRepositorySshUrlTest.php
@@ -32,3 +32,11 @@ test('strips custom ports when converting scp-style ssh urls to https', function
         ->assertSet('repository_url', 'https://git.example.com/organization/repository.git')
         ->assertSet('branchFound', true);
 });
+
+test('converts ssh scheme urls with custom ports to https', function () {
+    Livewire::test(PublicGitRepository::class, ['type' => 'public'])
+        ->set('repository_url', 'ssh://git@gitea.example.com:2222/organization/repository.git')
+        ->call('loadBranch')
+        ->assertSet('repository_url', 'https://gitea.example.com/organization/repository.git')
+        ->assertSet('branchFound', true);
+});
diff --git a/tests/Feature/PullServiceTemplatesFromCdnTest.php b/tests/Feature/PullServiceTemplatesFromCdnTest.php
index d70d787a76..1406721f27 100644
--- a/tests/Feature/PullServiceTemplatesFromCdnTest.php
+++ b/tests/Feature/PullServiceTemplatesFromCdnTest.php
@@ -1,10 +1,15 @@
 <?php
 
 use App\Jobs\PullTemplatesFromCDN;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
+
+uses(RefreshDatabase::class);
 
 beforeEach(function () {
     Cache::flush();
@@ -146,7 +151,9 @@ it('keeps the local templates when the CDN returns an unusable bundle', function
     'json list' => '[1, 2]',
 ]);
 
-it('logs when the CDN responds with a non-success status', function () {
+it('logs without notifying when the CDN responds with a non-success status', function () {
+    Team::factory()->create(['id' => 0])->discordNotificationSettings()->update(['discord_enabled' => true]);
+    Notification::fake();
     Http::fake([
         'cdn.coollabs.io/*' => Http::response('nope', 503),
     ]);
@@ -160,4 +167,5 @@ it('logs when the CDN responds with a non-success status', function () {
     (new PullTemplatesFromCDN)->handle();
 
     expect(Cache::get(service_templates_cache_key()))->toBeNull();
+    Notification::assertNothingSent();
 });
diff --git a/tests/Feature/ReadOnlyFieldsAreNotPersistedTest.php b/tests/Feature/ReadOnlyFieldsAreNotPersistedTest.php
new file mode 100644
index 0000000000..4075717d90
--- /dev/null
+++ b/tests/Feature/ReadOnlyFieldsAreNotPersistedTest.php
@@ -0,0 +1,95 @@
+<?php
+
+use App\Livewire\Destination\Show as DestinationShow;
+use App\Livewire\Project\Database\Clickhouse\General as ClickhouseGeneral;
+use App\Livewire\Project\Database\Dragonfly\General as DragonflyGeneral;
+use App\Livewire\Project\Database\Keydb\General as KeydbGeneral;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->team->members()->attach($this->owner->id, ['role' => 'owner']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+});
+
+dataset('read-only-credential-components', [
+    'keydb' => ['create_standalone_keydb', KeydbGeneral::class, ['keydbPassword' => 'keydb_password']],
+    'dragonfly' => ['create_standalone_dragonfly', DragonflyGeneral::class, ['dragonflyPassword' => 'dragonfly_password']],
+    'clickhouse' => ['create_standalone_clickhouse', ClickhouseGeneral::class, [
+        'clickhouseAdminUser' => 'clickhouse_admin_user',
+        'clickhouseAdminPassword' => 'clickhouse_admin_password',
+    ]],
+]);
+
+it('does not save read-only credentials of a started database', function (string $createDatabase, string $generalClass, array $fields) {
+    $database = $createDatabase($this->environment->id, $this->destination, ['started_at' => now()])->fresh();
+    $stored = collect($fields)->mapWithKeys(fn (string $column) => [$column => $database->{$column}]);
+
+    $component = Livewire::test($generalClass, ['database' => $database])->set('description', 'Updated');
+    foreach (array_keys($fields) as $property) {
+        $component->set($property, 'AutofilledLogin1234567890');
+    }
+    $component->call('submit')->assertHasNoErrors();
+
+    $database->refresh();
+    expect($database->description)->toBe('Updated');
+    foreach ($stored as $column => $value) {
+        expect($database->{$column})->toBe($value);
+    }
+})->with('read-only-credential-components');
+
+it('saves credentials of a database that was never started', function (string $createDatabase, string $generalClass, array $fields) {
+    $database = $createDatabase($this->environment->id, $this->destination)->fresh();
+
+    $component = Livewire::test($generalClass, ['database' => $database]);
+    foreach (array_keys($fields) as $property) {
+        $component->set($property, 'ChangedBeforeStart1234567890');
+    }
+    $component->call('submit')->assertHasNoErrors();
+
+    $database->refresh();
+    foreach ($fields as $column) {
+        expect($database->{$column})->toBe('ChangedBeforeStart1234567890');
+    }
+})->with('read-only-credential-components');
+
+it('rejects changes to the read-only destination network and server IP', function (string $property) {
+    $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destination->uuid]);
+
+    expect(fn () => $component->set($property, 'tampered'))->toThrow(CannotUpdateLockedPropertyException::class);
+})->with(['network', 'serverIp']);
+
+it('saves the destination name without changing the network or server IP', function () {
+    $network = $this->destination->network;
+    $ip = (string) $this->server->ip;
+
+    Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destination->uuid])
+        ->set('name', 'renamed-destination')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    expect($this->destination->fresh()->name)->toBe('renamed-destination')
+        ->and($this->destination->fresh()->network)->toBe($network)
+        ->and((string) $this->server->fresh()->ip)->toBe($ip);
+});
diff --git a/tests/Feature/ResourceMenuInMainNavTest.php b/tests/Feature/ResourceMenuInMainNavTest.php
new file mode 100644
index 0000000000..7776e99551
--- /dev/null
+++ b/tests/Feature/ResourceMenuInMainNavTest.php
@@ -0,0 +1,148 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'name' => 'Navbar Menu App',
+        'status' => 'running',
+    ]);
+});
+
+test('an application page teleports its menu into the main sidebar ', function () {
+    $response = $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $html = $response->getContent();
+
+    expect($html)
+        ->toContain('id="main-nav-context-0"')
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('application-settings-navigation in-main-nav')
+        ->toMatch('#<button type="button" @click="navLevel = -1; navSwap = \'back\'"\s+title="Back to the main menu"#')
+        ->not->toContain('id="main-nav-context-1"')
+        ->and(substr_count($html, 'id="main-nav-context-0"'))->toBe(1);
+});
+
+test('pages without a resource menu keep the main menu on wide screens', function () {
+    $response = $this->get(route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]));
+
+    $response->assertSuccessful();
+    expect($response->getContent())->not->toContain('id="main-nav-context-');
+});
+
+test('a database page teleports its menu into the main sidebar', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id, 'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $html = $this->get(route('project.database.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'database_uuid' => $database->uuid,
+    ]))->assertSuccessful()->getContent();
+
+    expect($html)
+        ->toContain('id="main-nav-context-0"')
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('application-settings-navigation in-main-nav');
+});
+
+test('a server page teleports its menu into the main sidebar with a back row to the main menu', function () {
+    $html = $this->get(route('server.show', ['server_uuid' => $this->server->uuid]))
+        ->assertSuccessful()
+        ->getContent();
+
+    expect($html)
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('application-settings-navigation in-main-nav')
+        ->toMatch('#@click="navLevel = -1; navSwap = \'back\'"\s+title="Back to the main menu"#')
+        ->and(substr_count($html, 'proxyConfigurationPending: '))->toBe(2);
+});
+
+test('integration detail pages teleport their menu with a back row to the integrations submenu', function () {
+    $storage = S3Storage::create([
+        'name' => 'backup-bucket', 'region' => 'us-east-1', 'key' => 'access-key', 'secret' => 'secret-key',
+        'bucket' => 'coolify-backups', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->team->id, 'is_usable' => true,
+    ]);
+
+    $pages = [
+        route('storage.show', ['storage_uuid' => $storage->uuid]),
+        route('destination.show', ['destination_uuid' => $this->destination->uuid]),
+    ];
+
+    foreach ($pages as $url) {
+        expect($this->get($url)->assertSuccessful()->getContent())
+            ->toContain('x-teleport="#main-nav-context-0"')
+            ->toContain('application-settings-navigation in-main-nav')
+            ->toMatch('#@click="navLevel = -1; navSwap = \'back\'"\s+title="Back to Integrations"#')
+            ->toContain('data-active-submenu="Integrations"');
+    }
+});
+
+test('a database backup page keeps the database menu one back away in the main sidebar', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'orders-db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db',
+        'image' => 'postgres:17', 'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id, 'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *', 'save_s3' => false, 'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(), 'team_id' => $this->team->id,
+    ]);
+
+    $html = $this->get(route('project.database.backup.execution', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'database_uuid' => $database->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]))->assertSuccessful()->getContent();
+
+    expect($html)
+        ->toContain('x-teleport="#main-nav-context-0"')
+        ->toContain('x-teleport="#main-nav-context-1"')
+        ->toMatch('#@click="navLevel = -1; navSwap = \'back\'"\s+title="Back to the main menu"#')
+        ->toMatch('#@click="navLevel = 0; navSwap = \'back\'"\s+title="Back to the database menu"#')
+        ->and(substr_count($html, 'aria-label="Database settings"'))->toBe(1)
+        ->and(substr_count($html, 'aria-label="Backup settings"'))->toBe(2);
+});
diff --git a/tests/Feature/ReverbAndTerminalPackagingTest.php b/tests/Feature/ReverbAndTerminalPackagingTest.php
index 4be08dcdd5..eb9e828a9d 100644
--- a/tests/Feature/ReverbAndTerminalPackagingTest.php
+++ b/tests/Feature/ReverbAndTerminalPackagingTest.php
@@ -254,7 +254,6 @@ it('stops publishing or preserving the obsolete realtime image', function () {
         ->not->toContain('realtime_version')
         ->not->toContain('realtime_image')
         ->and(file_get_contents(app_path('Actions/Server/CleanupDocker.php')))
-        ->not->toContain('coolify-realtime')
         ->not->toContain('realtimeImage')
         ->and(file_get_contents(base_path('versions.json')))
         ->not->toContain('"realtime"')
diff --git a/tests/Feature/ScheduleAuditTest.php b/tests/Feature/ScheduleAuditTest.php
index 6c700eae69..68a81a3325 100644
--- a/tests/Feature/ScheduleAuditTest.php
+++ b/tests/Feature/ScheduleAuditTest.php
@@ -422,3 +422,27 @@ test('updating, toggling, and deleting a storage backup schedule record audit ev
         ->and($deleteEvent->metadata['storage_uuid'])->toBe($volume->uuid)
         ->and($backup->fresh())->toBeNull();
 });
+
+test('a request that reaches the danger section after the backup schedule is deleted does not render it', function () {
+    $database = createScheduleAuditPostgres($this->environment, $this->destination);
+    $backup = createScheduleAuditDatabaseBackup($this->team, $database);
+
+    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($database): void {
+        $event->route->setParameter('project_uuid', $this->project->uuid);
+        $event->route->setParameter('environment_uuid', $this->environment->uuid);
+        $event->route->setParameter('database_uuid', $database->uuid);
+    });
+
+    Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+        'section' => 'danger',
+    ])
+        ->call('delete', 'password', ['delete_associated_backups_locally'])
+        ->assertRedirect()
+        ->call('refreshStatus')
+        ->assertOk();
+
+    expect($backup->fresh())->toBeNull()
+        ->and(scheduleAuditEvent('ui.database.backup_schedule_deleted')->metadata['backup_uuid'])->toBe($backup->uuid);
+});
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index 2e4cdcf34e..19edd2af41 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -1,10 +1,16 @@
 <?php
 
+use App\Jobs\CheckForUpdatesJob;
+use App\Jobs\CheckHelperImageJob;
+use App\Jobs\PullChangelog;
+use App\Jobs\PullTemplatesFromCDN;
+use App\Jobs\UpdateCoolifyJob;
 use App\Models\InstanceSettings;
 use Illuminate\Console\Scheduling\Schedule;
 use Illuminate\Contracts\Console\Kernel;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Queue;
 
 uses(RefreshDatabase::class);
 
@@ -51,6 +57,22 @@ it('schedules every production job with onOneServer', function () {
     });
 });
 
+it('dispatches CDN fetching jobs with a random delay so instances do not hit the CDN at the same second', function () {
+    InstanceSettings::query()->whereKey(0)->update(['is_auto_update_enabled' => true]);
+    Queue::fake();
+
+    $jobs = [CheckHelperImageJob::class, CheckForUpdatesJob::class, PullTemplatesFromCDN::class, PullChangelog::class, UpdateCoolifyJob::class];
+    $schedule = app(Schedule::class);
+
+    foreach ($jobs as $job) {
+        $event = collect($schedule->events())->first(fn ($e) => $e->description === $job);
+        expect($event)->not->toBeNull("[{$job}] is not scheduled");
+        $event->run(app());
+
+        Queue::assertPushed($job, fn ($pushed) => is_int($pushed->delay) && $pushed->delay >= 0 && $pushed->delay <= 600);
+    }
+});
+
 it('does not schedule Stripe subscription reconciliation automatically', function () {
     $schedule = app(Schedule::class);
 
diff --git a/tests/Feature/ScheduledJobManagerDispatchTest.php b/tests/Feature/ScheduledJobManagerDispatchTest.php
index d09bb865a1..d904fe016d 100644
--- a/tests/Feature/ScheduledJobManagerDispatchTest.php
+++ b/tests/Feature/ScheduledJobManagerDispatchTest.php
@@ -1060,6 +1060,33 @@ it('does not run a scheduled task again when Redis hands it out after its worker
     expect(ScheduledTaskExecution::query()->where('scheduled_task_id', $task->id)->exists())->toBeFalse();
 });
 
+it('drops a scheduled task job while an earlier run of the same task holds the overlap lock', function () {
+    $task = createScheduledApplicationTask(createScheduledTaskApplication(), ['timeout' => 4200]);
+    $occurrence = ScheduledJobDelivery::create([
+        'schedule_key' => "scheduled-task:{$task->id}",
+        'scheduled_for' => now(),
+        'job_type' => 'scheduled-task',
+        'resource_id' => $task->id,
+        'status' => 'enqueued',
+        'enqueued_at' => now(),
+    ]);
+    $job = (new ScheduledTaskJob($task, $occurrence->uuid))->withFakeQueueInteractions();
+    $middleware = $job->middleware()[0];
+    $runningLock = Cache::lock($middleware->getLockKey($job), 60);
+    $runningLock->get();
+
+    $middleware->handle($job, fn (ScheduledTaskJob $job) => $job->handle());
+    $otherTaskJob = new ScheduledTaskJob(createScheduledApplicationTask(createScheduledTaskApplication()));
+
+    $job->assertNotReleased();
+    expect($middleware->expiresAfter)->toBe(4200 + 300)
+        ->and($occurrence->fresh()->status)->toBe('skipped')
+        ->and(ScheduledTaskExecution::query()->where('scheduled_task_id', $task->id)->exists())->toBeFalse()
+        ->and($otherTaskJob->middleware()[0]->getLockKey($otherTaskJob))->not->toBe($middleware->getLockKey($job));
+
+    $runningLock->release();
+});
+
 it('fails only its own execution and notifies the team when the worker timeout stops a scheduled task job', function () {
     InstanceSettings::forceCreate(['id' => 0]);
     Notification::fake();
diff --git a/tests/Feature/ScheduledTaskCrossTeamIdorTest.php b/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
index b250db119b..bb5792ca07 100644
--- a/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
+++ b/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
@@ -60,8 +60,8 @@ describe('ScheduledTask locked properties', function () {
         expect($attributes)->not->toBeEmpty();
     });
 
-    test('Executions component task property has Locked attribute', function () {
-        $property = new ReflectionProperty(Executions::class, 'task');
+    test('Executions component task id property has Locked attribute', function () {
+        $property = new ReflectionProperty(Executions::class, 'taskId');
         $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
diff --git a/tests/Feature/ScheduledTaskDeleteTest.php b/tests/Feature/ScheduledTaskDeleteTest.php
new file mode 100644
index 0000000000..3834b7b0ef
--- /dev/null
+++ b/tests/Feature/ScheduledTaskDeleteTest.php
@@ -0,0 +1,99 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\Executions;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $privateKey->id]);
+    $this->destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+test('deleting a service scheduled task returns true so the confirmation modal does not refresh the deleted task', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'service_id' => $service->id,
+        'name' => 'nightly',
+        'command' => 'echo nightly',
+        'frequency' => 'daily',
+    ]);
+
+    Livewire::test(Show::class, ['resource' => $service, 'task' => $task])
+        ->call('delete')
+        ->assertReturned(true)
+        ->assertDispatched('scheduledTaskDeleted')
+        ->assertNoRedirect();
+
+    expect($task->fresh())->toBeNull();
+});
+
+test('deleting an application scheduled task returns true and closes the task modal', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $application->id,
+        'name' => 'nightly',
+        'command' => 'echo nightly',
+        'frequency' => 'daily',
+    ]);
+
+    Livewire::test(Show::class, ['resource' => $application, 'task' => $task])
+        ->call('delete')
+        ->assertReturned(true)
+        ->assertDispatched('scheduledTaskDeleted')
+        ->assertNoRedirect();
+
+    expect($task->fresh())->toBeNull();
+});
+
+test('the executions poll still works after its task is deleted while the page navigates away', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(Executions::class, ['taskId' => $task->id]);
+    $task->delete();
+
+    $component->call('refreshExecutions')->assertOk();
+});
diff --git a/tests/Feature/ScheduledTaskModalTest.php b/tests/Feature/ScheduledTaskModalTest.php
new file mode 100644
index 0000000000..5c73bdc053
--- /dev/null
+++ b/tests/Feature/ScheduledTaskModalTest.php
@@ -0,0 +1,102 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\All;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $this->application->id,
+        'name' => 'modal-task',
+        'command' => 'echo hello',
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+test('opening a task shows the editor modal', function () {
+    Livewire::test(All::class, ['resource' => $this->application])
+        ->call('openTask', $this->task->uuid)
+        ->assertSet('taskModalOpen', true)
+        ->assertSet('taskUuid', $this->task->uuid)
+        ->assertSeeLivewire(Show::class);
+});
+
+test('task uuid in the url opens the modal on load', function () {
+    Livewire::withQueryParams(['task_uuid' => $this->task->uuid])
+        ->test(All::class, ['resource' => $this->application])
+        ->assertSet('taskModalOpen', true)
+        ->assertSeeLivewire(Show::class);
+});
+
+test('a task of another resource cannot be opened', function () {
+    $otherTask = ScheduledTask::factory()->create(['team_id' => Team::factory()->create()->id]);
+
+    expect(fn () => Livewire::test(All::class, ['resource' => $this->application])
+        ->call('openTask', $otherTask->uuid))
+        ->toThrow(ModelNotFoundException::class);
+});
+
+test('deleting a task from the modal closes it', function () {
+    $list = Livewire::test(All::class, ['resource' => $this->application])
+        ->call('openTask', $this->task->uuid);
+
+    Livewire::test(Show::class, ['resource' => $this->application, 'task' => $this->task])
+        ->call('delete')
+        ->assertDispatched('scheduledTaskDeleted');
+
+    expect(ScheduledTask::find($this->task->id))->toBeNull();
+
+    $list->dispatch('scheduledTaskDeleted')
+        ->assertSet('taskModalOpen', false)
+        ->assertSet('taskUuid', '')
+        ->assertDontSee('modal-task');
+});
+
+test('old task page url redirects to the list with the modal open', function () {
+    $application = $this->application->load('environment.project');
+
+    $this->get(route('project.application.scheduled-tasks', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+        'task_uuid' => $this->task->uuid,
+    ]))->assertRedirect(route('project.application.scheduled-tasks.show', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+        'task_uuid' => $this->task->uuid,
+    ]));
+});
diff --git a/tests/Feature/Security/CommandInjectionSecurityTest.php b/tests/Feature/Security/CommandInjectionSecurityTest.php
index 60f5ae8c91..a5d97bdb98 100644
--- a/tests/Feature/Security/CommandInjectionSecurityTest.php
+++ b/tests/Feature/Security/CommandInjectionSecurityTest.php
@@ -1,8 +1,11 @@
 <?php
 
+use App\Actions\Service\StartService;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationSetting;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
 
@@ -937,8 +940,15 @@ describe('service application lifecycle command escaping', function () {
         expect($source)->toContain('escapeshellarg($workdir)')
             ->and($source)->toContain('escapeshellarg($composeFile)')
             ->and($source)->toContain('escapeshellarg($service->uuid)')
-            ->and($source)->toContain('escapeshellarg($composeServiceName)')
-            ->and($source)->toContain('escapeshellarg($service->destination->network)');
+            ->and($source)->toContain('escapeshellarg($composeServiceName)');
+    });
+
+    test('predefined network connect command escapes the container name', function () {
+        $service = (new Service)->forceFill(['uuid' => 'svc-uuid']);
+        $service->setRelation('destination', (new StandaloneDocker)->forceFill(['network' => 'coolify']));
+
+        expect(StartService::predefinedNetworkConnectCommand($service, 'app$(id)', []))
+            ->toContain(" 'app$(id)-svc-uuid' | grep -qxF 'coolify' || docker network connect --alias 'app$(id)-svc-uuid' 'coolify' 'app$(id)-svc-uuid' || echo 'Warning: Could not connect app$(id) to the coolify network.'");
     });
 
     test('service application restart and stop actions escape container names', function (string $path) {
diff --git a/tests/Feature/SentinelTokenValidationTest.php b/tests/Feature/SentinelTokenValidationTest.php
index 6c59952522..2416317c64 100644
--- a/tests/Feature/SentinelTokenValidationTest.php
+++ b/tests/Feature/SentinelTokenValidationTest.php
@@ -193,6 +193,30 @@ describe('ServerSetting::ensureSentinelUrl', function () {
             ->and($this->server->settings->fresh()->sentinel_custom_url)->toBe($url);
     });
 
+    it('replaces a local host gateway endpoint on any port, because the Coolify network firewall can block it', function (string $legacyUrl) {
+        $this->server->update(['ip' => 'host.docker.internal']);
+        DB::table('server_settings')->where('id', $this->server->settings->id)->update([
+            'sentinel_custom_url' => $legacyUrl,
+        ]);
+
+        $url = $this->server->settings->fresh()->ensureSentinelUrl();
+
+        expect($url)->toBe('http://coolify:8080')
+            ->and($this->server->settings->fresh()->sentinel_custom_url)->toBe($url);
+    })->with([
+        'custom APP_PORT' => 'http://host.docker.internal:8010',
+        'trailing slash' => 'http://host.docker.internal:8000/',
+        'uppercase host' => 'HTTP://Host.Docker.Internal:8010',
+    ]);
+
+    it('keeps a host gateway endpoint for a remote server', function () {
+        DB::table('server_settings')->where('id', $this->server->settings->id)->update([
+            'sentinel_custom_url' => 'http://host.docker.internal:8010',
+        ]);
+
+        expect($this->server->settings->fresh()->ensureSentinelUrl())->toBe('http://host.docker.internal:8010');
+    });
+
     it('preserves an explicit custom URL for the local server', function () {
         $this->server->update(['ip' => 'host.docker.internal']);
         DB::table('server_settings')->where('id', $this->server->settings->id)->update([
diff --git a/tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php b/tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php
new file mode 100644
index 0000000000..d57f68a4b5
--- /dev/null
+++ b/tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php
@@ -0,0 +1,49 @@
+<?php
+
+use App\Events\CloudflareTunnelChanged;
+use App\Listeners\CloudflareTunnelChangedNotification;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Sleep;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+    config()->set('constants.ssh.max_retries', 1);
+    config()->set('constants.ssh.mux_enabled', false);
+
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $this->server = Server::factory()->create([
+        'team_id' => $team->id,
+        'user' => 'ubuntu',
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+});
+
+it('uses sudo for the health check on a non-root server', function () {
+    Event::fake();
+    Sleep::fake();
+    Process::fake([
+        '*sudo docker inspect coolify-cloudflared*' => Process::result(output: 'true'),
+        '*' => Process::result(errorOutput: 'permission denied while trying to connect to the Docker API', exitCode: 1),
+    ]);
+
+    (new CloudflareTunnelChangedNotification)->handle(new CloudflareTunnelChanged([
+        'server_id' => $this->server->id,
+        'ssh_domain' => 'ssh.example.com',
+    ]));
+
+    expect($this->server->settings->refresh()->is_cloudflare_tunnel)->toBeTruthy()
+        ->and($this->server->refresh()->ip)->toBe('ssh.example.com');
+});
diff --git a/tests/Feature/ServerCanvasTest.php b/tests/Feature/ServerCanvasTest.php
index d8b4346103..cf8bd8878e 100644
--- a/tests/Feature/ServerCanvasTest.php
+++ b/tests/Feature/ServerCanvasTest.php
@@ -74,14 +74,18 @@ test('the servers canvas shows every server of the team with its resources and l
         ->assertJsonPath('positions', [])
         ->assertJsonPath('links.0.id', $link->uuid);
 
+    $resources = collect($response->json('nodes'))->where('type', '!=', 'empty');
+
+    // The project's empty production environment shows as a placeholder card on the server of its other environments.
     expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['db-server', 'web-server'])
         ->and(collect($response->json('nodes'))->mapWithKeys(fn ($node) => [$node['name'] => [$node['zone'], $node['context']]])->all())->toBe([
             'storefront' => [$this->web->uuid, 'Shop / staging'],
             'orders-api' => [$this->db->uuid, 'Shop / staging'],
+            'No resources yet' => [$this->web->uuid, 'Shop / production'],
         ])
         ->and($response->json('nodes.0.project'))->toBe(['uuid' => $this->project->uuid, 'name' => 'Shop'])
         ->and($response->json('nodes.0.environment'))->toBe(['uuid' => $this->environment->uuid, 'name' => 'staging'])
-        ->and(collect($response->json('nodes'))->pluck('context_link')->unique()->all())->toBe([
+        ->and($resources->pluck('context_link')->unique()->all())->toBe([
             route('project.resource.index', ['project_uuid' => $this->project->uuid, 'environment_uuid' => $this->environment->uuid]),
         ])
         ->and(collect($response->json('zones'))->pluck('link')->all())->toBe([
@@ -90,6 +94,17 @@ test('the servers canvas shows every server of the team with its resources and l
         ]);
 });
 
+test('the servers canvas puts empty environments of a project without resources on the first server', function () {
+    $bare = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Bare']);
+
+    $response = serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk();
+
+    expect(collect($response->json('zones'))->pluck('name')->all())->toBe(['db-server', 'web-server'])
+        ->and(collect($response->json('nodes'))->where('project.uuid', $bare->uuid)->pluck('zone')->all())->toBe([$this->db->uuid]);
+});
+
 test('one server canvas shows only that server, and links that leave it are hidden', function () {
     $app = serverCanvasApp($this->environment, $this->web, 'storefront');
     $api = serverCanvasApp($this->environment, $this->db, 'orders-api');
@@ -110,27 +125,27 @@ test('one server canvas shows only that server, and links that leave it are hidd
         ->assertJsonPath('links', []);
 });
 
-test('the server canvas uses the card positions saved on the environment canvas', function () {
+test('the server canvas sends the card positions saved on the environment canvas with each card', function () {
     $app = serverCanvasApp($this->environment, $this->web, 'storefront');
-    $api = serverCanvasApp($this->environment, $this->db, 'orders-api');
-    $this->environment->forceFill(['canvas_positions' => [
-        $app->uuid => ['x' => 120, 'y' => 40],
-        $api->uuid => ['x' => 480, 'y' => 40],
-        'deleted-resource' => ['x' => 0, 'y' => 0],
-    ]])->save();
+    $other = serverCanvasApp($this->environment, $this->web, 'checkout');
+    $this->environment->forceFill(['canvas_positions' => [$app->uuid => ['x' => 120, 'y' => 40]]])->save();
 
-    serverCanvasSession($this, $this->admin, $this->team)
+    $nodes = collect(serverCanvasSession($this, $this->admin, $this->team)
         ->getJson('/canvas/api/servers/canvas')
         ->assertOk()
-        ->assertJsonPath('positions', [
-            $app->uuid => ['x' => 120, 'y' => 40],
-            $api->uuid => ['x' => 480, 'y' => 40],
-        ]);
+        ->assertJsonPath('can_edit', true)
+        ->assertJsonPath('can_move', false)
+        ->assertJsonPath('positions', [])
+        ->json('nodes'))->keyBy('id');
+
+    expect($nodes[$app->uuid]['saved'])->toBe(['x' => 120, 'y' => 40])
+        ->and($nodes[$other->uuid]['saved'])->toBeNull();
 
     serverCanvasSession($this, $this->admin, $this->team)
         ->getJson("/canvas/api/servers/{$this->web->uuid}/canvas")
         ->assertOk()
-        ->assertJsonPath('positions', [$app->uuid => ['x' => 120, 'y' => 40]]);
+        ->assertJsonPath('can_move', false)
+        ->assertJsonPath('positions', []);
 });
 
 test('members see the server canvas without server IPs and cannot edit it', function () {
@@ -323,3 +338,58 @@ test('only the one server canvas points to the unmanaged containers of its serve
     serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$foreign->uuid}/canvas/containers")
         ->assertNotFound();
 });
+
+test('server zones show host facts, the proxy and a usage endpoint only when metrics can be read', function () {
+    $this->web->forceFill([
+        'server_metadata' => ['os' => 'Ubuntu 24.04', 'arch' => 'x86_64', 'cpus' => 4, 'memory_bytes' => 8589934592, 'uptime_since' => '2026-10-01 10:00:00'],
+        'proxy' => ['type' => 'TRAEFIK', 'status' => 'running'],
+    ])->save();
+    $this->web->settings->forceFill(['is_reachable' => true, 'is_metrics_enabled' => true])->saveQuietly();
+    $this->db->settings->forceFill(['is_reachable' => true, 'is_metrics_enabled' => false])->saveQuietly();
+    $this->db->forceFill(['proxy' => ['type' => 'NONE']])->save();
+
+    $zones = collect(serverCanvasSession($this, $this->admin, $this->team)
+        ->getJson('/canvas/api/servers/canvas')
+        ->assertOk()
+        ->json('zones'))->keyBy('name');
+
+    expect($zones['web-server']['details'])->toBe([
+        'os' => 'Ubuntu 24.04',
+        'arch' => 'x86_64',
+        'cpus' => 4,
+        'memory_bytes' => 8589934592,
+        'uptime_since' => '2026-10-01 10:00:00',
+        'proxy' => ['type' => 'TRAEFIK', 'status' => 'running'],
+        'usage_endpoint' => "/servers/{$this->web->uuid}/canvas/usage",
+    ])
+        ->and($zones['db-server']['details']['proxy'])->toBeNull()
+        ->and($zones['db-server']['details']['usage_endpoint'])->toBeNull();
+});
+
+test('the usage endpoint returns the latest Sentinel values and never another team server', function () {
+    $server = Mockery::mock($this->web)->makePartial();
+    $server->shouldReceive('getCpuMetrics')->andReturn([[1, 10.0], [2, 12.34]]);
+    $server->shouldReceive('getMemoryMetrics')->andReturn([[2, 40.0]]);
+    $server->shouldReceive('getDiskMetrics')->andThrow(new RuntimeException('no disk data'));
+
+    expect(app(ServerCanvas::class)->usage($server))->toBe(['cpu' => 12.3, 'memory' => 40.0, 'disk' => null]);
+
+    $this->web->settings->forceFill(['is_metrics_enabled' => false])->saveQuietly();
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$this->web->uuid}/canvas/usage")
+        ->assertOk()->assertExactJson(['cpu' => null, 'memory' => null, 'disk' => null]);
+
+    $otherTeam = Team::factory()->create(['show_boarding' => false]);
+    $foreign = Server::factory()->create(['team_id' => $otherTeam->id]);
+    serverCanvasSession($this, $this->admin, $this->team)->getJson("/canvas/api/servers/{$foreign->uuid}/canvas/usage")
+        ->assertNotFound();
+});
+
+test('only admins may move the environment groups on the server canvas', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    serverCanvasSession($this, $this->admin, $this->team)->getJson('/canvas/api/servers/canvas')
+        ->assertJsonPath('can_move_groups', true);
+    serverCanvasSession($this, $member, $this->team)->getJson('/canvas/api/servers/canvas')
+        ->assertJsonPath('can_move_groups', false);
+});
diff --git a/tests/Feature/ServerConnectionChangeClosesMuxTest.php b/tests/Feature/ServerConnectionChangeClosesMuxTest.php
new file mode 100644
index 0000000000..57ad88639b
--- /dev/null
+++ b/tests/Feature/ServerConnectionChangeClosesMuxTest.php
@@ -0,0 +1,40 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $this->server = Server::factory()->create(['team_id' => $team->id, 'private_key_id' => $privateKey->id, 'user' => 'root']);
+    Process::fake();
+});
+
+function closesServerMux(Server $server): Closure
+{
+    return fn ($process) => str_contains($process->command, 'ssh -O stop') && str_contains($process->command, "mux_{$server->uuid}");
+}
+
+it('closes the multiplexed SSH connection when the connection details change', function (array $changes) {
+    $this->server->update($changes);
+
+    Process::assertRan(closesServerMux($this->server));
+})->with([
+    'user' => [['user' => 'deploy']],
+    'ip' => [['ip' => '203.0.113.20']],
+    'port' => [['port' => 2222]],
+]);
+
+it('keeps the multiplexed SSH connection when other server fields change', function () {
+    $this->server->update(['name' => 'renamed', 'description' => 'changed']);
+
+    Process::assertDidntRun(closesServerMux($this->server));
+});
diff --git a/tests/Feature/ServerConnectionCheckIsolationTest.php b/tests/Feature/ServerConnectionCheckIsolationTest.php
index 771c4a832a..9d5b0b572b 100644
--- a/tests/Feature/ServerConnectionCheckIsolationTest.php
+++ b/tests/Feature/ServerConnectionCheckIsolationTest.php
@@ -5,6 +5,7 @@ use App\Models\CloudProviderToken;
 use App\Models\PrivateKey;
 use App\Models\Server;
 use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
@@ -243,3 +244,57 @@ it('gives the job enough time for every connection check step', function () {
     expect($job->timeout)->toBeGreaterThanOrEqual(ServerConnectionCheckJob::maximumCheckSeconds())
         ->and($lock->expiresAfter)->toBeGreaterThan($job->timeout);
 });
+
+it('stops managing a server when its owner marker names another instance', function () {
+    $server = createServerForConnectionIsolationTest([
+        'ip' => '203.0.113.10',
+        'server_metadata' => ['transfer' => ['status' => 'claimed', 'claim' => ['claim_id' => 'claim-of-this-instance']]],
+    ]);
+    $server->settings->update(['is_reachable' => true, 'is_usable' => true]);
+    Process::fake([
+        '*ls -la /*' => Process::result(output: '{"claim_id":"claim-of-instance-b","instance_url":"https://coolify-b.test"}', exitCode: 0),
+        '*' => Process::result(output: '{"Server":{"Version":"29.4.3"}}', exitCode: 0),
+    ]);
+
+    (new ServerConnectionCheckJob($server->fresh(), disableMux: false))->handle();
+
+    $server->refresh();
+    expect($server->isTransferredAway())->toBeTrue()
+        ->and(data_get($server->server_metadata, 'transfer.target_instance_url'))->toBe('https://coolify-b.test')
+        ->and((bool) $server->settings->force_disabled)->toBeTrue();
+    Process::assertDidntRun(fn ($process) => str_contains($process->command, 'docker version'));
+});
+
+it('keeps managing a server when its owner marker is its own claim', function () {
+    $server = createServerForConnectionIsolationTest([
+        'ip' => '203.0.113.10',
+        'server_metadata' => ['transfer' => ['status' => 'claimed', 'claim' => ['claim_id' => 'claim-of-this-instance']]],
+    ]);
+    Process::fake([
+        '*ls -la /*' => Process::result(output: '{"claim_id":"claim-of-this-instance"}', exitCode: 0),
+        '*compose*' => Process::result(output: 'v2.32.4', exitCode: 0),
+        '*' => Process::result(output: '{"Server":{"Version":"29.4.3"}}', exitCode: 0),
+    ]);
+
+    (new ServerConnectionCheckJob($server->fresh(), disableMux: false))->handle();
+
+    $server->refresh();
+    expect($server->isTransferredAway())->toBeFalse()
+        ->and((bool) $server->settings->is_usable)->toBeTrue();
+});
+
+it('passes the SSH probe on a server without an owner marker', function () {
+    // The remote shell runs the probe with `set -e`, like this.
+    $result = Process::input(ServerConnectionCheckJob::probeCommand())->run(['sh', '-se']);
+
+    expect(file_exists(ServerTransferClaimer::OWNER_MARKER_PATH))->toBeFalse()
+        ->and($result->exitCode())->toBe(0);
+});
+
+it('keeps the owner marker read elevated in the SSH probe on a non-root server', function () {
+    $server = createServerForConnectionIsolationTest(['user' => 'ubuntu']);
+
+    expect(parseCommandsByLineForSudo(collect([ServerConnectionCheckJob::probeCommand()]), $server))->toBe([
+        'sudo cat '.ServerTransferClaimer::OWNER_MARKER_PATH.' 2>/dev/null || sudo true; ls -la / > /dev/null',
+    ]);
+});
diff --git a/tests/Feature/ServerDangerMenuVisibilityTest.php b/tests/Feature/ServerDangerMenuVisibilityTest.php
index fde1e65b7d..2f6b687c15 100644
--- a/tests/Feature/ServerDangerMenuVisibilityTest.php
+++ b/tests/Feature/ServerDangerMenuVisibilityTest.php
@@ -39,7 +39,7 @@ test('danger menu is visible for non-coolify-host servers that use host.docker.i
 
     $this->get(route('server.show', ['server_uuid' => $server->uuid]))
         ->assertSuccessful()
-        ->assertSee('>Danger</', false)
+        ->assertSee('>Danger Zone</', false)
         ->assertSee(route('server.delete', ['server_uuid' => $server->uuid]), false);
 });
 
@@ -58,7 +58,6 @@ test('danger menu is hidden for the coolify host server', function () {
 
     $this->get(route('server.show', ['server_uuid' => $server->uuid]))
         ->assertSuccessful()
-        ->assertDontSee('>Danger</', false)
         ->assertDontSee(route('server.delete', ['server_uuid' => $server->uuid]), false);
 });
 
diff --git a/tests/Feature/ServerManagementOwnershipTest.php b/tests/Feature/ServerManagementOwnershipTest.php
index 66e34538f3..1081738c69 100644
--- a/tests/Feature/ServerManagementOwnershipTest.php
+++ b/tests/Feature/ServerManagementOwnershipTest.php
@@ -1,19 +1,28 @@
 <?php
 
 use App\Livewire\Server\Show;
+use App\Livewire\Server\TransferFinish;
+use App\Models\Application;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    config(['app.env' => 'local']);
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    config(['app.env' => 'production']);
+    $this->withoutVite();
     InstanceSettings::forceCreate([
         'id' => 0,
         'fqdn' => 'https://coolify-a.test',
@@ -32,40 +41,13 @@ beforeEach(function () {
     session(['currentTeam' => $this->team]);
 });
 
-test('owner can stop managing a server from this instance', function () {
-    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
-        ->assertDispatched('success');
-
-    $this->server->refresh();
-
-    expect($this->server->isTransferredAway())->toBeTrue()
-        ->and($this->server->isManagementDisabled())->toBeTrue()
-        ->and((bool) $this->server->settings->force_disabled)->toBeTrue()
-        ->and((bool) $this->server->settings->is_sentinel_enabled)->toBeFalse();
-});
-
-test('server with disabled management shows it is transferable, not transferred away', function () {
-    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
-        ->assertSee('Transferable to another instance')
-        ->assertSee(route('server.transfer', ['server_uuid' => $this->server->uuid]))
-        ->assertDontSee('Transferred to another instance')
-        ->assertDontSee('Transferred away')
-        ->assertDontSeeHtml('>Transferable<');
-});
-
-test('server transferred to another instance is not reported as management disabled', function () {
+test('server transferred to another instance shows where it was transferred', function () {
     app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
 
-    $this->server->refresh();
-
-    expect($this->server->isTransferredAway())->toBeTrue()
-        ->and($this->server->isManagementDisabled())->toBeFalse();
-
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
         ->assertSee('Transferred to another instance')
-        ->assertDontSee('Transferable to another instance');
+        ->assertSee('https://coolify-b.test')
+        ->assertSee('Enable management');
 });
 
 test('owner can take management of a transferred server', function () {
@@ -79,7 +61,7 @@ test('owner can take management of a transferred server', function () {
     ])->save();
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertDispatched('success');
 
     $this->server->refresh();
@@ -112,7 +94,7 @@ test('cloud team over its server limit cannot take management of a transferred s
     markServerTransferredAway($this->server);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertDispatched('error')
         ->assertNotDispatched('success');
 
@@ -128,7 +110,7 @@ test('cloud team within its server limit can take management of a transferred se
     markServerTransferredAway($this->server);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertDispatched('success');
 
     $this->server->refresh();
@@ -137,7 +119,7 @@ test('cloud team within its server limit can take management of a transferred se
         ->and((bool) $this->server->settings->force_disabled)->toBeFalse();
 });
 
-test('claiming a server keeps it force disabled when the cloud team is over its server limit', function () {
+test('claiming a server fails without changes when the cloud team is over its server limit', function () {
     config()->set('constants.coolify.self_hosted', false);
     $this->team->forceFill(['custom_server_limit' => 1])->save();
     Server::factory()->create([
@@ -146,15 +128,18 @@ test('claiming a server keeps it force disabled when the cloud team is over its
     ]);
     markServerTransferredAway($this->server);
 
-    app(ServerTransferClaimer::class)->claim($this->server);
+    expect(fn () => app(ServerTransferClaimer::class)->claim($this->server))
+        ->toThrow(RuntimeException::class, 'over its server limit');
 
     $this->server->refresh();
 
-    expect(data_get($this->server->server_metadata, 'transfer.status'))->toBe('claimed')
+    expect($this->server->isTransferredAway())->toBeTrue()
         ->and((bool) $this->server->settings->force_disabled)->toBeTrue();
+    Process::assertNothingRan();
 });
 
-test('team members cannot change server management ownership', function () {
+test('team members cannot take management of a transferred server', function () {
+    markServerTransferredAway($this->server);
     $member = User::factory()->create();
     $this->team->members()->attach($member, ['role' => 'member']);
 
@@ -162,27 +147,25 @@ test('team members cannot change server management ownership', function () {
     session(['currentTeam' => $this->team]);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->call('toggleManagement')
+        ->call('enableManagement')
         ->assertForbidden();
 
-    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+    expect($this->server->fresh()->isTransferredAway())->toBeTrue();
 });
 
-test('server overview shows a management button that matches the ownership state', function () {
+test('a managed server has no management button and cannot be disabled from the server page', function () {
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->assertSee('Disable management')
         ->assertDontSee('Enable management')
-        ->assertDontSeeHtml('wire:confirm')
-        ->call('toggleManagement', '')
-        ->assertSee('Enable management')
-        ->assertDontSee('Disable management');
+        ->assertDontSee('Disable management')
+        ->call('enableManagement')
+        ->assertNotDispatched('success');
+
+    expect(data_get($this->server->fresh()->server_metadata, 'transfer.status'))->toBeNull();
 });
 
-test('server validation button is hidden while management is disabled or transferred away', function () {
+test('server validation button is hidden while the server is transferred away', function () {
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->assertSeeHtml('wire:click.prevent="validateServer"')
-        ->call('toggleManagement')
-        ->assertDontSeeHtml('wire:click.prevent="validateServer"');
+        ->assertSeeHtml('wire:click.prevent="validateServer"');
 
     app(ServerTransferClaimer::class)->markTransferred($this->server->fresh(), targetInstanceUrl: 'https://coolify-b.test');
 
@@ -190,13 +173,37 @@ test('server validation button is hidden while management is disabled or transfe
         ->assertDontSeeHtml('wire:click.prevent="validateServer"');
 });
 
-test('management ownership is not available outside development', function () {
-    config(['app.env' => 'production']);
+test('taking back a transferred server fails without changes when the host cannot be reached', function () {
+    markServerTransferredAway($this->server);
+    Process::fake(['*' => Process::result(errorOutput: 'Connection refused', exitCode: 1)]);
 
     Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
-        ->assertDontSee('Disable management')
-        ->call('toggleManagement')
-        ->assertNotFound();
+        ->call('enableManagement')
+        ->assertNotDispatched('success');
 
-    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+    $this->server->refresh();
+
+    expect($this->server->isTransferredAway())->toBeTrue()
+        ->and((bool) $this->server->settings->force_disabled)->toBeTrue();
+});
+
+test('after a take back the server page shows the finish list until the user finishes the transfer', function () {
+    markServerTransferredAway($this->server);
+    Application::factory()->create([
+        'name' => 'shop',
+        'destination_id' => $this->server->standaloneDockers()->first()->id,
+        'destination_type' => StandaloneDocker::class,
+        'git_repository' => 'https://github.com/coollabsio/coolify',
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->call('enableManagement')
+        ->assertDispatched('transferFinishStarted');
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server->fresh()])
+        ->assertSee('Finish the transfer')
+        ->assertSee('Manual webhook of shop')
+        ->call('finishTransfer')
+        ->assertDontSee('Finish the transfer');
+    expect(data_get($this->server->fresh()->server_metadata, 'transfer.finish.finished_at'))->not->toBeNull();
 });
diff --git a/tests/Feature/ServerMetadataTest.php b/tests/Feature/ServerMetadataTest.php
index e4cbb5ed6e..ec33d4f0e8 100644
--- a/tests/Feature/ServerMetadataTest.php
+++ b/tests/Feature/ServerMetadataTest.php
@@ -128,6 +128,35 @@ it('stores a parsed docker version when gathering server metadata', function ()
         ->and($this->server->fresh()->composeVersion())->toBe('2.32.4');
 });
 
+it('keeps transfer and migration state when gathering server metadata', function () {
+    $this->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+    // Loaded before the transfer state is written, like a validation that runs during a transfer.
+    $staleServer = Server::find($this->server->id);
+
+    $this->server->update(['server_metadata' => [
+        'os' => 'Old OS',
+        'transfer' => ['status' => 'claimed', 'export_id' => 'export-1'],
+        'migration' => ['status' => 'succeeded', 'export_id' => 'export-1'],
+    ]]);
+
+    Process::fake([
+        '*' => Process::result(output: "---PRETTY_NAME---\nDebian GNU/Linux 12 (bookworm)\n---CPUS---\n2", exitCode: 0),
+    ]);
+
+    $staleServer->gatherServerMetadata();
+
+    expect($this->server->fresh()->server_metadata)
+        ->toMatchArray([
+            'os' => 'Debian GNU/Linux 12 (bookworm)',
+            'cpus' => 2,
+            'transfer' => ['status' => 'claimed', 'export_id' => 'export-1'],
+            'migration' => ['status' => 'succeeded', 'export_id' => 'export-1'],
+        ]);
+});
+
 it('shows the stored docker version in remote server details', function () {
     $this->server->update([
         'server_metadata' => [
diff --git a/tests/Feature/ServerNavbarStatusVisibilityTest.php b/tests/Feature/ServerNavbarStatusVisibilityTest.php
index b524064fea..fddef90107 100644
--- a/tests/Feature/ServerNavbarStatusVisibilityTest.php
+++ b/tests/Feature/ServerNavbarStatusVisibilityTest.php
@@ -1,17 +1,20 @@
 <?php
 
+use App\Enums\ProxyTypes;
 use App\Livewire\Server\Navbar;
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
+use App\Services\ProxyDashboardCacheService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create(['id' => 0]);
+    InstanceSettings::forceCreate(['id' => 0]);
 });
 
 function makeNavbarServer(bool $isFunctional): array
@@ -98,3 +101,35 @@ it('refreshes sentinel status when sentinel restarts for the server', function (
         ->assertDontSee('Out of sync')
         ->assertDispatched('sentinel-status-changed');
 });
+
+it('does not render the floating action panel when the server has no proxy actions', function () {
+    [$server] = makeNavbarServer(isFunctional: false);
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->assertDontSeeHtml('x-teleport="#resource-action-hud-slot"');
+});
+
+it('renders the floating action panel with proxy actions for a functional server', function () {
+    [$server] = makeNavbarServer(isFunctional: true);
+    $server->forceFill(['proxy' => ['type' => ProxyTypes::TRAEFIK->value]])->save();
+    $server = $server->fresh();
+
+    expect($server->proxySet())->toBeTrue();
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->assertSeeHtml('x-teleport="#resource-action-hud-slot"')
+        ->assertSee('Refresh Proxy Status');
+});
+
+it('shows the Traefik dashboard link without proxy actions to members who cannot manage the proxy', function () {
+    [$server, $user, $team] = makeNavbarServer(isFunctional: true);
+    $user->teams()->updateExistingPivot($team->id, ['role' => 'member']);
+    $server->forceFill(['proxy' => ['type' => ProxyTypes::TRAEFIK->value, 'status' => 'running']])->save();
+    $server = $server->fresh();
+    Cache::put(ProxyDashboardCacheService::getCacheKey($server), true);
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->assertSeeHtml('x-teleport="#resource-action-hud-slot"')
+        ->assertSee('Traefik Dashboard')
+        ->assertDontSee('Refresh Proxy Status');
+});
diff --git a/tests/Feature/ServerTransferPreviewOwnershipTest.php b/tests/Feature/ServerTransferPreviewOwnershipTest.php
index 03cabfa874..87e2b6de29 100644
--- a/tests/Feature/ServerTransferPreviewOwnershipTest.php
+++ b/tests/Feature/ServerTransferPreviewOwnershipTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\InstanceSettings;
@@ -15,12 +16,15 @@ use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\ValidationException;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     config()->set('app.env', 'local');
     config()->set('app.maintenance.driver', 'file');
     Server::flushIdentityMap();
@@ -80,7 +84,7 @@ test('preview imports reject another team UUID and roll back all imported record
     $token->accessToken->forceFill(['team_id' => $team->id])->save();
     $counts = [Server::count(), Application::withTrashed()->count(), PrivateKey::count(), Project::count()];
 
-    $this->withToken($token->plainTextToken)->postJson('/api/v1/servers/import', ['bundle' => $bundle])
+    $this->withToken($token->plainTextToken)->postJson('/api/v1/servers/import', ['bundle' => $bundle, 'adopt_mode' => false])
         ->assertUnprocessable()
         ->assertJsonValidationErrors('previews');
 
@@ -103,7 +107,7 @@ test('preview imports reject another team domain without clearing it', function
     $serverCount = Server::count();
 
     try {
-        app(ServerTransferImporter::class)->import($bundle, $team->id, preserveUuids: $preserveUuids);
+        app(ServerTransferImporter::class)->import($bundle, $team->id, preserveUuids: $preserveUuids, adoptMode: false);
         $this->fail('A foreign preview domain must be rejected.');
     } catch (ValidationException $exception) {
         expect($exception->errors())->toHaveKey('previews');
@@ -130,7 +134,7 @@ test('preview imports preserve same-team UUID handoffs and preview volumes', fun
         'mount_path' => '/data',
     ]);
 
-    $result = app(ServerTransferImporter::class)->import($fixture['bundle'], $team->id);
+    $result = app(ServerTransferImporter::class)->import($fixture['bundle'], $team->id, adoptMode: false);
 
     $imported = Server::whereUuid($result['server_uuid'])->firstOrFail()->applications()->firstOrFail();
     expect($preview->fresh()->application_id)->toBe($imported->id)
@@ -146,7 +150,7 @@ test('preview imports can release a same-team domain collision', function () {
     $bundle = $fixture['bundle'];
     $bundle['projects'][0]['environments'][0]['applications'][0]['previews'][0]['uuid'] = new_public_id();
 
-    $result = app(ServerTransferImporter::class)->import($bundle, $team->id);
+    $result = app(ServerTransferImporter::class)->import($bundle, $team->id, adoptMode: false);
 
     $imported = Server::whereUuid($result['server_uuid'])->firstOrFail()->applications()->firstOrFail();
     expect($fixture['preview']->fresh()->fqdn)->toBeNull();
diff --git a/tests/Feature/ServiceComposeStdinTest.php b/tests/Feature/ServiceComposeStdinTest.php
index f5d48e9a15..a45772ad22 100644
--- a/tests/Feature/ServiceComposeStdinTest.php
+++ b/tests/Feature/ServiceComposeStdinTest.php
@@ -36,7 +36,7 @@ afterEach(function () {
     File::deleteDirectory($this->stubDirectory);
 });
 
-function serviceComposeStdinService(string $sshUser): Service
+function serviceComposeStdinService(string $sshUser, ?string $composeRaw = null): Service
 {
     $team = Team::factory()->create();
     $server = Server::factory()->create([
@@ -54,7 +54,7 @@ function serviceComposeStdinService(string $sshUser): Service
         'destination_id' => $destination->id,
         'destination_type' => $destination->getMorphClass(),
         'connect_to_docker_network' => true,
-        'docker_compose_raw' => "services:\n  app:\n    image: busybox:latest\n    volumes:\n      - data:/data\nvolumes:\n  data:\n    labels:\n      example: changed\n",
+        'docker_compose_raw' => $composeRaw ?? "services:\n  app:\n    image: busybox:latest\n    volumes:\n      - data:/data\nvolumes:\n  data:\n    labels:\n      example: changed\n",
     ]);
 }
 
@@ -66,7 +66,7 @@ function serviceComposeStdinService(string $sshUser): Service
  *
  * @return list<string> the commands that ran, and the lines the prompt consumed
  */
-function runServiceScriptLikeSsh(string $script, string $stubDirectory): array
+function runServiceScriptLikeSsh(string $script, string $stubDirectory, string $connectedNetworks = ''): array
 {
     File::ensureDirectoryExists($stubDirectory);
     $log = "{$stubDirectory}/calls.log";
@@ -74,6 +74,9 @@ function runServiceScriptLikeSsh(string $script, string $stubDirectory): array
 #!/bin/sh
 echo "docker $*" >> "$STUB_LOG"
 case " $* " in
+  *" container inspect "*)
+    printf '%s\n' $STUB_CONNECTED_NETWORKS
+    ;;
   *" compose "*" up "*|*" compose "*" pull"*)
     if IFS= read -r answer; then echo "prompt read: $answer" >> "$STUB_LOG"; fi
     ;;
@@ -86,7 +89,7 @@ SH);
         chmod("{$stubDirectory}/{$stub}", 0755);
     }
 
-    $process = new SymfonyProcess(['bash', '-se'], env: ['PATH' => $stubDirectory.':'.getenv('PATH'), 'STUB_LOG' => $log], input: $script."\n", timeout: 30);
+    $process = new SymfonyProcess(['bash', '-se'], env: ['PATH' => $stubDirectory.':'.getenv('PATH'), 'STUB_LOG' => $log, 'STUB_CONNECTED_NETWORKS' => $connectedNetworks], input: $script."\n", timeout: 30);
     $process->run();
 
     expect($process->isSuccessful())->toBeTrue($process->getErrorOutput());
@@ -98,7 +101,7 @@ function serviceComposeCommandLines(Activity $activity): array
 {
     return array_values(array_filter(
         explode("\n", RemoteProcessCommand::read($activity)),
-        fn (string $line) => str_contains($line, 'docker compose ') && (str_contains($line, ' up -d') || str_contains($line, ' pull')),
+        fn (string $line) => str_contains($line, 'docker compose ') && (str_contains($line, ' up -d') || str_contains($line, ' pull') || str_contains($line, ' start')),
     ));
 }
 
@@ -130,7 +133,7 @@ it('gives service compose up and pull no stdin and never answers the recreate pr
 
     $lines = serviceComposeCommandLines(StartService::run($service, pullLatestImages: true));
 
-    expect($lines)->toHaveCount(2);
+    expect($lines)->toHaveCount(3);
     foreach ($lines as $line) {
         expect($line)->toStartWith('sudo docker compose ')
             ->toEndWith(' < /dev/null')
@@ -138,3 +141,62 @@ it('gives service compose up and pull no stdin and never answers the recreate pr
             ->not->toContain(' -y ');
     }
 });
+
+/**
+ * @param  list<string>  $calls
+ */
+function serviceComposeCallIndex(array $calls, string ...$needles): int
+{
+    foreach ($calls as $index => $call) {
+        if (collect($needles)->every(fn (string $needle) => str_contains($call, $needle))) {
+            return $index;
+        }
+    }
+
+    throw new RuntimeException('No call contains: '.implode(', ', $needles));
+}
+
+it('connects service containers to the predefined network before compose starts them', function (string $sshUser) {
+    $compose = "services:\n  db:\n    image: busybox:latest\n    healthcheck:\n      test: ['CMD-SHELL', 'true']\n  app:\n    image: busybox:latest\n    depends_on:\n      db:\n        condition: service_healthy\n";
+    $service = serviceComposeStdinService($sshUser, $compose);
+
+    $calls = runServiceScriptLikeSsh(RemoteProcessCommand::read(StartService::run($service)), $this->stubDirectory);
+
+    $create = serviceComposeCallIndex($calls, ' compose ', ' up -d ', ' --no-start');
+    $start = serviceComposeCallIndex($calls, ' compose ', " --project-name {$service->uuid} start");
+    foreach (['db', 'app'] as $name) {
+        $connect = serviceComposeCallIndex($calls, "docker network connect --alias {$name}-{$service->uuid} coolify {$name}-{$service->uuid}");
+        expect($connect)->toBeGreaterThan($create)->toBeLessThan($start);
+    }
+})->with(['root' => 'root', 'non-root' => 'deploy']);
+
+it('does not connect a running service container that is already on the predefined network', function (string $sshUser) {
+    $service = serviceComposeStdinService($sshUser);
+    $service->parse();
+
+    $calls = runServiceScriptLikeSsh(RemoteProcessCommand::read(DeployServiceApplication::run($service->applications()->firstOrFail())), $this->stubDirectory, connectedNetworks: "{$service->uuid} coolify");
+
+    expect(collect($calls)->filter(fn (string $call) => str_contains($call, 'network connect --alias'))->all())->toBe([]);
+})->with(['root' => 'root', 'non-root' => 'deploy']);
+
+it('does not connect containers that use a network mode', function () {
+    $compose = "services:\n  vpn:\n    image: busybox:latest\n  app:\n    image: busybox:latest\n    network_mode: service:vpn\n";
+    $service = serviceComposeStdinService('root', $compose);
+
+    $calls = runServiceScriptLikeSsh(RemoteProcessCommand::read(StartService::run($service)), $this->stubDirectory);
+
+    expect(collect($calls)->filter(fn (string $call) => str_contains($call, 'network connect --alias'))->values()->all())
+        ->toBe(["docker network connect --alias vpn-{$service->uuid} coolify vpn-{$service->uuid}"]);
+});
+
+it('connects a single service container to the predefined network before it starts', function (string $sshUser) {
+    $service = serviceComposeStdinService($sshUser);
+    $service->parse();
+
+    $calls = runServiceScriptLikeSsh(RemoteProcessCommand::read(DeployServiceApplication::run($service->applications()->firstOrFail())), $this->stubDirectory);
+
+    $create = serviceComposeCallIndex($calls, ' compose ', ' up -d --no-deps --no-start app');
+    $connect = serviceComposeCallIndex($calls, "docker network connect --alias app-{$service->uuid} coolify app-{$service->uuid}");
+    $start = serviceComposeCallIndex($calls, "docker start app-{$service->uuid}");
+    expect($connect)->toBeGreaterThan($create)->toBeLessThan($start);
+})->with(['root' => 'root', 'non-root' => 'deploy']);
diff --git a/tests/Feature/ServiceConnectToDockerNetworkApiTest.php b/tests/Feature/ServiceConnectToDockerNetworkApiTest.php
new file mode 100644
index 0000000000..1753a20d34
--- /dev/null
+++ b/tests/Feature/ServiceConnectToDockerNetworkApiTest.php
@@ -0,0 +1,78 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Testing\TestResponse;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0, 'is_api_enabled' => true]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->bearerToken = $this->user->createToken('test-token', ['*'])->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $this->project->environments()->first();
+});
+
+function createServiceWithDockerNetworkFlag(mixed $connectToDockerNetwork, string $bearerToken, array $payload): TestResponse
+{
+    return test()->withHeaders(['Authorization' => 'Bearer '.$bearerToken])
+        ->postJson('/api/v1/services', [
+            ...$payload,
+            'connect_to_docker_network' => $connectToDockerNetwork,
+        ]);
+}
+
+describe('POST /api/v1/services connect_to_docker_network', function () {
+    test('saves the flag for a docker_compose_raw service', function () {
+        $response = createServiceWithDockerNetworkFlag(true, $this->bearerToken, [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'docker_compose_raw' => base64_encode("services:\n  app:\n    image: nginx:alpine\n"),
+        ]);
+
+        $response->assertCreated();
+        expect(Service::whereUuid($response->json('uuid'))->firstOrFail()->connect_to_docker_network)->toBeTruthy();
+    });
+
+    test('saves the flag for a one-click service', function () {
+        Queue::fake();
+
+        $response = createServiceWithDockerNetworkFlag(true, $this->bearerToken, [
+            'type' => 'cyberchef',
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+        ]);
+
+        $response->assertCreated();
+        expect(Service::whereUuid($response->json('uuid'))->firstOrFail()->connect_to_docker_network)->toBeTruthy();
+    });
+
+    test('rejects a non-boolean value', function () {
+        $response = createServiceWithDockerNetworkFlag('not-a-boolean', $this->bearerToken, [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'docker_compose_raw' => base64_encode("services:\n  app:\n    image: nginx:alpine\n"),
+        ]);
+
+        $response->assertUnprocessable()->assertJsonValidationErrors(['connect_to_docker_network']);
+        expect($response->json('errors.connect_to_docker_network'))->not->toContain('This field is not allowed.');
+    });
+});
diff --git a/tests/Feature/ServiceHeadingStatusTest.php b/tests/Feature/ServiceHeadingStatusTest.php
index 9cd0488e2d..fb4678ad2f 100644
--- a/tests/Feature/ServiceHeadingStatusTest.php
+++ b/tests/Feature/ServiceHeadingStatusTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Project\Service\Heading as ServiceHeading;
+use App\Livewire\Project\Service\ResourceCard;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -81,3 +82,17 @@ test('the heading shows the service status when no resource is selected', functi
         ->assertSeeInOrder(['Service status', 'Containers', 'Healthcheck'])
         ->assertSee('Degraded');
 });
+
+test('a compose resource row shows the new status when the service status changes', function () {
+    $component = Livewire::test(ResourceCard::class, [
+        'service' => $this->service->fresh(),
+        'resource' => $this->exitedApp->fresh(),
+        'parameters' => $this->parameters,
+    ])->assertSee('Exited');
+
+    $this->exitedApp->forceFill(['status' => 'running:healthy'])->save();
+
+    $component->dispatch("echo-private:team.{$this->team->id},ServiceStatusChanged")
+        ->assertSee('Running')
+        ->assertDontSee('Exited');
+});
diff --git a/tests/Feature/ServiceParserReferenceTest.php b/tests/Feature/ServiceParserReferenceTest.php
new file mode 100644
index 0000000000..fb7a0aed60
--- /dev/null
+++ b/tests/Feature/ServiceParserReferenceTest.php
@@ -0,0 +1,428 @@
+<?php
+
+/**
+ * Golden test for the compose parsers (serviceParser + updateCompose, and applicationParser), latest compose
+ * parsing version only.
+ *
+ * Every case parses a compose file in three steps, the same way the UI does:
+ *   1. deploy (create + start parse the compose twice),
+ *   2. custom domains: each generated host becomes <name>.example.com, paths are kept (shared hosts stay shared),
+ *   3. a domain saved on each application that had none (for example a worker that copies a declaration).
+ * The result (domains, environment variable rows, storages, generated compose with proxy labels, or the error)
+ * is compared with tests/Fixtures/parser/expected/<case>.yaml.
+ *
+ * Cases: tests/Fixtures/parser/service-reference.yaml (one service per parser feature) with server and
+ * application setting variations, an error-path fixture, and every template in templates/compose (also the
+ * `# ignore: true` ones: existing services can still use them).
+ *
+ * Applications: tests/Fixtures/parser/application-reference.yaml (Docker Compose build pack) in three steps:
+ * deploy, custom domains on the General page, and pull request preview deployments.
+ *
+ * Only the reference expected files are committed. Template expected files are gitignored: when one is missing,
+ * the case only checks that the template parses without an error, and it writes the file.
+ *
+ * Before/after check of a parser change for every template:
+ *   ./scripts/parser-snapshot-diff save       (before the change)
+ *   ./scripts/parser-snapshot-diff baseline   (after the change; or: ./scripts/parser-snapshot-diff <git-ref>)
+ * When a change of the reference output is intended, regenerate the files and review the diff:
+ *   UPDATE_PARSER_SNAPSHOTS=1 php artisan test --compact tests/Feature/ServiceParserReferenceTest.php
+ */
+
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Carbon\CarbonImmutable;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Every volume dispatches a job that reads files over SSH.
+    Bus::fake();
+    Queue::fake();
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+});
+
+it('parses the compose exactly as recorded', function (string $composePath, ?string $serviceType, array $options, string $expectedName) {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id, 'name' => 'reference-server', 'ip' => '10.0.0.1']);
+    $server->settings->update($options['server'] ?? []);
+    if (isset($options['proxy'])) {
+        $server->proxy->set('type', $options['proxy']);
+        $server->save();
+    }
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id, 'name' => 'Reference Project']);
+    $environment = Environment::where('project_id', $project->id)->where('name', 'production')->first()
+        ?? Environment::factory()->create(['project_id' => $project->id, 'name' => 'production']);
+    SharedEnvironmentVariable::create([
+        'key' => 'SHARED_KEY', 'value' => 'shared-value', 'type' => 'environment',
+        'team_id' => $team->id, 'project_id' => $project->id, 'environment_id' => $environment->id,
+    ]);
+
+    $service = Service::factory()->create([
+        'name' => 'reference',
+        'service_type' => $serviceType,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => file_get_contents(base_path($composePath)),
+    ]);
+    $service->forceFill(['uuid' => 'referenceservice00000001'])->save();
+
+    // A user converted these compose services to the other type before the first parse.
+    foreach ($options['migrated'] ?? [] as $name => $type) {
+        ($type === 'database' ? ServiceDatabase::class : ServiceApplication::class)::create(['name' => $name, 'service_id' => $service->id, 'is_migrated' => true]);
+    }
+
+    $snapshot = [];
+    $step = function (string $label, Closure $before) use ($service, &$snapshot): bool {
+        try {
+            $before();
+            $snapshot[$label] = serviceParserReferenceSnapshot($service->fresh(), $service->fresh()->parse());
+
+            return true;
+        } catch (Throwable $e) {
+            $snapshot[$label] = ['error' => class_basename($e).': '.$e->getMessage()];
+
+            return false;
+        }
+    };
+    $saveDomain = function (ServiceApplication $application, string $fqdn): void {
+        $application->fqdn = $fqdn;
+        $application->save();
+        updateCompose($application->fresh());
+    };
+
+    // Step 1: create + deploy (Create.php parses once, StartService parses again), then application settings.
+    $deployed = $step('1_deploy', function () use ($service, $options) {
+        $service->fresh()->parse();
+        foreach ($options['applications'] ?? [] as $name => $settings) {
+            $application = $service->applications()->where('name', $name)->firstOrFail();
+            $noindex = data_get($settings, 'noindex');
+            unset($settings['noindex']);
+            $application->fill($settings);
+            if ($noindex) {
+                $application->setNoindexDomains(explode(',', (string) $application->fqdn));
+            }
+            $application->save();
+        }
+    });
+
+    if ($deployed) {
+        // Step 2: custom domains saved like the Domains page does (save fqdn, updateCompose, parse).
+        $step('2_custom_domains', function () use ($service, $saveDomain) {
+            foreach ($service->fresh()->applications()->whereNotNull('fqdn')->where('fqdn', '!=', '')->orderBy('name')->get() as $application) {
+                $saveDomain($application, serviceParserReferenceCustomDomains($application->fqdn));
+            }
+        });
+
+        // Step 3: a domain saved on each application without one; copies must not move the shared variables.
+        $step('3_domain_on_applications_without_one', function () use ($service, $saveDomain) {
+            foreach ($service->fresh()->applications()->orderBy('name')->get()->filter(fn ($application) => blank($application->fqdn)) as $application) {
+                $saveDomain($application, "https://{$application->name}-extra.example.com");
+            }
+        });
+    }
+
+    $actual = Yaml::dump(serviceParserReferenceNormalize($service->fresh(), $snapshot), 12, 2, Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK);
+    $expectedPath = base_path("tests/Fixtures/parser/expected/{$expectedName}.yaml");
+
+    if (getenv('UPDATE_PARSER_SNAPSHOTS') || ! file_exists($expectedPath)) {
+        @mkdir(dirname($expectedPath), 0755, true);
+        file_put_contents($expectedPath, $actual);
+    }
+
+    expect($actual)->toBe(file_get_contents($expectedPath));
+})->with(fn () => serviceParserReferenceCases());
+
+it('parses the application compose exactly as recorded', function (array $options, string $expectedName) {
+    // Production container names of compose applications end with the deployment time.
+    $this->travelTo(CarbonImmutable::parse('2026-01-02 03:04:05'));
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id, 'name' => 'reference-server', 'ip' => '10.0.0.1']);
+    $server->settings->update($options['server'] ?? []);
+    if (isset($options['proxy'])) {
+        $server->proxy->set('type', $options['proxy']);
+        $server->save();
+    }
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id, 'name' => 'Reference Project']);
+    $environment = Environment::where('project_id', $project->id)->where('name', 'production')->first()
+        ?? Environment::factory()->create(['project_id' => $project->id, 'name' => 'production']);
+    SharedEnvironmentVariable::create([
+        'key' => 'SHARED_KEY', 'value' => 'shared-value', 'type' => 'environment',
+        'team_id' => $team->id, 'project_id' => $project->id, 'environment_id' => $environment->id,
+    ]);
+
+    $application = Application::factory()->create([
+        'name' => 'reference',
+        'build_pack' => 'dockercompose',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => file_get_contents(base_path('tests/Fixtures/parser/application-reference.yaml')),
+        'preview_url_template' => '{{pr_id}}.{{domain}}',
+        'git_branch' => 'main',
+    ]);
+    $application->forceFill(['uuid' => 'referenceapplication0001'])->save();
+    $application->settings->update($options['settings'] ?? []);
+    $commit = 'abcdef0123456789abcdef0123456789abcdef01';
+
+    $snapshot = [];
+    $step = function (string $label, Closure $parse) use ($application, &$snapshot): void {
+        try {
+            $compose = $parse();
+            $snapshot[$label] = serviceParserReferenceApplicationSnapshot($application->fresh(), $compose);
+        } catch (Throwable $e) {
+            $snapshot[$label] = ['error' => class_basename($e).': '.$e->getMessage()];
+        }
+    };
+
+    // Step 1: first deploy (the parser fills docker_compose_domains from SERVICE_URL_/SERVICE_FQDN_ declarations).
+    $step('1_deploy', fn () => $application->fresh()->parse(commit: $commit));
+
+    // Step 2: custom domains saved on the General page: one per service, shared paths kept.
+    $step('2_custom_domains', function () use ($application, $commit) {
+        $application = $application->fresh();
+        $domains = collect(json_decode($application->docker_compose_domains ?: '[]', true))
+            ->map(fn (array $entry) => ['domain' => filled($entry['domain'] ?? null) ? serviceParserReferenceCustomDomains($entry['domain']) : null])
+            ->put('api.v2', ['domain' => 'https://api-v2.example.com'])
+            ->put('api', ['domain' => 'https://www.api.example.com', 'redirect' => 'non-www'])
+            ->all();
+        $application->docker_compose_domains = json_encode($domains);
+        $application->save();
+
+        return $application->fresh()->parse(commit: $commit);
+    });
+
+    // Step 3: pull request deployment (preview domains from preview_url_template, preview volume names).
+    $step('3_preview', function () use ($application, $commit) {
+        $preview = ApplicationPreview::create([
+            'uuid' => 'referencepreview00000001',
+            'application_id' => $application->id,
+            'pull_request_id' => 7,
+            'pull_request_html_url' => 'https://github.com/example/repository/pull/7',
+        ]);
+        // The pull request webhook and ApplicationDeploymentJob generate the preview domains before the parse.
+        $preview->generate_preview_fqdn_compose();
+
+        return $application->fresh()->parse(pull_request_id: 7, preview_id: $preview->id, commit: $commit);
+    });
+
+    // Step 4: preview without generated preview domains: the parser generates them from the application domains.
+    $step('4_preview_without_generated_domains', function () use ($application, $commit) {
+        $preview = ApplicationPreview::create([
+            'uuid' => 'referencepreview00000002',
+            'application_id' => $application->id,
+            'pull_request_id' => 8,
+            'pull_request_html_url' => 'https://github.com/example/repository/pull/8',
+        ]);
+
+        return $application->fresh()->parse(pull_request_id: 8, preview_id: $preview->id, commit: $commit);
+    });
+
+    $actual = Yaml::dump(serviceParserReferenceApplicationNormalize($application->fresh(), $snapshot), 12, 2, Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK);
+    $expectedPath = base_path("tests/Fixtures/parser/expected/{$expectedName}.yaml");
+
+    if (getenv('UPDATE_PARSER_SNAPSHOTS') || ! file_exists($expectedPath)) {
+        file_put_contents($expectedPath, $actual);
+    }
+
+    expect($actual)->toBe(file_get_contents($expectedPath));
+})->with([
+    'application' => [[], 'application'],
+    'application with exact traefik labels' => [['proxy' => 'TRAEFIK', 'server' => ['generate_exact_labels' => true]], 'application-with-exact-traefik-labels'],
+    'application with exact caddy labels' => [['proxy' => 'CADDY', 'server' => ['generate_exact_labels' => true]], 'application-with-exact-caddy-labels'],
+    'application with settings' => [[
+        'server' => ['is_logdrain_custom_enabled' => true],
+        'settings' => ['is_gzip_enabled' => false, 'is_stripprefix_enabled' => false, 'is_container_label_escape_enabled' => false, 'is_log_drain_enabled' => true, 'connect_to_docker_network' => true],
+    ], 'application-with-settings'],
+]);
+
+/**
+ * @return array<string, mixed>
+ */
+function serviceParserReferenceApplicationSnapshot(Application $application, Collection $compose): array
+{
+    return [
+        'docker_compose_domains' => json_decode($application->docker_compose_domains ?: '[]', true),
+        'previews' => $application->previews()->orderBy('pull_request_id')->get()
+            ->mapWithKeys(fn (ApplicationPreview $preview) => [$preview->pull_request_id => array_filter([
+                'fqdn' => $preview->fqdn,
+                'docker_compose_domains' => json_decode($preview->docker_compose_domains ?: '[]', true),
+            ])])->all(),
+        'volumes' => $application->persistentStorages()->orderBy('name')->get()
+            ->map(fn ($volume) => "{$volume->name}:{$volume->mount_path}")->all(),
+        'files' => $application->fileStorages()->orderBy('mount_path')->get()
+            ->map(fn ($file) => array_filter([
+                'fs_path' => $file->fs_path,
+                'mount_path' => $file->mount_path,
+                'is_directory' => (bool) $file->is_directory,
+                'content' => $file->content,
+            ], fn ($value) => $value !== null))->all(),
+        'environment_variables' => $application->environment_variables()->orderBy('key')->get()->mapWithKeys(fn ($variable) => [
+            $variable->key => $variable->is_required ? ['value' => $variable->value, 'required' => true] : $variable->value,
+        ])->all(),
+        'compose' => $compose->toArray(),
+    ];
+}
+
+/**
+ * @param  array<string, mixed>  $snapshot
+ * @return array<string, mixed>
+ */
+function serviceParserReferenceApplicationNormalize(Application $application, array $snapshot): array
+{
+    $replacements = [config('constants.coolify.version') => '<coolify-version>'];
+    foreach ($application->environment_variables()->get()->concat($application->environment_variables_preview()->get()) as $variable) {
+        if (filled($variable->value) && preg_match('/^SERVICE_(PASSWORD|BASE64|REALBASE64|HEX|USER|LOWERCASEUSER)/', $variable->key)) {
+            $replacements[$variable->value] = "<generated:{$variable->key}:".strlen($variable->value).'>';
+        }
+    }
+    uksort($replacements, fn ($a, $b) => strlen((string) $b) <=> strlen((string) $a));
+
+    array_walk_recursive($snapshot, function (&$value) use ($replacements) {
+        if (is_string($value)) {
+            $value = strtr($value, $replacements);
+        }
+    });
+
+    return $snapshot;
+}
+
+/**
+ * @return array<string, array{0: string, 1: ?string, 2: array<string, mixed>, 3: string}>
+ */
+function serviceParserReferenceCases(): array
+{
+    $reference = 'tests/Fixtures/parser/service-reference.yaml';
+    $cases = [
+        'reference' => [$reference, null, []],
+        'reference with exact traefik labels' => [$reference, null, ['proxy' => 'TRAEFIK', 'server' => ['generate_exact_labels' => true]]],
+        'reference with exact caddy labels' => [$reference, null, ['proxy' => 'CADDY', 'server' => ['generate_exact_labels' => true, 'is_traffic_analytics_enabled' => true]]],
+        'reference with application settings' => [$reference, null, [
+            'server' => ['is_logdrain_custom_enabled' => true],
+            'applications' => [
+                'web' => ['is_gzip_enabled' => false, 'is_force_https_enabled' => false, 'redirect' => 'www', 'noindex' => true, 'is_log_drain_enabled' => true],
+                'api' => ['is_stripprefix_enabled' => false],
+                'www' => ['redirect' => 'non-www'],
+            ],
+        ]],
+        'reference with migrated services' => [$reference, null, ['migrated' => ['db' => 'application', 'sidecar' => 'database']]],
+        'unsafe volume path' => ['tests/Fixtures/parser/service-unsafe.yaml', null, []],
+        'unsafe service name' => ['tests/Fixtures/parser/service-unsafe-name.yaml', null, []],
+        'invalid yaml' => ['tests/Fixtures/parser/service-invalid-yaml.yaml', null, []],
+    ];
+
+    foreach (glob(dirname(__DIR__, 2).'/templates/compose/*.y*ml') as $template) {
+        $name = pathinfo($template, PATHINFO_FILENAME);
+        $cases["template {$name}"] = ['templates/compose/'.basename($template), $name, []];
+    }
+
+    return collect($cases)->mapWithKeys(fn (array $case, string $name) => [
+        $name => [...$case, str_starts_with($name, 'template ') ? 'templates/'.Str::after($name, 'template ') : Str::slug($name)],
+    ])->all();
+}
+
+/**
+ * Replace each generated host with <name>.example.com and keep the port and path, so services that share a host still do.
+ */
+function serviceParserReferenceCustomDomains(string $fqdns): string
+{
+    return collect(explode(',', $fqdns))->map(function (string $fqdn) {
+        $host = parse_url(trim($fqdn), PHP_URL_HOST);
+        $name = Str::before(Str::before($host, '-referenceservice00000001'), '-referenceapplication0001');
+        $name = Str::before($name, '.');
+
+        $port = parse_url(trim($fqdn), PHP_URL_PORT);
+
+        return 'https://'.$name.'.example.com'.($port ? ":{$port}" : '').(parse_url(trim($fqdn), PHP_URL_PATH) ?? '');
+    })->implode(',');
+}
+
+/**
+ * @return array<string, mixed>
+ */
+function serviceParserReferenceSnapshot(Service $service, Collection $compose): array
+{
+    $storages = fn ($resource) => array_filter([
+        'volumes' => $resource->persistentStorages()->orderBy('name')->get()
+            ->map(fn ($volume) => "{$volume->name}:{$volume->mount_path}")->all(),
+        'files' => $resource->fileStorages()->orderBy('mount_path')->get()
+            ->map(fn ($file) => array_filter([
+                'fs_path' => $file->fs_path,
+                'mount_path' => $file->mount_path,
+                'is_directory' => (bool) $file->is_directory,
+                'content' => $file->content,
+            ], fn ($value) => $value !== null))->all(),
+    ]);
+
+    return [
+        'applications' => $service->applications()->orderBy('name')->get()->mapWithKeys(fn ($application) => [
+            $application->name => array_filter([
+                'fqdn' => $application->fqdn,
+                'required_port' => $application->getRequiredPort(),
+                'exclude_from_status' => (bool) $application->exclude_from_status,
+                'ports' => $application->ports,
+                ...$storages($application),
+            ], fn ($value) => $value !== null && $value !== []),
+        ])->all(),
+        'databases' => $service->databases()->orderBy('name')->get()->mapWithKeys(fn ($database) => [
+            $database->name => array_filter([
+                'exclude_from_status' => (bool) $database->exclude_from_status,
+                ...$storages($database),
+            ], fn ($value) => $value !== null && $value !== []),
+        ])->all(),
+        'environment_variables' => $service->environment_variables()->orderBy('key')->get()->mapWithKeys(fn ($variable) => [
+            $variable->key => $variable->is_required ? ['value' => $variable->value, 'required' => true] : $variable->value,
+        ])->all(),
+        'compose' => $compose->toArray(),
+    ];
+}
+
+/**
+ * Replace values that change on every run: generated secrets, uuids of generated rows, Coolify version.
+ *
+ * @param  array<string, mixed>  $snapshot
+ * @return array<string, mixed>
+ */
+function serviceParserReferenceNormalize(Service $service, array $snapshot): array
+{
+    $replacements = [config('constants.coolify.version') => '<coolify-version>'];
+    foreach ($service->applications()->get()->concat($service->databases()->get()) as $resource) {
+        $replacements[$resource->uuid] = "<uuid:{$resource->name}>";
+    }
+    foreach ($service->environment_variables()->get() as $variable) {
+        if (filled($variable->value) && preg_match('/^SERVICE_(PASSWORD|BASE64|REALBASE64|HEX|USER|LOWERCASEUSER|SUPABASEANON|SUPABASESERVICE)/', $variable->key)) {
+            $replacements[$variable->value] = "<generated:{$variable->key}:".strlen($variable->value).'>';
+        }
+    }
+    uksort($replacements, fn ($a, $b) => strlen((string) $b) <=> strlen((string) $a));
+
+    array_walk_recursive($snapshot, function (&$value) use ($replacements) {
+        if (is_string($value)) {
+            $value = strtr($value, $replacements);
+        }
+    });
+
+    return $snapshot;
+}
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index 3c1aa95d59..9d910aebf0 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -195,8 +195,8 @@ test('legacy service database backup detail urls redirect to unified backup view
     ];
 
     $this->get($generalUrl)->assertRedirect(route('project.service.volume-backups.index', $parameters));
-    $this->get($generalUrl.'/s3')->assertRedirect(route('project.service.volume-backups.index', $parameters));
-    $this->get($generalUrl.'/retention')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/s3')->assertRedirect($generalUrl);
+    $this->get($generalUrl.'/retention')->assertRedirect($generalUrl);
     $this->get($generalUrl.'/danger')->assertRedirect(route('project.service.volume-backups.index', $parameters));
     $this->get($generalUrl.'/executions')->assertRedirect(route('project.service.volume-backups.index', $parameters));
 });
diff --git a/tests/Feature/ServiceSharedMagicUrlOwnerTest.php b/tests/Feature/ServiceSharedMagicUrlOwnerTest.php
new file mode 100644
index 0000000000..acc2e64832
--- /dev/null
+++ b/tests/Feature/ServiceSharedMagicUrlOwnerTest.php
@@ -0,0 +1,178 @@
+<?php
+
+/**
+ * Regression for #11924: when two compose services declare the same
+ * SERVICE_URL_<NAME>_<PORT> (old Twenty template: twenty + worker), the
+ * variable must follow the domain of the <NAME> application, not the domain
+ * of whichever service the parser processes last.
+ */
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'compose_parsing_version' => '5',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  twenty:
+    image: twentycrm/twenty:v1.15
+    environment:
+      - SERVICE_URL_TWENTY_3000
+  worker:
+    image: twentycrm/twenty:v1.15
+    environment:
+      - SERVICE_URL_TWENTY_3000
+YAML,
+    ]);
+});
+
+it('keeps SERVICE_URL_TWENTY on the twenty domain when worker declares the same variable', function () {
+    $this->service->parse();
+
+    $twenty = $this->service->applications()->where('name', 'twenty')->first();
+    $twenty->update(['fqdn' => 'https://crm.example.com']);
+
+    $this->service->fresh()->parse();
+
+    $env = fn (string $key) => $this->service->environment_variables()->where('key', $key)->value('value');
+
+    expect($env('SERVICE_URL_TWENTY'))->toBe('https://crm.example.com')
+        ->and($env('SERVICE_FQDN_TWENTY'))->toBe('crm.example.com')
+        ->and($env('SERVICE_URL_TWENTY_3000'))->toBe('https://crm.example.com:3000')
+        ->and($this->service->applications()->where('name', 'worker')->value('fqdn'))->toBeNull();
+});
+
+it('does not overwrite SERVICE_URL_TWENTY when the worker domain is saved', function () {
+    $this->service->parse();
+    $this->service->applications()->where('name', 'twenty')->first()->update(['fqdn' => 'https://crm.example.com']);
+    $this->service->fresh()->parse();
+
+    // Installs parsed before the fix keep a generated domain on worker.
+    $worker = $this->service->applications()->where('name', 'worker')->first();
+    $worker->update(['fqdn' => 'http://twenty-stale.10.0.1.1.sslip.io']);
+
+    updateCompose($worker->fresh());
+
+    expect($this->service->environment_variables()->where('key', 'SERVICE_URL_TWENTY')->value('value'))
+        ->toBe('https://crm.example.com');
+});
+
+it('keeps path routing when services declare the same variable with another path or port', function () {
+    $this->service->update(['docker_compose_raw' => <<<'YAML'
+services:
+  appwrite:
+    image: appwrite/appwrite:1.7
+    environment:
+      - SERVICE_URL_APPWRITE=/v1
+  appwrite-console:
+    image: appwrite/console:6
+    environment:
+      - SERVICE_URL_APPWRITE_3000=/
+  appwrite-realtime:
+    image: appwrite/appwrite:1.7
+    environment:
+      - SERVICE_URL_APPWRITE=/v1/realtime
+YAML]);
+
+    $this->service->parse();
+
+    $domains = $this->service->applications()->pluck('fqdn', 'name');
+    $host = str($domains['appwrite'])->before('/v1')->value();
+
+    expect($domains['appwrite'])->toEndWith('.sslip.io/v1')
+        ->and($domains['appwrite-console'])->toBe($host)
+        ->and($domains['appwrite-realtime'])->toBe("{$host}/v1/realtime");
+});
+
+it('does not treat a build argument as a copy of the named application declaration', function () {
+    $this->service->update(['docker_compose_raw' => <<<'YAML'
+services:
+  twenty:
+    image: twentycrm/twenty:v1.15
+    environment:
+      - SERVICE_URL_TWENTY_3000
+  web:
+    image: nginx:alpine
+    build:
+      context: .
+      args:
+        - SERVICE_URL_TWENTY_3000=/admin
+YAML]);
+
+    $this->service->parse();
+
+    expect($this->service->applications()->where('name', 'web')->value('fqdn'))->toEndWith('/admin');
+});
+
+it('does not treat a service as a copy of a duplicate row with the same name', function () {
+    $this->service->update(['docker_compose_raw' => <<<'YAML'
+services:
+  app:
+    image: nginx:alpine
+    environment:
+      - SERVICE_URL_APP_80
+YAML]);
+    ServiceApplication::create(['name' => 'app', 'service_id' => $this->service->id, 'image' => 'nginx:alpine']);
+    ServiceApplication::create(['name' => 'app', 'service_id' => $this->service->id, 'image' => 'nginx:alpine', 'is_migrated' => true, 'fqdn' => 'https://app.example.com']);
+
+    $this->service->parse();
+
+    expect($this->service->environment_variables()->where('key', 'SERVICE_URL_APP')->value('value'))
+        ->toBe('https://app.example.com');
+});
+
+it('fixes SERVICE_URL_TWENTY for installs where worker already has a generated domain', function () {
+    $this->service->parse();
+    $this->service->applications()->where('name', 'twenty')->update(['fqdn' => 'https://crm.example.com']);
+    $this->service->applications()->where('name', 'worker')->update(['fqdn' => 'http://twenty-stale.10.0.1.1.sslip.io']);
+    $this->service->environment_variables()->where('key', 'SERVICE_URL_TWENTY')->first()->update(['value' => 'http://twenty-stale.10.0.1.1.sslip.io']);
+
+    $this->service->fresh()->parse();
+
+    expect($this->service->environment_variables()->where('key', 'SERVICE_URL_TWENTY')->value('value'))->toBe('https://crm.example.com')
+        ->and($this->service->applications()->where('name', 'worker')->value('fqdn'))->toBe('http://twenty-stale.10.0.1.1.sslip.io');
+});
+
+it('treats SERVICE_FQDN_ with the same name, port and value as a copy of SERVICE_URL_', function () {
+    $this->service->update(['docker_compose_raw' => <<<'YAML'
+services:
+  twenty:
+    image: twentycrm/twenty:v1.15
+    environment:
+      - SERVICE_URL_TWENTY_3000
+  worker:
+    image: twentycrm/twenty:v1.15
+    environment:
+      - SERVICE_FQDN_TWENTY_3000
+YAML]);
+
+    $this->service->parse();
+    $this->service->applications()->where('name', 'twenty')->first()->update(['fqdn' => 'https://crm.example.com']);
+    $this->service->fresh()->parse();
+
+    expect($this->service->environment_variables()->where('key', 'SERVICE_URL_TWENTY')->value('value'))->toBe('https://crm.example.com')
+        ->and($this->service->environment_variables()->where('key', 'SERVICE_FQDN_TWENTY_3000')->value('value'))->toBe('crm.example.com:3000')
+        ->and($this->service->applications()->where('name', 'worker')->value('fqdn'))->toBeNull();
+});
diff --git a/tests/Feature/ServiceTemplateMinioImageTest.php b/tests/Feature/ServiceTemplateMinioImageTest.php
new file mode 100644
index 0000000000..207e10734f
--- /dev/null
+++ b/tests/Feature/ServiceTemplateMinioImageTest.php
@@ -0,0 +1,48 @@
+<?php
+
+use App\Models\EnvironmentVariable;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use Symfony\Component\Yaml\Yaml;
+
+it('does not use the removed upstream MinIO images in service templates', function () {
+    $removedImages = ['minio/minio', 'minio/mc', 'quay.io/minio/minio', 'quay.io/minio/mc', 'docker.io/minio/minio', 'docker.io/minio/mc'];
+    $offenders = [];
+
+    foreach (glob(dirname(__DIR__, 2).'/templates/compose/*.yaml') as $templatePath) {
+        $services = Yaml::parse(file_get_contents($templatePath))['services'] ?? [];
+
+        foreach ($services as $serviceName => $service) {
+            $imageName = str($service['image'] ?? '')->before(':')->before('@')->value();
+
+            if (in_array($imageName, $removedImages, true)) {
+                $offenders[] = basename($templatePath).": {$serviceName} uses {$service['image']}";
+            }
+        }
+    }
+
+    expect($offenders)->toBe([]);
+});
+
+it('treats MinIO-compatible images as MinIO services', function (string $image) {
+    $service = new Service;
+    $service->setRelation('server', new Server);
+    $service->setRelation('environment_variables', collect([
+        (new EnvironmentVariable)->forceFill(['key' => 'MINIO_BROWSER_REDIRECT_URL', 'value' => 'https://console.example.com']),
+        (new EnvironmentVariable)->forceFill(['key' => 'MINIO_SERVER_URL', 'value' => 'https://s3.example.com']),
+    ]));
+
+    $application = (new ServiceApplication)->setRawAttributes(['image' => $image], sync: true);
+    $application->setRelation('service', $service);
+
+    expect($application->serviceType())->not->toBeNull()
+        ->and(generateServiceSpecificFqdns($application)->all())->toBe([
+            'https://console.example.com:9001',
+            'https://s3.example.com:9000',
+        ]);
+})->with([
+    'pgsty/silo:RELEASE.2026-10-15T00-00-00Z',
+    'docker.io/pgsty/silo:RELEASE.2026-10-15T00-00-00Z',
+    'ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z',
+]);
diff --git a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
index ed5a27fc21..d6519cbb39 100644
--- a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
+++ b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
@@ -135,3 +135,30 @@ it('preserves one click service key casing when selecting a service template', f
 
     expect($component->type)->toBe('one-click-service-denoKV');
 });
+
+it('links service websites to the project page instead of a shared host root', function () {
+    $path = base_path('templates/'.config('constants.services.file_name'));
+    $payload = json_encode([
+        'uptime-kuma' => ['documentation' => 'https://github.com/louislam/uptime-kuma?tab=readme-ov-file&utm_source=coolify.io'],
+        'alexandrie' => ['documentation' => 'https://www.github.com/Smaug6739/Alexandrie/tree/main/docs'],
+        'radarr' => ['documentation' => 'https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io'],
+        'n8n' => ['documentation' => 'https://n8n.io/docs?utm_source=coolify.io'],
+        'broken' => ['documentation' => 'not a url'],
+    ]);
+
+    File::partialMock()
+        ->shouldReceive('exists')
+        ->with($path)
+        ->andReturn(true)
+        ->shouldReceive('get')
+        ->with($path)
+        ->andReturn($payload);
+
+    $services = (new Select)->loadServices()['services'];
+
+    expect($services['uptime-kuma']['website'])->toBe('https://github.com/louislam/uptime-kuma')
+        ->and($services['alexandrie']['website'])->toBe('https://www.github.com/Smaug6739/Alexandrie')
+        ->and($services['radarr']['website'])->toBe('https://hub.docker.com/r/linuxserver/radarr')
+        ->and($services['n8n']['website'])->toBe('https://n8n.io')
+        ->and($services['broken']['website'])->toBeNull();
+});
diff --git a/tests/Feature/ServiceUrlsApiPersistenceTest.php b/tests/Feature/ServiceUrlsApiPersistenceTest.php
new file mode 100644
index 0000000000..270a79d19e
--- /dev/null
+++ b/tests/Feature/ServiceUrlsApiPersistenceTest.php
@@ -0,0 +1,78 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'test-token',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_FRONTEND_80\n",
+    ]);
+    $this->service->parse(isNew: true);
+});
+
+function serviceMagicEnvValue(Service $service, string $key): ?string
+{
+    return $service->environment_variables()->where('key', $key)->value('value');
+}
+
+it('keeps a domain set through the services API urls field after the compose is parsed again', function () {
+    $this->withHeaders(['Authorization' => 'Bearer '.$this->bearerToken])
+        ->patchJson("/api/v1/services/{$this->service->uuid}", [
+            'urls' => [['name' => 'frontend', 'url' => 'https://example.com']],
+        ])
+        ->assertOk()
+        ->assertJsonPath('domains.0', 'https://example.com');
+
+    $assertDomain = function (): void {
+        $service = $this->service->fresh();
+        expect($service->applications()->where('name', 'frontend')->value('fqdn'))->toBe('https://example.com')
+            ->and(serviceMagicEnvValue($service, 'SERVICE_URL_FRONTEND'))->toBe('https://example.com')
+            ->and(serviceMagicEnvValue($service, 'SERVICE_URL_FRONTEND_80'))->toBe('https://example.com:80')
+            ->and(serviceMagicEnvValue($service, 'SERVICE_FQDN_FRONTEND'))->toBe('example.com')
+            ->and(serviceMagicEnvValue($service, 'SERVICE_FQDN_FRONTEND_80'))->toBe('example.com:80');
+    };
+
+    $assertDomain();
+
+    // StartService parses the compose again before every deploy.
+    $this->service->fresh()->parse();
+
+    $assertDomain();
+});
diff --git a/tests/Feature/SettingsAccessListboxTest.php b/tests/Feature/SettingsAccessListboxTest.php
index 5d0f8c309b..8c251575f5 100644
--- a/tests/Feature/SettingsAccessListboxTest.php
+++ b/tests/Feature/SettingsAccessListboxTest.php
@@ -127,3 +127,24 @@ test('open API allowlist warning is shown when API access is enabled without all
         ->assertSet('is_api_enabled', true)
         ->assertSee('API access is open to every source');
 });
+
+test('MCP endpoint callout links to API token management', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'is_api_enabled' => false,
+        'is_mcp_server_enabled' => true,
+    ]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Advanced::class)
+        ->assertSee(url('/mcp'))
+        ->assertSee('href="'.route('security.api-tokens').'"', false);
+});
diff --git a/tests/Feature/SettingsBackupEmptyStateTest.php b/tests/Feature/SettingsBackupEmptyStateTest.php
index 605350beb8..30392acc49 100644
--- a/tests/Feature/SettingsBackupEmptyStateTest.php
+++ b/tests/Feature/SettingsBackupEmptyStateTest.php
@@ -216,11 +216,38 @@ test('configure backup creates the instance database instead of using a team dat
 
     Livewire::test(SettingsBackup::class)
         ->call('addCoolifyDatabase')
-        ->assertHasNoErrors()
-        ->assertSet('postgres_password', 'instance-secret');
+        ->assertHasNoErrors();
 
     $instanceDatabase = StandalonePostgresql::query()->findOrFail(0);
-    expect($instanceDatabase->scheduledBackups()->sole()->team_id)->toBe(0)
+    expect($instanceDatabase->postgres_password)->toBe('instance-secret')
+        ->and($instanceDatabase->scheduledBackups()->sole()->team_id)->toBe(0)
         ->and($tenantDatabase->fresh()->scheduledBackups()->exists())->toBeFalse()
         ->and($tenantDatabase->fresh()->postgres_password)->toBe('tenant-secret');
 });
+
+test('saving instance backup settings only persists the description', function () {
+    $database = settingsBackupInstanceDatabaseWithoutSchedule();
+    $database->forceFill(['postgres_password' => 'instance-db-secret'])->save();
+    $database->scheduledBackups()->create([
+        'enabled' => true,
+        'save_s3' => false,
+        'frequency' => '0 0 * * *',
+        'team_id' => 0,
+    ]);
+
+    Livewire::test(SettingsBackup::class)
+        ->assertSee('Instance database')
+        ->assertSee('coolify')
+        ->assertDontSeeHtml('wire:model=postgres_user')
+        ->assertDontSeeHtml('wire:model=postgres_password')
+        ->assertDontSee('instance-db-secret', stripInitialData: false)
+        ->set('description', 'Updated description')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $database->refresh();
+    expect($database->description)->toBe('Updated description')
+        ->and($database->name)->toBe('coolify-db')
+        ->and($database->postgres_user)->toBe('coolify')
+        ->and($database->postgres_password)->toBe('instance-db-secret');
+});
diff --git a/tests/Feature/SettingsDetectPublicIpsTest.php b/tests/Feature/SettingsDetectPublicIpsTest.php
new file mode 100644
index 0000000000..f2de861987
--- /dev/null
+++ b/tests/Feature/SettingsDetectPublicIpsTest.php
@@ -0,0 +1,86 @@
+<?php
+
+use App\Livewire\Settings\Index as SettingsIndex;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    InstanceSettings::forceCreate(['id' => 0, 'public_ipv4' => '203.0.113.21', 'public_ipv6' => '2001:db8::21']);
+    Once::flush();
+
+    $this->rootTeam = Team::factory()->create(['id' => 0]);
+    $this->user = User::factory()->create();
+    $this->rootTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->rootTeam]);
+
+    Process::fake([
+        'curl -4s https://ifconfig.io' => "203.0.113.1\n",
+        'curl -6s https://ifconfig.io' => "2001:db8::1\n",
+    ]);
+});
+
+it('saves the detected public IPs and shows them in the fields', function () {
+    Livewire::test(SettingsIndex::class)
+        ->call('detectPublicIps')
+        ->assertSet('public_ipv4', '203.0.113.1')
+        ->assertSet('public_ipv6', '2001:db8::1')
+        ->assertDispatched('success');
+
+    $settings = InstanceSettings::find(0);
+    expect($settings->public_ipv4)->toBe('203.0.113.1')
+        ->and($settings->public_ipv6)->toBe('2001:db8::1');
+});
+
+it('keeps the current value of an address family that cannot be detected', function () {
+    Process::fake([
+        'curl -4s https://ifconfig.io' => "203.0.113.1\n",
+        'curl -6s https://ifconfig.io' => '',
+    ]);
+
+    Livewire::test(SettingsIndex::class)
+        ->call('detectPublicIps')
+        ->assertSet('public_ipv4', '203.0.113.1')
+        ->assertSet('public_ipv6', '2001:db8::21');
+
+    expect(InstanceSettings::find(0)->public_ipv6)->toBe('2001:db8::21');
+});
+
+it('shows an error when no address can be detected', function () {
+    Process::fake([
+        'curl -4s https://ifconfig.io' => '',
+        'curl -6s https://ifconfig.io' => '',
+    ]);
+
+    Livewire::test(SettingsIndex::class)
+        ->call('detectPublicIps')
+        ->assertSet('public_ipv4', '203.0.113.21')
+        ->assertSet('public_ipv6', '2001:db8::21')
+        ->assertDispatched('error')
+        ->assertNotDispatched('success');
+});
+
+it('does not let a user who is no longer an instance admin detect public IPs', function () {
+    $component = Livewire::test(SettingsIndex::class);
+
+    $this->rootTeam->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+    Cache::flush();
+    Once::flush();
+
+    $component->call('detectPublicIps')
+        ->assertDispatched('error')
+        ->assertSet('public_ipv4', '203.0.113.21');
+    expect(InstanceSettings::find(0)->public_ipv4)->toBe('203.0.113.21');
+    Process::assertNothingRan();
+});
diff --git a/tests/Feature/SharedVariableCanvasTest.php b/tests/Feature/SharedVariableCanvasTest.php
index 98b15c266a..92b3db0f6c 100644
--- a/tests/Feature/SharedVariableCanvasTest.php
+++ b/tests/Feature/SharedVariableCanvasTest.php
@@ -218,6 +218,20 @@ test('a server canvas only shows resources on that server', function () {
     expect(collect($response->json('nodes'))->where('type', '!=', 'variable')->pluck('name')->all())->toBe(['storefront']);
 });
 
+test('the server canvas hides the built-in server variables and the references to them', function () {
+    $this->server->environment_variables()->create(['key' => 'REGION', 'value' => 'eu', 'team_id' => $this->team->id]);
+    sharedVariableCanvasEnv($this->storefront, 'HOST', '{{server.COOLIFY_SERVER_NAME}}');
+    sharedVariableCanvasEnv($this->storefront, 'REGION', '{{server.REGION}}');
+
+    $response = sharedVariableCanvasAs($this, $this->admin, $this->team)
+        ->getJson("/canvas/api/shared-variables/server/{$this->server->uuid}/canvas")
+        ->assertOk();
+
+    // Coolify creates COOLIFY_SERVER_UUID / COOLIFY_SERVER_NAME on every server; they are not shown, not even as deleted.
+    expect(collect($response->json('nodes'))->where('type', 'variable')->pluck('name')->all())->toBe(['REGION'])
+        ->and(collect($response->json('links'))->pluck('key')->all())->toBe(['REGION']);
+});
+
 test('another team cannot open or change the canvas of a scope it does not own', function () {
     $otherTeam = Team::factory()->create(['show_boarding' => false]);
     $otherTeam->members()->attach($this->admin->id, ['role' => 'owner']);
diff --git a/tests/Feature/SharedVariablesOverviewTest.php b/tests/Feature/SharedVariablesOverviewTest.php
new file mode 100644
index 0000000000..d9d6df9019
--- /dev/null
+++ b/tests/Feature/SharedVariablesOverviewTest.php
@@ -0,0 +1,90 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\SharedVariableCanvas;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create(['show_boarding' => false]);
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'member']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function overviewShared(array $attributes): SharedEnvironmentVariable
+{
+    return SharedEnvironmentVariable::create(['value' => 'secret-value', ...$attributes]);
+}
+
+function overviewEnv(Application $application, string $key, string $value): void
+{
+    EnvironmentVariable::create([
+        'key' => $key, 'value' => $value,
+        'resourceable_type' => $application->getMorphClass(), 'resourceable_id' => $application->id,
+    ]);
+}
+
+test('the overview counts variables per scope and the resources that use each one', function () {
+    overviewShared(['key' => 'API_TOKEN', 'type' => 'team', 'team_id' => $this->team->id]);
+    overviewShared(['key' => 'DB_URL', 'type' => 'project', 'team_id' => $this->team->id, 'project_id' => $this->project->id]);
+    overviewShared(['key' => 'REGION', 'type' => 'server', 'team_id' => $this->team->id, 'server_id' => $this->server->id]);
+    overviewEnv($this->application, 'TOKEN', '{{team.API_TOKEN}}');
+    overviewEnv($this->application, 'DATABASE', 'postgres://{{ project.DB_URL }}');
+    overviewEnv($this->application, 'OLD', '{{team.REMOVED}}');
+
+    $overview = app(SharedVariableCanvas::class)->overview($this->team);
+
+    expect($overview['scopes']['team'])->toBe(['variables' => 1, 'owners' => 1])
+        ->and($overview['scopes']['project'])->toBe(['variables' => 1, 'owners' => 1])
+        ->and($overview['scopes']['environment'])->toBe(['variables' => 0, 'owners' => 0])
+        ->and($overview['used']->pluck('resources', 'key')->all())->toBe(['API_TOKEN' => 1, 'DB_URL' => 1])
+        ->and($overview['unused']->pluck('key')->all())->toBe(['REGION'])
+        ->and($overview['missing'])->toBe(1);
+});
+
+test('a reference resolves against the resource own project, not another project with the same key', function () {
+    $otherProject = Project::factory()->create(['team_id' => $this->team->id]);
+    overviewShared(['key' => 'DB_URL', 'type' => 'project', 'team_id' => $this->team->id, 'project_id' => $otherProject->id]);
+    overviewEnv($this->application, 'DATABASE', '{{project.DB_URL}}');
+
+    $overview = app(SharedVariableCanvas::class)->overview($this->team);
+
+    expect($overview['used'])->toBeEmpty()
+        ->and($overview['missing'])->toBe(1);
+});
+
+test('the overview page shows only the current team and never the values', function () {
+    overviewShared(['key' => 'API_TOKEN', 'type' => 'team', 'team_id' => $this->team->id]);
+    $otherTeam = Team::factory()->create();
+    overviewShared(['key' => 'OTHER_TEAM_KEY', 'type' => 'team', 'team_id' => $otherTeam->id]);
+
+    $this->actingAs($this->user)->withSession(['currentTeam' => $this->team])
+        ->get(route('shared-variables.index'))
+        ->assertSuccessful()
+        ->assertSee('API_TOKEN')
+        ->assertDontSee('OTHER_TEAM_KEY')
+        ->assertDontSee('secret-value');
+});
diff --git a/tests/Feature/SshMultiplexingLockTest.php b/tests/Feature/SshMultiplexingLockTest.php
index dd0ce783b2..a489af4955 100644
--- a/tests/Feature/SshMultiplexingLockTest.php
+++ b/tests/Feature/SshMultiplexingLockTest.php
@@ -223,6 +223,7 @@ it('kills only old orphaned ssh masters whose control socket no longer exists',
 ".
             "333 1 30 ssh -fN -o ControlMaster=auto -o ControlPath={$youngSocket} root@1.2.3.4
 "),
+        '*ssh -O check*' => Process::result(errorOutput: 'Master running (pid=111)'),
         'kill*' => Process::result(exitCode: 0),
     ]);
 
@@ -238,6 +239,59 @@ it('kills only old orphaned ssh masters whose control socket no longer exists',
     File::delete($liveSocket);
 });
 
+it('kills ssh -fN processes that share a live ControlPath but do not own it', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => true]);
+    $muxDir = storage_path('app/ssh/mux');
+    File::ensureDirectoryExists($muxDir);
+
+    $socket = $muxDir.'/mux_shared_'.uniqid();
+    File::put($socket, 'x');
+
+    Process::fake([
+        'ps*' => Process::result(output: "111 1 5000 ssh -fN -o ControlMaster=auto -o ControlPath={$socket} root@1.2.3.4\n".
+            "222 1 7000 ssh -fN -o ControlMaster=auto -o ControlPath={$socket} root@1.2.3.4\n".
+            "333 1 9000 ssh -fN -o ControlMaster=auto -o ControlPath={$socket} root@1.2.3.4\n"),
+        '*ssh -O check*' => Process::result(errorOutput: 'Master running (pid=111)'),
+        'kill*' => Process::result(exitCode: 0),
+    ]);
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupOrphanedSshProcesses');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    Process::assertRan(fn ($process) => $process->command === 'kill -9 '.escapeshellarg('222'));
+    Process::assertRan(fn ($process) => $process->command === 'kill -9 '.escapeshellarg('333'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '111'));
+    Process::assertRanTimes(fn ($process) => str_contains($process->command, 'ssh -O check'), 1);
+
+    File::delete($socket);
+});
+
+it('does not kill ssh -fN processes when the socket owner is unknown', function () {
+    config(['constants.ssh.mux_orphan_reap_enabled' => true]);
+    $muxDir = storage_path('app/ssh/mux');
+    File::ensureDirectoryExists($muxDir);
+
+    $socket = $muxDir.'/mux_unknown_'.uniqid();
+    File::put($socket, 'x');
+
+    Process::fake([
+        'ps*' => Process::result(output: "111 1 5000 ssh -fN -o ControlMaster=auto -o ControlPath={$socket} root@1.2.3.4\n"),
+        '*ssh -O check*' => Process::result(exitCode: 255, errorOutput: 'Control socket connect: Connection refused'),
+        'kill*' => Process::result(exitCode: 0),
+    ]);
+
+    $job = new CleanupStaleMultiplexedConnections;
+    $method = new ReflectionMethod($job, 'cleanupOrphanedSshProcesses');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill'));
+
+    File::delete($socket);
+});
+
 it('does not reap an ssh master that is intentionally retiring', function () {
     config(['constants.ssh.mux_orphan_reap_enabled' => true]);
     $muxDir = storage_path('app/ssh/mux');
@@ -333,31 +387,45 @@ it('does not mark a mux process as retiring when stop fails', function () {
     expect(SshMultiplexingHelper::isMuxProcessRetiring('444', "/var/www/html/storage/app/ssh/mux/mux_{$server->uuid}"))->toBeFalse();
 });
 
-it('kills only old orphaned cloudflared proxies whose parent ssh is gone', function () {
+it('kills only old cloudflared proxies whose stdin pipe no live ssh holds', function () {
     config(['constants.ssh.mux_orphan_reap_enabled' => true]);
 
+    // This test process stands in for a live ssh master: it holds the write end
+    // of the reparented proxy's stdin pipe. The orphan's writer is closed.
+    $descriptors = [0 => ['pipe', 'r'], 1 => ['file', '/dev/null', 'w'], 2 => ['file', '/dev/null', 'w']];
+    $reparented = proc_open(['sleep', '60'], $descriptors, $reparentedPipes);
+    $orphan = proc_open(['sleep', '60'], $descriptors, $orphanPipes);
+    $tunnelSsh = proc_open(['sleep', '60'], $descriptors, $tunnelSshPipes);
+    fclose($orphanPipes[0]);
+    fclose($tunnelSshPipes[0]);
+    $reparentedPid = proc_get_status($reparented)['pid'];
+    $orphanPid = proc_get_status($orphan)['pid'];
+    $tunnelSshPid = proc_get_status($tunnelSsh)['pid'];
+    $sshPid = getmypid();
+
     Process::fake([
-        'ps*' => Process::result(output: '100 1 5000 ssh -fN -o ControlMaster=auto root@1.2.3.4
-'.
-            '200 100 5000 cloudflared access ssh --hostname host.example.com
-'.
-            '300 2176 5000 cloudflared access ssh --hostname host.example.com
-'.
-            '400 2176 30 cloudflared access ssh --hostname host.example.com
-'.
-            '2176 1 9000 /usr/bin/some-supervisor
-'),
+        'ps*' => Process::result(output: "{$sshPid} 1 5000 ssh -fN -o ControlMaster=auto root@1.2.3.4\n".
+            "200 {$sshPid} 5000 cloudflared access ssh --hostname host.example.com\n".
+            "{$reparentedPid} 1 5000 cloudflared access ssh --hostname host.example.com\n".
+            "{$orphanPid} 1 5000 cloudflared access ssh --hostname host.example.com\n".
+            "400 1 30 cloudflared access ssh --hostname host.example.com\n".
+            "{$tunnelSshPid} 1 5000 ssh -fN -o ProxyCommand=cloudflared access ssh --hostname %h root@1.2.3.4\n"),
         'kill*' => Process::result(exitCode: 0),
     ]);
 
     $job = new CleanupStaleMultiplexedConnections;
     $method = new ReflectionMethod($job, 'cleanupOrphanedCloudflaredProcesses');
-    $method->setAccessible(true);
     $method->invoke($job);
 
-    Process::assertRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '300'));
-    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '200'));
-    Process::assertNotRan(fn ($process) => str_contains($process->command, 'kill') && str_contains($process->command, '400'));
+    proc_terminate($reparented);
+    proc_terminate($orphan);
+    proc_terminate($tunnelSsh);
+    proc_close($reparented);
+    proc_close($orphan);
+    proc_close($tunnelSsh);
+
+    Process::assertRan(fn ($process) => $process->command === 'kill '.escapeshellarg((string) $orphanPid));
+    Process::assertRanTimes(fn ($process) => str_starts_with($process->command, 'kill'), 1);
 });
 
 it('dry-run mode logs orphans but kills nothing when reaping is disabled', function () {
diff --git a/tests/Feature/SslipServerHostnameTest.php b/tests/Feature/SslipServerHostnameTest.php
new file mode 100644
index 0000000000..dca13318e7
--- /dev/null
+++ b/tests/Feature/SslipServerHostnameTest.php
@@ -0,0 +1,15 @@
+<?php
+
+use App\Models\Server;
+
+it('builds the sslip.io domain from the IP address of the server', function (string $address, string $expected) {
+    $server = new Server(['ip' => $address]);
+    $server->id = 1;
+
+    expect(sslip($server))->toBe($expected);
+})->with([
+    'IPv4' => ['188.245.12.182', 'http://188.245.12.182.sslip.io'],
+    'IPv6' => ['2a01:4f8:c016:bd23::1', 'http://2a01-4f8-c016-bd23--1.sslip.io'],
+    'resolvable hostname' => ['localhost', 'http://127.0.0.1.sslip.io'],
+    'unresolvable hostname' => ['coolify-test.invalid', 'http://coolify-test.invalid.sslip.io'],
+]);
diff --git a/tests/Feature/StableNestedLivewireKeysTest.php b/tests/Feature/StableNestedLivewireKeysTest.php
index 96ad9a8959..4c3a63a0d4 100644
--- a/tests/Feature/StableNestedLivewireKeysTest.php
+++ b/tests/Feature/StableNestedLivewireKeysTest.php
@@ -30,7 +30,7 @@ it('keys nested Livewire status components rendered inside navigation loops', fu
     $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
 
     expect($sidebar)
-        ->toContain(':key="\'application-server-status-\'.$application->uuid"');
+        ->toContain(':key="$placement.\'-application-server-status-\'.$application->uuid"');
 });
 
 it('keys virtual log rows by stable line identity instead of list position', function () {
diff --git a/tests/Feature/TagsShowPageTest.php b/tests/Feature/TagsShowPageTest.php
index b454b59e18..e3ff87911b 100644
--- a/tests/Feature/TagsShowPageTest.php
+++ b/tests/Feature/TagsShowPageTest.php
@@ -98,3 +98,72 @@ it('redirects to the overview when the requested tag does not exist', function (
     Livewire::test(Show::class, ['tagName' => 'missing-tag'])
         ->assertRedirect(route('tags.show'));
 });
+
+it('lists the team resources in the connect modal and toggles the tag on a resource', function () {
+    $tag = Tag::create(['name' => 'hello', 'team_id' => $this->team->id]);
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'shop']);
+    $environment = Environment::factory()->create(['project_id' => $project->id, 'name' => 'prod']);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'name' => 'untagged-app',
+    ]);
+
+    $component = Livewire::test(Show::class, ['tagName' => 'hello'])
+        ->assertDontSee('shop / prod')
+        ->call('openConnectResources')
+        ->assertSee('shop / prod')
+        ->assertSee('untagged-app')
+        ->call('toggleResource', $application->uuid);
+
+    expect($application->tags()->whereKey($tag->id)->exists())->toBeTrue();
+    expect($component->get('applications')->pluck('uuid')->all())->toBe([$application->uuid]);
+
+    $component->call('toggleResource', $application->uuid);
+
+    expect($application->tags()->whereKey($tag->id)->exists())->toBeFalse();
+});
+
+it('does not tag a resource of another team from the connect modal', function () {
+    $tag = Tag::create(['name' => 'hello', 'team_id' => $this->team->id]);
+    $otherTeam = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $otherTeam->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $otherTeam->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    Livewire::test(Show::class, ['tagName' => 'hello'])
+        ->call('toggleResource', $application->uuid)
+        ->assertDispatched('error');
+
+    expect($application->tags()->exists())->toBeFalse();
+});
+
+it('does not let a member change tags from the connect modal', function () {
+    $tag = Tag::create(['name' => 'hello', 'team_id' => $this->team->id]);
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $member = User::factory()->create();
+    $member->teams()->attach($this->team, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(Show::class, ['tagName' => 'hello'])
+        ->call('toggleResource', $application->uuid);
+
+    expect($application->tags()->exists())->toBeFalse();
+});
diff --git a/tests/Feature/TeamSwitchConcurrentRequestTest.php b/tests/Feature/TeamSwitchConcurrentRequestTest.php
new file mode 100644
index 0000000000..0de09bbd00
--- /dev/null
+++ b/tests/Feature/TeamSwitchConcurrentRequestTest.php
@@ -0,0 +1,76 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\RouteCollection;
+use Illuminate\Support\Facades\Route;
+
+uses(RefreshDatabase::class);
+
+function registerTeamSwitchTestRoutesBeforeCatchAll(array $actions): void
+{
+    $routes = new RouteCollection;
+    foreach ($actions as $uri => $action) {
+        $routes->add(Route::middleware(['web', 'auth'])->get($uri, $action));
+    }
+    foreach (app('router')->getRoutes() as $route) {
+        $routes->add($route);
+    }
+    app('router')->setRoutes($routes);
+}
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->user = User::factory()->create();
+    $this->firstTeam = $this->user->teams()->first();
+    $this->secondTeam = Team::factory()->create();
+    $this->secondTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->thirdTeam = Team::factory()->create();
+    $this->thirdTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    Team::query()->update(['show_boarding' => false]);
+    $this->user->forceFill(['current_team_id' => $this->firstTeam->id])->saveQuietly();
+
+    registerTeamSwitchTestRoutesBeforeCatchAll([
+        '_test/team-switch-during-request' => function () {
+            // The team switcher saves the session while this request still runs.
+            $switchRequestSession = clone session()->driver();
+            $switchRequestSession->start();
+            $switchRequestSession->put('currentTeam', $this->secondTeam);
+            $switchRequestSession->save();
+            $this->user->forceFill(['current_team_id' => $this->secondTeam->id])->saveQuietly();
+
+            return 'ok';
+        },
+        '_test/switch-to-second-team' => function () {
+            $otherRequestSession = clone session()->driver();
+            $otherRequestSession->start();
+            $otherRequestSession->put('currentTeam', $this->thirdTeam);
+            $otherRequestSession->save();
+
+            refreshSession($this->secondTeam);
+
+            return 'ok';
+        },
+        '_test/current-team' => fn () => 'team:'.currentTeam()->id,
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->firstTeam]);
+});
+
+test('a request that was in flight during a team switch does not restore the previous team', function () {
+    $this->get('/_test/team-switch-during-request')->assertOk();
+
+    $this->get('/_test/current-team')->assertOk()->assertSee('team:'.$this->secondTeam->id);
+    expect($this->user->fresh()->current_team_id)->toBe($this->secondTeam->id);
+});
+
+test('a request that switches the team keeps the team it selected over a concurrent change', function () {
+    $this->get('/_test/switch-to-second-team')->assertOk();
+
+    $this->get('/_test/current-team')->assertOk()->assertSee('team:'.$this->secondTeam->id);
+    expect($this->user->fresh()->current_team_id)->toBe($this->secondTeam->id);
+});
diff --git a/tests/Feature/TerminalSessionStartFailureTest.php b/tests/Feature/TerminalSessionStartFailureTest.php
index 80990fed1f..6871500448 100644
--- a/tests/Feature/TerminalSessionStartFailureTest.php
+++ b/tests/Feature/TerminalSessionStartFailureTest.php
@@ -8,6 +8,9 @@ use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
@@ -106,6 +109,27 @@ function createTerminalApplication(Server $server, Team $team): Application
     ]);
 }
 
+/**
+ * A degraded service: app0 has exited, app1 and postgres are running.
+ */
+function createDegradedTerminalService(Server $server, Team $team): Service
+{
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    ServiceApplication::create(['service_id' => $service->id, 'name' => 'app0', 'status' => 'exited']);
+    ServiceApplication::create(['service_id' => $service->id, 'name' => 'app1', 'status' => 'running:unhealthy']);
+    ServiceDatabase::create(['service_id' => $service->id, 'name' => 'postgres', 'status' => 'running:healthy']);
+
+    return $service;
+}
+
 describe('Terminal::sendTerminalCommand', function () {
     it('issues a token for a running container with a shell', function () {
         fakeTerminalContainer('running');
@@ -269,4 +293,32 @@ describe('ExecuteContainerCommand', function () {
             ->assertDispatchedTo(Terminal::class, Terminal::AUTO_START_CANCELLED_EVENT)
             ->assertNotDispatched('send-terminal-command');
     });
+
+    it('lists the running containers of a degraded service', function () {
+        Process::fake();
+        $service = createDegradedTerminalService($this->server, $this->team);
+        bindTerminalRouteParameters(['service_uuid' => $service->uuid]);
+
+        expect($service->fresh()->status)->toStartWith('degraded');
+
+        $component = Livewire::test(ExecuteContainerCommand::class)
+            ->call('loadContainers')
+            ->assertDispatchedTo(Terminal::class, Terminal::AUTO_START_CANCELLED_EVENT);
+
+        expect(collect($component->get('containerOptions'))->pluck('value')->all())->toBe([
+            "{$this->server->uuid}:app1-{$service->uuid}",
+            "{$this->server->uuid}:postgres-{$service->uuid}",
+        ]);
+    });
+
+    it('lists no service containers when terminal access is disabled on the server', function () {
+        Process::fake();
+        $service = createDegradedTerminalService($this->server, $this->team);
+        $this->server->settings->update(['is_terminal_enabled' => false]);
+        bindTerminalRouteParameters(['service_uuid' => $service->uuid]);
+
+        Livewire::test(ExecuteContainerCommand::class)
+            ->call('loadContainers')
+            ->assertSet('containerOptions', []);
+    });
 });
diff --git a/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php b/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php
index 13e230d6a1..3c3fc9a06b 100644
--- a/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php
+++ b/tests/Feature/TrafficAnalytics/GeoVisualizationTest.php
@@ -27,7 +27,7 @@ class FakeGeoTrafficClient extends SentinelTrafficClient
     }
 }
 
-function fakeGeoResponses(array $countryRows): array
+function fakeGeoResponses(array $countryRows, array $cityRows = []): array
 {
     return [
         '/traffic/apps' => json_encode([]),
@@ -41,6 +41,7 @@ function fakeGeoResponses(array $countryRows): array
         ]),
         '/traffic/paths' => json_encode([]),
         '/traffic/breakdown/country' => json_encode($countryRows),
+        '/traffic/breakdown/city' => json_encode($cityRows),
         '/traffic/attribution' => json_encode(['attribution' => 'GeoIP data by MaxMind']),
     ];
 }
@@ -111,7 +112,7 @@ it('shows a plain no-data state when no country data has been recorded', functio
 
     loadLazy(Livewire::test(Analytics::class))
         ->assertOk()
-        ->assertSee('Countries')
+        ->assertSee('Locations')
         ->assertSee('No country data for the selected range');
 });
 
@@ -135,3 +136,94 @@ it('mounts the globe from the element itself when country data arrives after the
         ->assertSeeHtml('id="global-analytics-globe" x-ref="canvas"')
         ->assertSeeHtml('window.mountTrafficGlobe(canvas');
 });
+
+it('renders the city list, the switch, and both marker sets when Sentinel returns city data', function () {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses(
+        [['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000]],
+        [
+            ['value' => 'DE|BE|Berlin', 'requests' => 400, 'bytes_out' => 9000, 'lat' => 52.52, 'lon' => 13.405],
+            ['value' => 'DE||', 'requests' => 150, 'bytes_out' => 4000],
+            ['value' => '__other__', 'requests' => 50, 'bytes_out' => 2000],
+        ],
+    );
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->assertOk()
+        ->assertSeeHtml('aria-label="Location detail"')
+        ->assertSee('Germany')
+        ->assertSee('Berlin')
+        ->assertSee('BE, Germany')
+        // Only the row with coordinates turns the globe on hover.
+        ->assertSeeHtml('focus([52.52, 13.405])');
+});
+
+it('sends the globe one marker set for each view, without markers for unknown cities', function () {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses(
+        [['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000]],
+        [
+            ['value' => 'DE|BE|Berlin', 'requests' => 400, 'bytes_out' => 9000, 'lat' => 52.52, 'lon' => 13.405],
+            // An unknown city never gets a marker, also when Sentinel sends coordinates.
+            ['value' => 'DE||', 'requests' => 150, 'bytes_out' => 4000, 'lat' => 51.0, 'lon' => 9.0],
+        ],
+    );
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-global-analytics-status', function (string $event, array $params): bool {
+            return data_get($params, '0.geo') === [
+                'countries' => [['code' => 'DE', 'requests' => 600]],
+                'cities' => [['lat' => 52.52, 'lon' => 13.405, 'requests' => 400]],
+            ];
+        });
+});
+
+it('shows an empty city list and no city markers when Sentinel returns no city data', function (array $cityRows) {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses([
+        ['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000],
+    ], $cityRows);
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->assertOk()
+        ->assertSee('Germany')
+        ->assertSee('No city data for the selected range.')
+        ->assertDontSeeHtml('focus([')
+        ->call('loadData')
+        ->assertDispatched('refreshChartData-global-analytics-status', function (string $event, array $params): bool {
+            return data_get($params, '0.geo') === [
+                'countries' => [['code' => 'DE', 'requests' => 600]],
+                'cities' => [],
+            ];
+        });
+})->with([
+    'old sentinel' => [[]],
+    'country-only database' => [[['value' => 'DE||', 'requests' => 600, 'bytes_out' => 15000]]],
+]);
+
+it('escapes a city name that contains quotes or HTML', function () {
+    $server = bootGeoServer();
+
+    $fake = new FakeGeoTrafficClient($server);
+    $fake->responses = fakeGeoResponses(
+        [['value' => 'US', 'requests' => 600, 'bytes_out' => 15000]],
+        [['value' => "US|MO|O'Fallon <b>x</b>", 'requests' => 400, 'bytes_out' => 9000, 'lat' => 38.81, 'lon' => -90.7]],
+    );
+    app()->bind(SentinelTrafficClient::class, fn () => $fake);
+
+    loadLazy(Livewire::test(Analytics::class))
+        ->assertOk()
+        ->assertSee("O'Fallon <b>x</b>")
+        ->assertDontSeeHtml('<b>x</b></span>')
+        ->assertSeeHtml('focus([38.81, -90.7])');
+});
diff --git a/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php b/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php
index 58add72c10..870befc0f5 100644
--- a/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php
+++ b/tests/Feature/TrafficAnalytics/GlobalAnalyticsTest.php
@@ -149,8 +149,6 @@ it('renders a team-wide analytics summary across enabled servers', function () {
         ->assertSee('Global Leaderboard App')
         ->assertSee('Top hosts')
         ->assertSee('Top paths')
-        ->assertSee('3 4xx')
-        ->assertSee('1 5xx')
         ->assertSee('Status codes')
         ->assertSee('Countries')
         ->assertSee('United States')
@@ -490,7 +488,9 @@ it('labels the IP breakdown by the client IP mode of the queried servers', funct
         $component->assertDontSee('Top IPs')
             ->assertDontSee('Top networks')
             ->assertDontSee('203.0.113.7');
-        expect($component->instance()->breakdowns)->not->toHaveKey('ip');
+        // Sentinel finds the city from the client IP, so it stores no cities either.
+        expect($component->instance()->breakdowns)->not->toHaveKey('ip')
+            ->and($component->instance()->breakdowns)->not->toHaveKey('city');
 
         return;
     }
diff --git a/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php b/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php
index b3946c00ba..81c1cb5c6c 100644
--- a/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php
+++ b/tests/Feature/TrafficAnalytics/SentinelTrafficClientTest.php
@@ -95,10 +95,10 @@ it('accepts every known dimension and rejects unknown ones', function () {
     $client = new FakeTrafficClient($server);
     $client->response = json_encode([]);
 
-    foreach (['status', 'method', 'country', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot'] as $dimension) {
+    foreach (['status', 'method', 'country', 'city', 'referer', 'browser', 'os', 'device', 'protocol', 'scheme', 'tls', 'cache', 'bot'] as $dimension) {
         $client->breakdown(null, $dimension, 'a', 'b');
     }
-    expect($client->captured)->toHaveCount(12);
+    expect($client->captured)->toHaveCount(13);
 
     expect(fn () => $client->breakdown(null, 'not-a-real-dimension', 'a', 'b'))
         ->toThrow(InvalidArgumentException::class);
diff --git a/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php b/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php
index 9d53564fb7..3bb5a818f8 100644
--- a/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php
+++ b/tests/Feature/TrafficAnalytics/StartSentinelTrafficTest.php
@@ -180,6 +180,12 @@ it('starts sentinel with a restart policy so Docker restarts it after a crash or
     expect($script)->toContain('--name coolify-sentinel --restart unless-stopped ');
 });
 
+it('starts sentinel in the host user namespace so --pid host works on a userns-remap daemon', function () {
+    $script = runStartSentinelAndCaptureScript(sentinelTrafficServer($this, 'TRAEFIK', analyticsEnabled: false));
+
+    expect($script)->toContain('--userns host --pid host ');
+});
+
 it('does not touch the access log when traffic analytics cannot run', function (?string $proxyType, bool $analyticsEnabled) {
     $server = sentinelTrafficServer($this, $proxyType, $analyticsEnabled);
 
diff --git a/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php b/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php
index ef9f7325f6..fbcaaf2307 100644
--- a/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php
+++ b/tests/Feature/TrafficAnalytics/TrafficAnalyticsAggregatorTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Data\Traffic\TrafficBreakdownData;
 use App\Data\Traffic\TrafficOverviewData;
 use App\Services\TrafficAnalyticsAggregator;
 
@@ -24,3 +25,25 @@ it('returns a zeroed, non-approximate result for a single server', function () {
     expect($result['latencyApproximate'])->toBeFalse();
     expect($result['uniquesApproximate'])->toBeFalse();
 });
+
+it('sums one city from two servers and keeps the first coordinates', function () {
+    $aggregator = new TrafficAnalyticsAggregator(['city']);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE|BE|Berlin', 5, 500)]);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE|BE|Berlin', 4, 400, 52.52, 13.405)]);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE|BE|Berlin', 1, 100, 1.0, 2.0)]);
+
+    expect($aggregator->breakdowns()['city'])->toBe([
+        ['value' => 'DE|BE|Berlin', 'requests' => 10, 'bytesOut' => 1000, 'lat' => 52.52, 'lon' => 13.405],
+    ]);
+});
+
+it('adds no coordinate keys to rows that have none', function () {
+    $aggregator = new TrafficAnalyticsAggregator(['country', 'city']);
+    $aggregator->addBreakdown('country', [new TrafficBreakdownData('DE', 5, 500)]);
+    $aggregator->addBreakdown('city', [new TrafficBreakdownData('DE||', 5, 500)]);
+
+    expect($aggregator->breakdowns())->toBe([
+        'country' => [['value' => 'DE', 'requests' => 5, 'bytesOut' => 500]],
+        'city' => [['value' => 'DE||', 'requests' => 5, 'bytesOut' => 500]],
+    ]);
+});
diff --git a/tests/Feature/TrafficAnalytics/TrafficDataTest.php b/tests/Feature/TrafficAnalytics/TrafficDataTest.php
index b75fd0b550..7169b5b42c 100644
--- a/tests/Feature/TrafficAnalytics/TrafficDataTest.php
+++ b/tests/Feature/TrafficAnalytics/TrafficDataTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Data\Traffic\TrafficBreakdownData;
 use App\Data\Traffic\TrafficOverviewData;
 use App\Data\Traffic\TrafficPathData;
 
@@ -36,3 +37,26 @@ it('maps per-path error counters from sentinel', function () {
     expect($dto->s4xx)->toBe(3)
         ->and($dto->s5xx)->toBe(2);
 });
+
+it('maps city coordinates from sentinel', function () {
+    $dto = TrafficBreakdownData::fromSentinel([
+        'value' => 'DE|BE|Berlin', 'requests' => 9, 'bytes_out' => 900, 'lat' => 52.52, 'lon' => 13.405,
+    ]);
+
+    expect($dto->value)->toBe('DE|BE|Berlin')
+        ->and($dto->lat)->toBe(52.52)
+        ->and($dto->lon)->toBe(13.405);
+});
+
+it('leaves coordinates null when sentinel sends none or sends only one', function (array $row) {
+    $dto = TrafficBreakdownData::fromSentinel(['value' => 'DE||', 'requests' => 2, 'bytes_out' => 20] + $row);
+
+    expect($dto->lat)->toBeNull()->and($dto->lon)->toBeNull();
+})->with([
+    'none' => [[]],
+    'only lat' => [['lat' => 52.52]],
+    'not numeric' => [['lat' => 'x', 'lon' => 'y']],
+    'not finite' => [['lat' => INF, 'lon' => 13.4]],
+    'latitude out of range' => [['lat' => 91, 'lon' => 13.4]],
+    'longitude out of range' => [['lat' => 52.5, 'lon' => -181]],
+]);
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index ae9b4898e0..2d09e4ac8b 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -40,6 +40,7 @@ use Illuminate\Routing\Redirector;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Process;
@@ -49,6 +50,7 @@ use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\Storage;
 use Livewire\Livewire;
 use Symfony\Component\HttpKernel\Exception\HttpException;
+use Symfony\Component\Process\Process as SymfonyProcess;
 
 uses(RefreshDatabase::class);
 
@@ -464,34 +466,19 @@ it('splits scheduled backup settings and executions across dedicated urls', func
     $this->get($generalUrl)
         ->assertOk()
         ->assertSee('General')
-        ->assertSee('S3 storage')
-        ->assertSee('Retention')
         ->assertSee('Executions')
         ->assertSee('Danger Zone')
         ->assertSee('Backup schedule')
         ->assertSee('File-level consistency')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Review generated archives')
-        ->assertDontSee('Delete backup schedule');
-
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
         ->assertSeeText('No validated S3 storage')
-        ->assertDontSee('Local copy')
-        ->assertDontSee('Enable S3')
-        ->assertDontSee('Disable S3')
-        ->assertDontSee('Backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Review generated archives');
-
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
         ->assertSee('Local backups')
         ->assertSee('S3 backups')
         ->assertSee('Backups to keep')
-        ->assertDontSee('File-level consistency')
-        ->assertDontSee('Review generated archives');
+        ->assertDontSee('Review generated archives')
+        ->assertDontSee('Delete backup schedule');
+
+    $this->get($generalUrl.'/s3')->assertRedirect($generalUrl);
+    $this->get($generalUrl.'/retention')->assertRedirect($generalUrl);
 
     $this->get($generalUrl.'/executions')
         ->assertOk()
@@ -747,16 +734,21 @@ it('renders volume backup executions like database backup executions', function
         'team_id' => $team->id,
         'frequency' => 'daily',
     ]);
+    $this->travelTo(Carbon::parse('2026-10-16 14:00:00', 'UTC'));
     ScheduledVolumeBackupExecution::create([
         'scheduled_volume_backup_id' => $backup->id,
         'status' => 'success',
         'filename' => '/data/coolify/backups/volumes/test/archive.tar.gz',
         'size' => 1024,
-        'finished_at' => now(),
+        'finished_at' => Carbon::parse('2026-10-16 14:30:05', 'UTC'),
     ]);
+    $this->travelTo(Carbon::parse('2026-10-16 18:00:00', 'UTC'));
 
     Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application, 'section' => 'executions'])
         ->assertSet('timezone', 'Europe/Budapest')
+        ->assertSee('2026-10-16 16:30:05 CEST')
+        ->assertSee('Started: 2026-10-16 16:00:00 CEST', false)
+        ->assertSee('3 hours ago')
         ->assertSeeInOrder([
             'Executions',
             'Status',
@@ -947,7 +939,6 @@ it('enables and disables volume S3 backups from the S3 title action', function (
     $component = Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->assertSee('Enable S3')
         ->assertDontSee('You do not have permission to perform this action.')
@@ -980,7 +971,6 @@ it('persists S3 settings the first time when a volume backup schedule does not e
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->assertSet('s3StorageIds', [$s3Storage->id])
         ->call('toggleS3')
@@ -1012,7 +1002,6 @@ it('persists the selected S3 storage when a volume backup schedule does not exis
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->set('s3StorageIds', [$s3Storage->id])
         ->assertDispatched('success');
@@ -1036,7 +1025,6 @@ it('shows and saves volume S3 retention while S3 backups are disabled', function
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 'retention',
     ])
         ->assertSee('S3 backups')
         ->set('retentionAmountS3', 12)
@@ -1063,7 +1051,6 @@ it('allows team owners to edit volume backup retention settings', function () {
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 'retention',
     ])->assertDontSee('You do not have permission to perform this action.');
 });
 
@@ -1090,7 +1077,6 @@ it('does not enable S3 backups when another volume backup setting is invalid', f
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->set('frequency', 'not a valid schedule')
         ->call('toggleS3')
@@ -1134,7 +1120,6 @@ it('does not change S3 storage when another volume backup setting is invalid', f
     Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->set('frequency', 'not a valid schedule')
         ->set('s3StorageIds', [$secondS3Storage->id])
@@ -1378,7 +1363,7 @@ it('saves the selected volume backup S3 storage immediately while S3 is disabled
         's3_storage_id' => $firstS3Storage->id,
     ]);
 
-    Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application, 'section' => 's3'])
+    Livewire::test(VolumeBackups::class, ['storage' => $volume, 'resource' => $application])
         ->set('s3StorageIds', [$secondS3Storage->id])
         ->assertDispatched('success');
 
@@ -1413,7 +1398,6 @@ it('saves the archive behavior immediately and the local copy with the S3 form',
     $s3Component = Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ]);
     // The local copy choice belongs to the S3 form and is persisted by its explicit save.
     $s3Component->set('disableLocalBackup', true)->call('save')->assertDispatched('success');
@@ -1440,14 +1424,12 @@ it('allows volume S3 backups to be disabled when no usable storage remains', fun
     $component = Livewire::test(VolumeBackups::class, [
         'storage' => $volume,
         'resource' => $application,
-        'section' => 's3',
     ])
         ->assertSet('saveToS3', true)
         ->assertSeeText('S3 storage')
         ->assertSeeText('No validated S3 storage')
         ->assertSeeHtml('href="'.route('storage.index').'"')
         ->assertSeeText('Open S3 storage')
-        ->assertDontSee('Save')
         ->assertDontSee('Disable S3')
         ->assertDontSee('Local copy')
         ->call('toggleS3')
@@ -2026,8 +2008,10 @@ it('streams S3-only volume backups without creating or copying a local archive',
     $expectedFilename = 'volume-app-data-1786795200.tar.gz';
     Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
         && str_contains($process->command, 'mc pipe')
+        && ! str_contains($process->command, '--quiet')
         && str_contains($process->command, '>/dev/null && (compressor=')
-        && str_contains($process->command, '>/dev/null) && mc stat')
+        && str_contains($process->command, '>/dev/null 2>/tmp/mc-pipe.log || {')
+        && str_contains($process->command, '/tmp/mc-pipe.log >&2; exit $status; }) && mc stat')
         && str_contains($process->command, 'temporary/bucket/')
         && str_contains($process->command, $expectedFilename)
         && substr_count($process->command, '--resolve') === 3
@@ -2374,10 +2358,69 @@ it('stops and restarts containers that use the volume when requested', function
         && str_contains($process->command, 'state_file='));
     Process::assertRan(fn ($process) => str_contains($process->command, '{{println .Source}}{{println .Name}}')
         && str_contains($process->command, "grep -Fqx -- 'app-data'")
-        && str_contains($process->command, '{{.State.Paused}}')
+        && str_contains($process->command, '{{if not .State.Paused}}')
         && str_contains($process->command, 'continue'));
 });
 
+/**
+ * Runs the recorded container scan script in a local shell with a fake `docker` binary.
+ *
+ * @return array{exit_code: int, output: string}
+ */
+function runVolumeContainerScan(string $fakeDocker): array
+{
+    $scan = '';
+    Process::assertRan(function ($process) use (&$scan): bool {
+        if (! str_contains($process->command, 'docker ps -q')) {
+            return false;
+        }
+        $scan = $process->command;
+
+        return true;
+    });
+    $script = implode("\n", array_slice(explode("\n", $scan), 1, -1));
+
+    $bin = sys_get_temp_dir().'/volume-scan-'.uniqid();
+    mkdir($bin);
+    file_put_contents("{$bin}/docker", "#!/bin/sh\n{$fakeDocker}");
+    chmod("{$bin}/docker", 0755);
+
+    $result = new SymfonyProcess(['sh', '-c', $script], env: ['PATH' => $bin.':'.getenv('PATH')]);
+    $result->run();
+    File::deleteDirectory($bin);
+
+    return ['exit_code' => $result->getExitCode(), 'output' => trim($result->getOutput())];
+}
+
+it('skips containers that are removed while scanning for volume users', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'stop_during_backup' => true,
+    ]);
+
+    Process::fake(['*du -b*' => '128', '*' => '']);
+    (new VolumeBackupJob($backup))->handle();
+
+    $docker = <<<'SH'
+case "$*" in
+  "ps -q") printf 'aaa111\nbbb222\nccc333\n' ;;
+  "ps -aq --filter id=aaa111") ;;
+  "ps -aq --filter id=ccc333") echo ccc333 ;;
+  *aaa111*) echo 'error: no such object: aaa111' >&2; exit 1 ;;
+  *bbb222*) printf '/var/lib/docker/volumes/app-data/_data\napp-data\n' ;;
+  *ccc333*) [ "$CCC_BROKEN" = 1 ] && { echo 'daemon error' >&2; exit 1; }; printf 'other\n' ;;
+esac
+SH;
+
+    expect(runVolumeContainerScan($docker))->toBe(['exit_code' => 0, 'output' => 'bbb222'])
+        ->and(runVolumeContainerScan("CCC_BROKEN=1\n".$docker)['exit_code'])->not->toBe(0);
+});
+
 it('finds containers using a bind mounted host path before stopping', function () {
     config(['broadcasting.default' => 'null']);
     InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
@@ -2924,3 +2967,45 @@ it('records a missed volume backup that is too old to run late as a failed execu
     Notification::assertSentToTimes($team, BackupFailed::class, 1);
     Notification::assertSentTo($team, BackupFailed::class, fn (BackupFailed $notification) => $notification->output === 'Skipped: the queued job did not start within 60 minutes.');
 });
+
+it('fails the volume archive only on fatal tar errors', function (int $tarExitCode, int $expectedExitCode) {
+    $bin = sys_get_temp_dir().'/volume-backup-tar-'.uniqid();
+    mkdir($bin);
+    file_put_contents($bin.'/tar', "#!/bin/sh\nexit {$tarExitCode}\n");
+    chmod($bin.'/tar', 0755);
+
+    $result = Process::env(['PATH' => $bin.':/usr/bin:/bin'])
+        ->run(['sh', '-c', VolumeBackupJob::archiveScript(50)]);
+
+    unlink($bin.'/tar');
+    rmdir($bin);
+
+    expect($result->exitCode())->toBe($expectedExitCode);
+})->with([
+    'success' => [0, 0],
+    'file changed as we read it' => [1, 0],
+    'fatal error' => [2, 2],
+]);
+
+it('shows the backup actions in the header bar on every application backup page', function () {
+    config(['cache.default' => 'array', 'app.maintenance.driver' => 'file']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+    ]);
+    $showUrl = route('project.application.backup.show', [
+        'project_uuid' => $application->project()->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
+
+    foreach (['', '/executions', '/danger'] as $suffix) {
+        expect($this->get($showUrl.$suffix)->assertOk()->getContent())
+            ->toMatch('/x-teleport="#resource-action-hud-slot".*?wire:click="toggleEnabled".*?Disable backup.*?wire:click="backupNow"/s');
+    }
+});
diff --git a/tests/Feature/Webhook/GitAppWebhookSetupTest.php b/tests/Feature/Webhook/GitAppWebhookSetupTest.php
new file mode 100644
index 0000000000..22007f24f6
--- /dev/null
+++ b/tests/Feature/Webhook/GitAppWebhookSetupTest.php
@@ -0,0 +1,82 @@
+<?php
+
+use App\Livewire\Project\Shared\Webhooks;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->admin = User::factory()->create();
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'git_repository' => 'test-org/test-repo',
+        'git_branch' => 'main',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+});
+
+afterEach(function () {
+    Server::flushIdentityMap();
+});
+
+test('GitLab App sources show the source webhook instead of claiming automatic setup', function () {
+    $gitlabApp = GitlabApp::create([
+        'name' => 'gitlab-app-webhook-setup-test',
+        'api_url' => 'https://gitlab.example.com/api/v4',
+        'html_url' => 'https://gitlab.example.com',
+        'webhook_token' => 'test-webhook-token',
+        'team_id' => $this->team->id,
+    ]);
+    $this->application->update(['source_id' => $gitlabApp->id, 'source_type' => GitlabApp::class]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+        ->assertSet('gitlabAppWebhook', url('/webhooks/source/gitlab/events'))
+        ->assertSee(url('/webhooks/source/gitlab/events'))
+        ->assertSee(route('source.gitlab.show', ['gitlab_app_uuid' => $gitlabApp->uuid]))
+        ->assertDontSee('test-webhook-token')
+        ->assertDontSee('Managed by your Git App');
+});
+
+test('GitHub App sources still show that webhooks are managed by the app', function () {
+    $githubApp = GithubApp::create([
+        'name' => 'github-app-webhook-setup-test',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'webhook_secret' => 'test-secret',
+        'is_public' => false,
+        'team_id' => $this->team->id,
+    ]);
+    $this->application->update(['source_id' => $githubApp->id, 'source_type' => GithubApp::class]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+        ->assertSet('gitlabAppWebhook', null)
+        ->assertSee('Managed by your Git App')
+        ->assertDontSee('/webhooks/source/gitlab/events');
+});
diff --git a/tests/Feature/Webhook/GitlabSystemHookTest.php b/tests/Feature/Webhook/GitlabSystemHookTest.php
new file mode 100644
index 0000000000..8856846918
--- /dev/null
+++ b/tests/Feature/Webhook/GitlabSystemHookTest.php
@@ -0,0 +1,278 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Testing\TestResponse;
+use Tests\TestCase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Queue::fake();
+    InstanceSettings::forceCreate(['id' => 0]);
+});
+
+function gitlabSystemHookSha(): string
+{
+    return 'da1560886d4f094c3e6c9ef40349f7d38b5d27d7';
+}
+
+function gitlabSystemHookSource(string $token): GitlabApp
+{
+    return GitlabApp::create([
+        'name' => "gitlab-system-hook-{$token}",
+        'api_url' => 'https://gitlab.example.com/api/v4',
+        'html_url' => 'https://gitlab.example.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'webhook_token' => $token,
+        'team_id' => Team::factory()->create()->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+}
+
+function gitlabSystemHookApplication(GitlabApp $source, int $projectId = 15, string $branch = 'main'): Application
+{
+    $project = Project::factory()->create(['team_id' => $source->team_id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $source->team_id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $application = Application::create([
+        'name' => "gitlab-system-hook-app-{$source->id}",
+        'git_repository' => 'mike/diaspora',
+        'git_branch' => $branch,
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'source_id' => $source->id,
+        'source_type' => GitlabApp::class,
+        'repository_project_id' => $projectId,
+    ]);
+    $application->settings->update([
+        'is_auto_deploy_enabled' => true,
+        'is_preview_deployments_enabled' => true,
+    ]);
+
+    return $application->refresh();
+}
+
+/**
+ * A push payload in the shape of the GitLab system hook docs example: it has
+ * `event_name` and a top-level `project_id`, but no `object_kind` and no `project.id`.
+ *
+ * @see https://docs.gitlab.com/administration/system_hooks/#push-events
+ *
+ * @return array<string, mixed>
+ */
+function gitlabSystemHookDocumentedPush(int $projectId = 15, string $ref = 'refs/heads/main'): array
+{
+    return [
+        'event_name' => 'push',
+        'before' => '95790bf891e76fee5e1747ab589903a6a1f80f22',
+        'after' => gitlabSystemHookSha(),
+        'ref' => $ref,
+        'checkout_sha' => gitlabSystemHookSha(),
+        'user_id' => 4,
+        'project_id' => $projectId,
+        'project' => ['name' => 'Diaspora', 'path_with_namespace' => 'mike/diaspora', 'default_branch' => 'main'],
+        'commits' => [[
+            'id' => gitlabSystemHookSha(),
+            'message' => 'Add simple search to projects in public area',
+            'added' => ['app.php'],
+            'modified' => [],
+            'removed' => [],
+        ]],
+        'total_commits_count' => 1,
+    ];
+}
+
+/**
+ * A push payload as current GitLab sends it to system hooks
+ * (Gitlab::DataBuilder::Push, the same data as for project hooks).
+ *
+ * @return array<string, mixed>
+ */
+function gitlabSystemHookRuntimePush(int $projectId = 15): array
+{
+    $payload = gitlabSystemHookDocumentedPush($projectId);
+    $payload['object_kind'] = 'push';
+    $payload['project']['id'] = $projectId;
+
+    return $payload;
+}
+
+/**
+ * @return array<string, mixed>
+ */
+function gitlabSystemHookMergeRequest(int $projectId = 15, string $action = 'open'): array
+{
+    return [
+        'object_kind' => 'merge_request',
+        'event_type' => 'merge_request',
+        'project' => ['id' => $projectId, 'path_with_namespace' => 'mike/diaspora'],
+        'object_attributes' => [
+            'action' => $action,
+            'iid' => 1,
+            'url' => 'https://gitlab.example.com/mike/diaspora/-/merge_requests/1',
+            'title' => 'MS-Viewport',
+            'source_branch' => 'ms-viewport',
+            'target_branch' => 'main',
+            'source_project_id' => $projectId,
+            'target_project_id' => $projectId,
+            'last_commit' => ['id' => gitlabSystemHookSha(), 'message' => 'Fix viewport'],
+        ],
+    ];
+}
+
+/**
+ * @param  array<string, mixed>  $payload
+ */
+function gitlabSystemHookSend(TestCase $test, array $payload, ?string $token, string $event = 'System Hook'): TestResponse
+{
+    $headers = ['HTTP_X-Gitlab-Event' => $event];
+    if ($token !== null) {
+        $headers['HTTP_X-Gitlab-Token'] = $token;
+    }
+
+    return $test->call('POST', '/webhooks/source/gitlab/events', [], [], [], $headers + [
+        'REMOTE_ADDR' => '203.0.113.20',
+        'CONTENT_TYPE' => 'application/json',
+    ], json_encode($payload, JSON_THROW_ON_ERROR));
+}
+
+function gitlabSystemHookDeployments(Application $application): array
+{
+    return ApplicationDeploymentQueue::query()->where('application_id', $application->id)->pluck('commit')->all();
+}
+
+describe('GitLab system hook push', function () {
+    test('a push to the tracked branch queues a deployment', function (array $payload) {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, $payload, 'system-hook-token')
+            ->assertOk()
+            ->assertJsonPath('0.application', $application->name);
+
+        expect(gitlabSystemHookDeployments($application))->toBe([gitlabSystemHookSha()]);
+    })->with([
+        'documented payload' => [fn () => gitlabSystemHookDocumentedPush()],
+        'runtime payload' => [fn () => gitlabSystemHookRuntimePush()],
+    ]);
+
+    test('a push to another branch queues no deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(ref: 'refs/heads/develop'), 'system-hook-token')->assertOk();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    });
+
+    test('a push for a project that no application tracks queues no deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source, projectId: 15);
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(projectId: 99), 'system-hook-token')
+            ->assertOk()
+            ->assertExactJson([]);
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    });
+
+    test('a token only deploys applications of its own source', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $otherSource = gitlabSystemHookSource('other-source-token');
+        $application = gitlabSystemHookApplication($source);
+        $otherApplication = gitlabSystemHookApplication($otherSource);
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(), 'system-hook-token')->assertOk();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([gitlabSystemHookSha()])
+            ->and(gitlabSystemHookDeployments($otherApplication))->toBe([]);
+    });
+
+    test('a missing or invalid token is rejected', function (?string $token) {
+        $application = gitlabSystemHookApplication(gitlabSystemHookSource('system-hook-token'));
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(), $token)->assertUnauthorized();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    })->with([
+        'missing' => [null],
+        'invalid' => ['wrong-token'],
+    ]);
+});
+
+describe('GitLab system hook merge request', function () {
+    test('an opened merge request queues a preview deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, gitlabSystemHookMergeRequest(), 'system-hook-token')->assertOk();
+
+        expect(ApplicationPreview::query()->where('application_id', $application->id)->pluck('pull_request_id')->all())->toBe([1])
+            ->and(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->sole()->pull_request_id)->toBe(1);
+    });
+});
+
+describe('GitLab system hook events without a deployment', function () {
+    test('the event is ignored without an error', function (array $payload) {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+
+        gitlabSystemHookSend($this, $payload, 'system-hook-token')
+            ->assertOk()
+            ->assertJsonPath('status', 'failed')
+            ->assertJsonPath('message', 'Event not allowed. Only push and merge_request events are allowed.');
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    })->with([
+        'project_create' => [['event_name' => 'project_create', 'project_id' => 15, 'name' => 'Diaspora', 'path_with_namespace' => 'mike/diaspora']],
+        'user_create' => [['event_name' => 'user_create', 'user_id' => 41, 'username' => 'js', 'email' => 'js@gitlabhq.com']],
+        'repository_update' => [['event_name' => 'repository_update', 'project_id' => 15, 'changes' => [['ref' => 'refs/heads/main', 'after' => gitlabSystemHookSha()]], 'refs' => ['refs/heads/main']]],
+        'tag_push' => [['event_name' => 'tag_push', 'ref' => 'refs/tags/v1.0.0', 'after' => gitlabSystemHookSha(), 'project_id' => 15, 'commits' => []]],
+    ]);
+});
+
+describe('GitLab project webhook', function () {
+    test('a push to the tracked branch still queues a deployment', function () {
+        $source = gitlabSystemHookSource('system-hook-token');
+        $application = gitlabSystemHookApplication($source);
+        $payload = gitlabSystemHookRuntimePush();
+        unset($payload['event_name'], $payload['project_id']);
+
+        gitlabSystemHookSend($this, $payload, 'system-hook-token', event: 'Push Hook')->assertOk();
+
+        expect(gitlabSystemHookDeployments($application))->toBe([gitlabSystemHookSha()]);
+    });
+
+    test('a payload without object_kind is still rejected', function () {
+        $application = gitlabSystemHookApplication(gitlabSystemHookSource('system-hook-token'));
+
+        gitlabSystemHookSend($this, gitlabSystemHookDocumentedPush(), 'system-hook-token', event: 'Push Hook')
+            ->assertOk()
+            ->assertJsonPath('message', 'Event not allowed. Only push and merge_request events are allowed.');
+
+        expect(gitlabSystemHookDeployments($application))->toBe([]);
+    });
+});
diff --git a/tests/Feature/Webhook/ManualWebhookSecretStrengthTest.php b/tests/Feature/Webhook/ManualWebhookSecretStrengthTest.php
index 508b90d558..1b65e9b58d 100644
--- a/tests/Feature/Webhook/ManualWebhookSecretStrengthTest.php
+++ b/tests/Feature/Webhook/ManualWebhookSecretStrengthTest.php
@@ -112,34 +112,30 @@ describe('Webhooks component', function () {
         expect($this->application->fresh()->manual_webhook_secret_github)->toBeEmpty();
     });
 
-    test('generate returns a random secret of at least 32 characters that saves with the form', function () {
-        $generated = null;
-
+    test('generate saves a random secret of at least 32 characters for that provider only', function () {
         $component = manualWebhookSecretComponent()
+            ->set('githubManualWebhookSecret', 'unsaved-github-edit')
             ->call('generateSecret', 'gitlab')
             ->assertHasNoErrors()
-            ->assertReturned(function ($secret) use (&$generated) {
-                $generated = $secret;
-
-                return is_string($secret) && strlen($secret) >= 32;
-            })
-            ->assertSet('gitlabManualWebhookSecret', 'gitlab-legacy');
-
-        expect($this->application->fresh()->manual_webhook_secret_gitlab)->toBe('gitlab-legacy');
-
-        $component->set('gitlabManualWebhookSecret', $generated)
-            ->call('submit')
-            ->assertHasNoErrors()
             ->assertDispatched('success');
 
-        expect($this->application->fresh()->manual_webhook_secret_gitlab)->toBe($generated);
+        $generated = $component->get('gitlabManualWebhookSecret');
+        $application = $this->application->fresh();
+
+        expect($generated)->toBeString()->not->toBe('gitlab-legacy')
+            ->and(strlen($generated))->toBeGreaterThanOrEqual(32)
+            ->and($application->manual_webhook_secret_gitlab)->toBe($generated)
+            ->and($application->manual_webhook_secret_github)->toBe('short-legacy');
+
+        $component->assertSet('githubManualWebhookSecret', 'unsaved-github-edit')
+            ->assertSet('savedSecrets.gitlabManualWebhookSecret', $generated)
+            ->assertSet('savedSecrets.githubManualWebhookSecret', 'short-legacy');
     });
 
     test('generate rejects an unknown provider', function () {
         manualWebhookSecretComponent()
             ->call('generateSecret', 'deploywebhook')
-            ->assertDispatched('error')
-            ->assertReturned(null);
+            ->assertDispatched('error');
     });
 
     test('shows generate buttons only to users who can edit secrets', function () {
@@ -158,9 +154,11 @@ describe('Webhooks component', function () {
         session(['currentTeam' => $this->team]);
 
         Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+            ->assertSet('savedSecrets', [])
             ->call('generateSecret', 'github')
-            ->assertDispatched('error')
-            ->assertReturned(null);
+            ->assertDispatched('error');
+
+        expect($this->application->fresh()->manual_webhook_secret_github)->toBe('short-legacy');
     });
 });
 
diff --git a/tests/Feature/Webhook/WebhookHmacTest.php b/tests/Feature/Webhook/WebhookHmacTest.php
index 1ff2e2c742..2a24b177cc 100644
--- a/tests/Feature/Webhook/WebhookHmacTest.php
+++ b/tests/Feature/Webhook/WebhookHmacTest.php
@@ -917,139 +917,33 @@ describe('Manual Webhook Repository Matching', function () {
         ],
     ]);
 
-    test('github matches ssh git repository URL exactly', function () {
-        $app = createApplicationWithWebhook(overrides: [
-            'git_repository' => 'git@github.com:test-org/test-repo.git',
-        ]);
-        $secret = $app->manual_webhook_secret_github;
+    test('signed pushes deploy applications whose repository URL names the pushed repository', function (string $provider, string $gitRepository) {
+        Queue::fake();
+        $application = makeWebhookApplicationServerFunctional(createApplicationWithWebhook(overrides: [
+            'git_repository' => $gitRepository,
+        ]));
 
-        $payload = json_encode([
-            'ref' => 'refs/heads/main',
-            'repository' => ['full_name' => 'test-org/test-repo'],
-            'after' => 'abc1234',
-            'commits' => [],
-        ]);
+        sendManualWebhookPush($this, $provider, $application)->assertOk();
 
-        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
-            'HTTP_X-GitHub-Event' => 'push',
-            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, $secret),
-            'CONTENT_TYPE' => 'application/json',
-        ], $payload);
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeTrue();
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea'])->with([
+        'scp-style' => 'git@git.example.com:test-org/test-repo.git',
+        'scp-style with custom port' => 'git@10.0.0.80:2222/test-org/test-repo.git',
+        'scp-style with custom user and port' => 'custom-user@git.example.com:2222/test-org/test-repo.git',
+        'ssh scheme with custom port' => 'ssh://git@10.0.0.80:2222/test-org/test-repo.git',
+        'https with different case' => 'https://github.com/Test-Org/Test-Repo.git',
+    ]);
 
-        $response->assertOk();
-        expect($response->getContent())->not->toContain('No applications found');
-    });
+    test('signed pushes do not deploy applications for another repository', function (string $provider) {
+        Queue::fake();
+        $application = makeWebhookApplicationServerFunctional(createApplicationWithWebhook(overrides: [
+            'git_repository' => 'git@10.0.0.80:2222/other-org/test-repo.git',
+        ]));
 
-    test('github matches an ssh repository URL with a non-git username', function () {
-        $app = createApplicationWithWebhook(overrides: [
-            'git_repository' => 'custom-user@git.example.com:test-org/test-repo.git',
-        ]);
-        $secret = $app->manual_webhook_secret_github;
+        sendManualWebhookPush($this, $provider, $application)->assertOk();
 
-        $payload = json_encode([
-            'ref' => 'refs/heads/main',
-            'repository' => ['full_name' => 'test-org/test-repo'],
-            'after' => 'abc1234',
-            'commits' => [],
-        ]);
-
-        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
-            'HTTP_X-GitHub-Event' => 'push',
-            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, $secret),
-            'CONTENT_TYPE' => 'application/json',
-        ], $payload);
-
-        $response->assertOk();
-        expect($response->getContent())->not->toContain('No applications found');
-    });
-
-    test('github matches an ssh repository URL with a non-git username and custom port', function () {
-        $app = createApplicationWithWebhook(overrides: [
-            'git_repository' => 'custom-user@git.example.com:2222/test-org/test-repo.git',
-        ]);
-        $secret = $app->manual_webhook_secret_github;
-
-        $payload = json_encode([
-            'ref' => 'refs/heads/main',
-            'repository' => ['full_name' => 'test-org/test-repo'],
-            'after' => 'abc1234',
-            'commits' => [],
-        ]);
-
-        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
-            'HTTP_X-GitHub-Event' => 'push',
-            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, $secret),
-            'CONTENT_TYPE' => 'application/json',
-        ], $payload);
-
-        $response->assertOk();
-        expect($response->getContent())->not->toContain('No applications found');
-    });
-
-    test('gitlab matches scp-style ssh repository URL with custom port', function () {
-        $app = createApplicationWithWebhook(overrides: [
-            'git_repository' => 'git@gitlab.example.com:2222/services/xyz.git',
-            'git_branch' => 'master',
-        ]);
-        $secret = $app->manual_webhook_secret_gitlab;
-
-        $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
-            'object_kind' => 'push',
-            'ref' => 'refs/heads/master',
-            'project' => ['path_with_namespace' => 'services/xyz'],
-            'after' => 'abc1234',
-            'commits' => [],
-        ], [
-            'X-Gitlab-Token' => $secret,
-        ]);
-
-        $response->assertOk();
-        expect($response->getContent())->not->toContain('No applications found');
-    });
-
-    test('gitlab matches scp-style ssh repository URL without port', function () {
-        $app = createApplicationWithWebhook(overrides: [
-            'git_repository' => 'git@gitlab.example.com:services/xyz.git',
-            'git_branch' => 'master',
-        ]);
-        $secret = $app->manual_webhook_secret_gitlab;
-
-        $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
-            'object_kind' => 'push',
-            'ref' => 'refs/heads/master',
-            'project' => ['path_with_namespace' => 'services/xyz'],
-            'after' => 'abc1234',
-            'commits' => [],
-        ], [
-            'X-Gitlab-Token' => $secret,
-        ]);
-
-        $response->assertOk();
-        expect($response->getContent())->not->toContain('No applications found');
-    });
-
-    test('github matches repository case-insensitively', function () {
-        $app = createApplicationWithWebhook(overrides: [
-            'git_repository' => 'https://github.com/Test-Org/Test-Repo.git',
-        ]);
-        $secret = $app->manual_webhook_secret_github;
-
-        $payload = json_encode([
-            'ref' => 'refs/heads/main',
-            'repository' => ['full_name' => 'test-org/test-repo'],
-            'after' => 'abc1234',
-            'commits' => [],
-        ]);
-
-        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
-            'HTTP_X-GitHub-Event' => 'push',
-            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, $secret),
-            'CONTENT_TYPE' => 'application/json',
-        ], $payload);
-
-        $response->assertOk();
-        expect($response->getContent())->not->toContain('No applications found');
-    });
+        expect(ApplicationDeploymentQueue::query()->where('application_id', $application->id)->exists())->toBeFalse();
+    })->with(['github', 'gitlab', 'bitbucket', 'gitea']);
 });
 
 describe('Webhook Secret Auto-Generation', function () {
diff --git a/tests/Feature/Webhook/WebhookPayloadTypesTest.php b/tests/Feature/Webhook/WebhookPayloadTypesTest.php
index 1ae841252e..cdc70f29fe 100644
--- a/tests/Feature/Webhook/WebhookPayloadTypesTest.php
+++ b/tests/Feature/Webhook/WebhookPayloadTypesTest.php
@@ -285,7 +285,6 @@ function webhookTypesFields(): array
             ['number', 'id', null],
             ['pull_request.html_url', 'url', null],
             ['pull_request.title', 'string', null],
-            ['pull_request.author_association', 'string', null],
             ['pull_request.head.ref', 'branch', 'No branch'],
             ['pull_request.base.ref', 'branch', 'No branch'],
             ['pull_request.head.sha', 'sha', null],
@@ -311,7 +310,6 @@ function webhookTypesFields(): array
             ['number', 'id', null],
             ['pull_request.html_url', 'url', null],
             ['pull_request.title', 'string', null],
-            ['pull_request.author_association', 'string', null],
             ['pull_request.head.ref', 'branch', 'No id or branch'],
             ['pull_request.base.ref', 'branch', 'No id or branch'],
             ['pull_request.head.sha', 'sha', null],
@@ -473,11 +471,20 @@ describe('Webhook payload value types', function () {
             && $job->pullRequestHtmlUrl === 'https://github.com/test-org/test-repo/pull/42'
             && $job->pullRequestTitle === 'Add feature'
             && $job->commitSha === webhookTypesSha()
-            && $job->authorAssociation === 'OWNER'
             && $job->fullName === 'test-org/test-repo'
             && $job->isForkPullRequest === false);
     })->with(['github manual', 'github app'])->with(['open', 'closed']);
 
+    test('a github pull request is queued as a fork when its head repository is unknown', function (string $handler) {
+        $application = webhookTypesApplication($handler);
+        $payload = webhookTypesPayload($handler, 'pr');
+        unset($payload['pull_request']['head']['repo']);
+
+        webhookTypesSend($this, $handler, 'pr', 'open', $application, $payload)->assertOk();
+
+        Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->isForkPullRequest === true);
+    })->with(['github manual', 'github app']);
+
     test('a github pull request with a numeric string number and sync shas is queued', function (string $handler) {
         $application = webhookTypesApplication($handler);
         $payload = webhookTypesPayload($handler, 'pr');
diff --git a/tests/Fixtures/parser/application-reference.yaml b/tests/Fixtures/parser/application-reference.yaml
new file mode 100644
index 0000000000..9f40212547
--- /dev/null
+++ b/tests/Fixtures/parser/application-reference.yaml
@@ -0,0 +1,142 @@
+# Reference compose for the application parser (Docker Compose build pack, applicationParser).
+# Test-only: tests/Feature/ServiceParserReferenceTest.php parses it and compares the result
+# with tests/Fixtures/parser/expected/application-*.yaml. Each service covers one group of parser features.
+services:
+  # Domain from a magic variable with a port, all environment syntaxes, magic secrets, labels, volumes.
+  web:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        - BUILD_VERSION=${BUILD_VERSION:-1.0.0}
+    environment:
+      - SERVICE_URL_WEB_3000
+      - LITERAL=plain-value
+      - BARE_PASSTHROUGH
+      - WITH_DEFAULT=${WITH_DEFAULT:-fallback}
+      - REQUIRED=${REQUIRED:?REQUIRED must be set}
+      - NO_BRACES=$NO_BRACES_VALUE
+      - NESTED=${NESTED_OUTER:-${NESTED_INNER:-inner-default}}
+      - NESTED_NO_DEFAULT=${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}
+      - DASH_DEFAULT=${DASH_DEFAULT_VAR-dash-default}
+      - NO_BRACES_DEFAULT=$NO_BRACES_DEFAULT_VAR:-no-braces-default
+      - NO_BRACES_MAGIC=$SERVICE_PASSWORD_NOBRACES
+      - SELF_REF=${SELF_REF}
+      - SHARED={{environment.SHARED_KEY}}
+      - PASSWORD=${SERVICE_PASSWORD_WEB}
+      - BASE64_64=${SERVICE_BASE64_64_WEB}
+      - HEX_32=${SERVICE_HEX_32_WEB}
+      - USER=${SERVICE_USER_WEB}
+      - API_URL=${SERVICE_URL_API}
+    labels:
+      com.example.team: platform
+      com.example.dollar: price-$5
+    volumes:
+      - web-data:/app/data
+      - ./config:/app/config:ro
+      - ./selinux:/app/selinux:z
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - type: bind
+        source: ./web-init.sh
+        target: /docker-entrypoint.d/init.sh
+        read_only: true
+        content: |
+          #!/bin/sh
+          echo "application reference fixture"
+    depends_on:
+      db:
+        condition: service_healthy
+
+  # Path value with FQDN declaration, image only, ports, map-style environment.
+  api:
+    image: node:22-alpine
+    environment:
+      SERVICE_FQDN_API: /api
+      MAP_LITERAL: map-value
+      MAP_NULL:
+    ports:
+      - "3001:3001"
+      - target: 3002
+        published: 3002
+        protocol: tcp
+    expose:
+      - 3001
+    volumes:
+      - shared-external:/shared
+      - nfs-data:/mnt/nfs
+
+  # Hyphenated and dotted service names.
+  my-app:
+    image: httpd:2.4-alpine
+    environment:
+      - SERVICE_URL_MY_APP_80
+  api.v2:
+    image: traefik/whoami
+
+  # SERVICE_FQDN_ declaration with a port.
+  admin:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_ADMIN_8080
+    networks:
+      internal:
+        ipv4_address: 172.30.0.10
+
+  # Ghost image with a path domain: extra redirect labels.
+  blog:
+    image: ghost:5-alpine
+    environment:
+      - SERVICE_URL_BLOG_2368=/blog
+
+  # Database image: no domain, no proxy labels.
+  db:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=${SERVICE_USER_DB}
+      - POSTGRES_PASSWORD=${SERVICE_PASSWORD_DB}
+      - POSTGRES_DB=app
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    networks:
+      - internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
+      interval: 5s
+
+  # restart "no", network_mode and a worker without a domain.
+  sidecar:
+    image: busybox
+    restart: "no"
+    network_mode: "service:web"
+    command: ["true"]
+  worker:
+    image: node:22-alpine
+    command: ["node", "worker.js"]
+    environment:
+      - APP_URL=${SERVICE_URL_WEB}
+      - APP_URL_WITH_PORT=${SERVICE_URL_WEB_3000}
+      - API_HOST=${SERVICE_FQDN_API}
+    depends_on:
+      - db
+
+volumes:
+  web-data:
+  db-data:
+    driver_opts:
+      type: none
+      o: bind
+      device: /srv/db
+  shared-external:
+    external: true
+  nfs-data:
+    driver_opts:
+      type: nfs
+      o: addr=10.0.0.2,rw
+      device: ":/exports/data"
+
+networks:
+  internal:
+  default:
+  aliased:
+    aliases:
+      - alias-name
diff --git a/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml b/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml
new file mode 100644
index 0000000000..1d5f6c0885
--- /dev/null
+++ b/tests/Fixtures/parser/expected/application-with-exact-caddy-labels.yaml
@@ -0,0 +1,2538 @@
+1_deploy:
+  docker_compose_domains:
+    web:
+      domain: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    api:
+      domain: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    my-app:
+      domain: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io:80'
+    admin:
+      domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
+    blog:
+      domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: web-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: api-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_FQDN: 'blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/blog:2368*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+2_custom_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: www.api.example.com
+    SERVICE_FQDN_API_V2: api-v2.example.com
+    SERVICE_FQDN_BLOG: blog.example.com
+    SERVICE_FQDN_MY_APP: my-app.example.com
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://admin.example.com'
+    SERVICE_URL_API: 'https://www.api.example.com'
+    SERVICE_URL_API_V2: 'https://api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://www.api.example.com'
+          COOLIFY_FQDN: www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir=https://api.example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.api.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://my-app.example.com'
+          COOLIFY_FQDN: my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my-app.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api-v2.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://api-v2.example.com'
+          COOLIFY_FQDN: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://admin.example.com'
+          COOLIFY_FQDN: admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://admin.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://blog.example.com/blog:2368'
+          COOLIFY_FQDN: 'blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/blog:2368*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+3_preview:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-7
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-7
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: 7.admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: 7.www.api.example.com
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-7:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.web.example.com'
+          COOLIFY_FQDN: 7.web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.web.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        volumes:
+          - 'referenceapplication0001_web-data-pr-7:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-7:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-7:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-7:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-7
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-7'
+      api-pr-7:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.www.api.example.com'
+          COOLIFY_FQDN: 7.www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-7:/shared'
+          - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.www.api.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      my-app-pr-7:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.my-app.example.com'
+          COOLIFY_FQDN: 7.my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: my-app-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.my-app.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      api.v2-pr-7:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.api-v2.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.api-v2.example.com'
+          COOLIFY_FQDN: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        env_file:
+          - .env
+      admin-pr-7:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.admin.example.com'
+          COOLIFY_FQDN: 7.admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-7: null
+        container_name: admin-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.admin.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        env_file:
+          - .env
+      blog-pr-7:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.blog.example.com/blog:2368'
+          COOLIFY_FQDN: '7.blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: blog-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/blog:2368*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.blog.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      db-pr-7:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        volumes:
+          - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-7: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        env_file:
+          - .env
+      sidecar-pr-7:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-7
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        env_file:
+          - .env
+      worker-pr-7:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        depends_on:
+          - db-pr-7
+        container_name: worker-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-7:
+        name: referenceapplication0001_web-data-pr-7
+      referenceapplication0001_shared-external-pr-7:
+        name: referenceapplication0001_shared-external-pr-7
+      referenceapplication0001_nfs-data-pr-7:
+        name: referenceapplication0001_nfs-data-pr-7
+      referenceapplication0001_db-data-pr-7:
+        name: referenceapplication0001_db-data-pr-7
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-7:
+        name: referenceapplication0001-7
+        external: true
+4_preview_without_generated_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    8: {}
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_shared-external-pr-8:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+    - 'referenceapplication0001_web-data-pr-8:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-8
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-8
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: referenceapplication0001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-8:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        volumes:
+          - 'referenceapplication0001_web-data-pr-8:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-8:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-8:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-8:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-8
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-8'
+      api-pr-8:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-8:/shared'
+          - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      my-app-pr-8:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: my-app-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      api.v2-pr-8:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        env_file:
+          - .env
+      admin-pr-8:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-8: null
+        container_name: admin-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        env_file:
+          - .env
+      blog-pr-8:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: blog-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      db-pr-8:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        volumes:
+          - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-8: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        env_file:
+          - .env
+      sidecar-pr-8:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-8
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        env_file:
+          - .env
+      worker-pr-8:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        depends_on:
+          - db-pr-8
+        container_name: worker-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-8:
+        name: referenceapplication0001_web-data-pr-8
+      referenceapplication0001_shared-external-pr-8:
+        name: referenceapplication0001_shared-external-pr-8
+      referenceapplication0001_nfs-data-pr-8:
+        name: referenceapplication0001_nfs-data-pr-8
+      referenceapplication0001_db-data-pr-8:
+        name: referenceapplication0001_db-data-pr-8
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-8:
+        name: referenceapplication0001-8
+        external: true
diff --git a/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml b/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml
new file mode 100644
index 0000000000..f55b910ac3
--- /dev/null
+++ b/tests/Fixtures/parser/expected/application-with-exact-traefik-labels.yaml
@@ -0,0 +1,2655 @@
+1_deploy:
+  docker_compose_domains:
+    web:
+      domain: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    api:
+      domain: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    my-app:
+      domain: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io:80'
+    admin:
+      domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
+    blog:
+      domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: web-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-web-2567.rule=Host(`web-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.service=http-0-referenceapplication0001-web-2567
+          - traefik.http.services.http-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: api-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-8a5d.rule=Host(`api-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.service=http-0-referenceapplication0001-api-8a5d
+          - traefik.http.services.http-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.service=http-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.services.http-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-admin-2123.rule=Host(`admin-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.service=http-0-referenceapplication0001-admin-2123
+          - traefik.http.services.http-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_FQDN: 'blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.middlewares=gzip,redir-ghost-referenceapplication0001'
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.rule=Host(`blog-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/blog:2368`)'
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+2_custom_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: www.api.example.com
+    SERVICE_FQDN_API_V2: api-v2.example.com
+    SERVICE_FQDN_BLOG: blog.example.com
+    SERVICE_FQDN_MY_APP: my-app.example.com
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://admin.example.com'
+    SERVICE_URL_API: 'https://www.api.example.com'
+    SERVICE_URL_API_V2: 'https://api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.service=http-0-referenceapplication0001-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.service=https-0-referenceapplication0001-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://www.api.example.com'
+          COOLIFY_FQDN: www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.regex=^(http|https)://www\.(.+)'
+          - 'traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.replacement=$${1}://$${2}'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-8a5d.rule=Host(`www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.service=http-0-referenceapplication0001-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-8a5d.middlewares=gzip,0-referenceapplication0001-to-non-www'
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-8a5d.rule=Host(`www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.service=https-0-referenceapplication0001-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - traefik.http.services.https-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://my-app.example.com'
+          COOLIFY_FQDN: my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.service=http-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.service=https-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.rule=Host(`api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.rule=Host(`api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.tls=true
+        networks:
+          referenceapplication0001: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://api-v2.example.com'
+          COOLIFY_FQDN: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://admin.example.com'
+          COOLIFY_FQDN: admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-admin-2123.rule=Host(`admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.service=http-0-referenceapplication0001-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-admin-2123.rule=Host(`admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.service=https-0-referenceapplication0001-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://blog.example.com/blog:2368'
+          COOLIFY_FQDN: 'blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-blog-126a.middlewares=gzip,redir-ghost-referenceapplication0001'
+          - 'traefik.http.routers.https-0-referenceapplication0001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.tls=true
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+3_preview:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-7
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-7
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: 7.admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: 7.www.api.example.com
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-7:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.web.example.com'
+          COOLIFY_FQDN: 7.web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-web-2567.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-web-2567.rule=Host(`7.web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-web-2567.service=http-0-referenceapplication0001-7-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-web-2567.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-web-2567.rule=Host(`7.web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.service=https-0-referenceapplication0001-7-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-web-2567.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceapplication0001-7-web-2567.loadbalancer.server.port=3000
+        volumes:
+          - 'referenceapplication0001_web-data-pr-7:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-7:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-7:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-7:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-7
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-7'
+      api-pr-7:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.www.api.example.com'
+          COOLIFY_FQDN: 7.www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-7:/shared'
+          - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.rule=Host(`7.www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.service=http-0-referenceapplication0001-7-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.rule=Host(`7.www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.service=https-0-referenceapplication0001-7-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-api-8a5d.loadbalancer.server.port=3001
+          - traefik.http.services.https-0-referenceapplication0001-7-api-8a5d.loadbalancer.server.port=3001
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      my-app-pr-7:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.my-app.example.com'
+          COOLIFY_FQDN: 7.my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: my-app-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.rule=Host(`7.my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.service=http-0-referenceapplication0001-7-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.rule=Host(`7.my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.service=https-0-referenceapplication0001-7-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceapplication0001-7-my-app-4dcb.loadbalancer.server.port=80
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      api.v2-pr-7:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.rule=Host(`7.api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.rule=Host(`7.api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.tls=true
+        networks:
+          referenceapplication0001-7: null
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.api-v2.example.com'
+          COOLIFY_FQDN: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        env_file:
+          - .env
+      admin-pr-7:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.admin.example.com'
+          COOLIFY_FQDN: 7.admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-7: null
+        container_name: admin-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.rule=Host(`7.admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.service=http-0-referenceapplication0001-7-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.rule=Host(`7.admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.service=https-0-referenceapplication0001-7-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-admin-2123.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceapplication0001-7-admin-2123.loadbalancer.server.port=8080
+        env_file:
+          - .env
+      blog-pr-7:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.blog.example.com/blog:2368'
+          COOLIFY_FQDN: '7.blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: blog-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.rewrite.replacement=/$1
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001-7.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001-7.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.rule=Host(`7.blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.middlewares=gzip,redir-ghost-referenceapplication0001-7,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.rule=Host(`7.blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.tls=true
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      db-pr-7:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        volumes:
+          - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-7: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        env_file:
+          - .env
+      sidecar-pr-7:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-7
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        env_file:
+          - .env
+      worker-pr-7:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        depends_on:
+          - db-pr-7
+        container_name: worker-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-7:
+        name: referenceapplication0001_web-data-pr-7
+      referenceapplication0001_shared-external-pr-7:
+        name: referenceapplication0001_shared-external-pr-7
+      referenceapplication0001_nfs-data-pr-7:
+        name: referenceapplication0001_nfs-data-pr-7
+      referenceapplication0001_db-data-pr-7:
+        name: referenceapplication0001_db-data-pr-7
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-7:
+        name: referenceapplication0001-7
+        external: true
+4_preview_without_generated_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    8: {}
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_shared-external-pr-8:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+    - 'referenceapplication0001_web-data-pr-8:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-8
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-8
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: referenceapplication0001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-8:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        volumes:
+          - 'referenceapplication0001_web-data-pr-8:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-8:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-8:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-8:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-8
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-8'
+      api-pr-8:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-8:/shared'
+          - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      my-app-pr-8:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: my-app-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      api.v2-pr-8:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        env_file:
+          - .env
+      admin-pr-8:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-8: null
+        container_name: admin-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        env_file:
+          - .env
+      blog-pr-8:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: blog-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      db-pr-8:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        volumes:
+          - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-8: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        env_file:
+          - .env
+      sidecar-pr-8:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-8
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        env_file:
+          - .env
+      worker-pr-8:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        depends_on:
+          - db-pr-8
+        container_name: worker-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-8:
+        name: referenceapplication0001_web-data-pr-8
+      referenceapplication0001_shared-external-pr-8:
+        name: referenceapplication0001_shared-external-pr-8
+      referenceapplication0001_nfs-data-pr-8:
+        name: referenceapplication0001_nfs-data-pr-8
+      referenceapplication0001_db-data-pr-8:
+        name: referenceapplication0001_db-data-pr-8
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-8:
+        name: referenceapplication0001-8
+        external: true
diff --git a/tests/Fixtures/parser/expected/application-with-settings.yaml b/tests/Fixtures/parser/expected/application-with-settings.yaml
new file mode 100644
index 0000000000..4958098cb2
--- /dev/null
+++ b/tests/Fixtures/parser/expected/application-with-settings.yaml
@@ -0,0 +1,3035 @@
+1_deploy:
+  docker_compose_domains:
+    web:
+      domain: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    api:
+      domain: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    my-app:
+      domain: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io:80'
+    admin:
+      domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
+    blog:
+      domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: web-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-web-2567.rule=Host(`web-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.service=http-0-referenceapplication0001-web-2567
+          - traefik.http.services.http-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: api-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-8a5d.rule=Host(`api-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.service=http-0-referenceapplication0001-api-8a5d
+          - traefik.http.services.http-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.service=http-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.services.http-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+          coolify: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-admin-2123.rule=Host(`admin-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.service=http-0-referenceapplication0001-admin-2123
+          - traefik.http.services.http-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_FQDN: 'blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.middlewares=redir-ghost-referenceapplication0001
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.rule=Host(`blog-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/blog:2368`)'
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle=/blog:2368*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+          coolify: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+      coolify:
+        name: coolify
+        external: true
+2_custom_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: www.api.example.com
+    SERVICE_FQDN_API_V2: api-v2.example.com
+    SERVICE_FQDN_BLOG: blog.example.com
+    SERVICE_FQDN_MY_APP: my-app.example.com
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://admin.example.com'
+    SERVICE_URL_API: 'https://www.api.example.com'
+    SERVICE_URL_API_V2: 'https://api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.service=http-0-referenceapplication0001-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.service=https-0-referenceapplication0001-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://www.api.example.com'
+          COOLIFY_FQDN: www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.regex=^(http|https)://www\.(.+)'
+          - 'traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.replacement=$${1}://$${2}'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-8a5d.rule=Host(`www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.service=http-0-referenceapplication0001-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.middlewares=0-referenceapplication0001-to-non-www
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-8a5d.rule=Host(`www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.service=https-0-referenceapplication0001-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - traefik.http.services.https-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir=https://api.example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.api.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://my-app.example.com'
+          COOLIFY_FQDN: my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.service=http-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.service=https-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my-app.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.rule=Host(`api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.rule=Host(`api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.tls=true
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api-v2.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://api-v2.example.com'
+          COOLIFY_FQDN: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://admin.example.com'
+          COOLIFY_FQDN: admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+          coolify: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-admin-2123.rule=Host(`admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.service=http-0-referenceapplication0001-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-admin-2123.rule=Host(`admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.service=https-0-referenceapplication0001-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://admin.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://blog.example.com/blog:2368'
+          COOLIFY_FQDN: 'blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.middlewares=redir-ghost-referenceapplication0001
+          - 'traefik.http.routers.https-0-referenceapplication0001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.tls=true
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle=/blog:2368*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+          coolify: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+      coolify:
+        name: coolify
+        external: true
+3_preview:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-7
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-7
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: 7.admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: 7.www.api.example.com
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-7:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.web.example.com'
+          COOLIFY_FQDN: 7.web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-web-2567.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-web-2567.rule=Host(`7.web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-web-2567.service=http-0-referenceapplication0001-7-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.middlewares=0-referenceapplication0001-7-noindex
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-web-2567.rule=Host(`7.web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.service=https-0-referenceapplication0001-7-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-web-2567.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceapplication0001-7-web-2567.loadbalancer.server.port=3000
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.web.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        volumes:
+          - 'referenceapplication0001_web-data-pr-7:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-7:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-7:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-7:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-7
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-7: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-7'
+      api-pr-7:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.www.api.example.com'
+          COOLIFY_FQDN: 7.www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-7:/shared'
+          - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.rule=Host(`7.www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.service=http-0-referenceapplication0001-7-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.middlewares=0-referenceapplication0001-7-noindex
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.rule=Host(`7.www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.service=https-0-referenceapplication0001-7-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-api-8a5d.loadbalancer.server.port=3001
+          - traefik.http.services.https-0-referenceapplication0001-7-api-8a5d.loadbalancer.server.port=3001
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.www.api.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      my-app-pr-7:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.my-app.example.com'
+          COOLIFY_FQDN: 7.my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: my-app-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.rule=Host(`7.my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.service=http-0-referenceapplication0001-7-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.middlewares=0-referenceapplication0001-7-noindex
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.rule=Host(`7.my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.service=https-0-referenceapplication0001-7-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceapplication0001-7-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.my-app.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      api.v2-pr-7:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.rule=Host(`7.api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.middlewares=0-referenceapplication0001-7-noindex
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.rule=Host(`7.api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.tls=true
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.api-v2.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+          coolify: null
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.api-v2.example.com'
+          COOLIFY_FQDN: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      admin-pr-7:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.admin.example.com'
+          COOLIFY_FQDN: 7.admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-7: null
+          coolify: null
+        container_name: admin-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.rule=Host(`7.admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.service=http-0-referenceapplication0001-7-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.middlewares=0-referenceapplication0001-7-noindex
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.rule=Host(`7.admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.service=https-0-referenceapplication0001-7-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-admin-2123.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceapplication0001-7-admin-2123.loadbalancer.server.port=8080
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.admin.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      blog-pr-7:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.blog.example.com/blog:2368'
+          COOLIFY_FQDN: '7.blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: blog-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.rewrite.replacement=/$1
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001-7.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001-7.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.rule=Host(`7.blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.middlewares=redir-ghost-referenceapplication0001-7,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.rule=Host(`7.blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.tls=true
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle=/blog:2368*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.blog.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      db-pr-7:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        volumes:
+          - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-7: null
+          coolify: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      sidecar-pr-7:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-7
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      worker-pr-7:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        depends_on:
+          - db-pr-7
+        container_name: worker-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        networks:
+          referenceapplication0001-7: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-7:
+        name: referenceapplication0001_web-data-pr-7
+      referenceapplication0001_shared-external-pr-7:
+        name: referenceapplication0001_shared-external-pr-7
+      referenceapplication0001_nfs-data-pr-7:
+        name: referenceapplication0001_nfs-data-pr-7
+      referenceapplication0001_db-data-pr-7:
+        name: referenceapplication0001_db-data-pr-7
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-7:
+        name: referenceapplication0001-7
+        external: true
+      coolify:
+        name: coolify
+        external: true
+4_preview_without_generated_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    8: {}
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_shared-external-pr-8:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+    - 'referenceapplication0001_web-data-pr-8:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-8
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-8
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: referenceapplication0001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-8:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        volumes:
+          - 'referenceapplication0001_web-data-pr-8:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-8:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-8:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-8:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-8
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-8: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-8'
+      api-pr-8:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-8:/shared'
+          - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      my-app-pr-8:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: my-app-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      api.v2-pr-8:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+          coolify: null
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      admin-pr-8:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-8: null
+          coolify: null
+        container_name: admin-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      blog-pr-8:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: blog-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      db-pr-8:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        volumes:
+          - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-8: null
+          coolify: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      sidecar-pr-8:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-8
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+      worker-pr-8:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        depends_on:
+          - db-pr-8
+        container_name: worker-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+          coolify: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-8:
+        name: referenceapplication0001_web-data-pr-8
+      referenceapplication0001_shared-external-pr-8:
+        name: referenceapplication0001_shared-external-pr-8
+      referenceapplication0001_nfs-data-pr-8:
+        name: referenceapplication0001_nfs-data-pr-8
+      referenceapplication0001_db-data-pr-8:
+        name: referenceapplication0001_db-data-pr-8
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-8:
+        name: referenceapplication0001-8
+        external: true
+      coolify:
+        name: coolify
+        external: true
diff --git a/tests/Fixtures/parser/expected/application.yaml b/tests/Fixtures/parser/expected/application.yaml
new file mode 100644
index 0000000000..fd66e5c121
--- /dev/null
+++ b/tests/Fixtures/parser/expected/application.yaml
@@ -0,0 +1,2781 @@
+1_deploy:
+  docker_compose_domains:
+    web:
+      domain: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    api:
+      domain: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    my-app:
+      domain: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io:80'
+    admin:
+      domain: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io:8080'
+    blog:
+      domain: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: web-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-web-2567.rule=Host(`web-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.service=http-0-referenceapplication0001-web-2567
+          - traefik.http.services.http-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: api-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-8a5d.rule=Host(`api-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.service=http-0-referenceapplication0001-api-8a5d
+          - traefik.http.services.http-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.service=http-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.services.http-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          COOLIFY_FQDN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceapplication0001-admin-2123.rule=Host(`admin-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.service=http-0-referenceapplication0001-admin-2123
+          - traefik.http.services.http-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_FQDN: 'blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.middlewares=gzip,redir-ghost-referenceapplication0001'
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.rule=Host(`blog-referenceapplication0001.10.0.0.1.sslip.io`) && PathPrefix(`/blog:2368`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/blog:2368*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceapplication0001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'http://web-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_WEB: web-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_API: 'http://api-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_API: api-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_MY_APP: 'http://my-app-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_MY_APP: my-app-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_ADMIN: 'http://admin-referenceapplication0001.10.0.0.1.sslip.io'
+          SERVICE_FQDN_ADMIN: admin-referenceapplication0001.10.0.0.1.sslip.io
+          SERVICE_URL_BLOG: 'http://blog-referenceapplication0001.10.0.0.1.sslip.io/blog:2368'
+          SERVICE_FQDN_BLOG: blog-referenceapplication0001.10.0.0.1.sslip.io
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+2_custom_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews: {}
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_web-data:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: www.api.example.com
+    SERVICE_FQDN_API_V2: api-v2.example.com
+    SERVICE_FQDN_BLOG: blog.example.com
+    SERVICE_FQDN_MY_APP: my-app.example.com
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_3000: 'web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://admin.example.com'
+    SERVICE_URL_API: 'https://www.api.example.com'
+    SERVICE_URL_API_V2: 'https://api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: 'http://web-referenceapplication0001.10.0.0.1.sslip.io:3000'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-web-2567.service=http-0-referenceapplication0001-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.service=https-0-referenceapplication0001-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceapplication0001-web-2567.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        volumes:
+          - 'referenceapplication0001_web-data:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:abcdef0123456789abcdef0123456789abcdef01'
+      api:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://www.api.example.com'
+          COOLIFY_FQDN: www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'shared-external:/shared'
+          - 'nfs-data:/mnt/nfs'
+        container_name: api-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.regex=^(http|https)://www\.(.+)'
+          - 'traefik.http.middlewares.0-referenceapplication0001-to-non-www.redirectregex.replacement=$${1}://$${2}'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-8a5d.rule=Host(`www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-api-8a5d.service=http-0-referenceapplication0001-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-8a5d.middlewares=gzip,0-referenceapplication0001-to-non-www'
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-8a5d.rule=Host(`www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.service=https-0-referenceapplication0001-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - traefik.http.services.https-0-referenceapplication0001-api-8a5d.loadbalancer.server.port=3001
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir=https://api.example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.api.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://my-app.example.com'
+          COOLIFY_FQDN: my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: my-app-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-my-app-4dcb.service=http-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.rule=Host(`my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.service=https-0-referenceapplication0001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceapplication0001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my-app.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      api.v2:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-api-v2-b0fa.rule=Host(`api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.rule=Host(`api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-api-v2-b0fa.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api-v2.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://api-v2.example.com'
+          COOLIFY_FQDN: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      admin:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://admin.example.com'
+          COOLIFY_FQDN: admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001: null
+        container_name: admin-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-admin-2123.rule=Host(`admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-admin-2123.service=http-0-referenceapplication0001-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.entryPoints=https
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceapplication0001-admin-2123.rule=Host(`admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.service=https-0-referenceapplication0001-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-admin-2123.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceapplication0001-admin-2123.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://admin.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_URL: 'https://blog.example.com/blog:2368'
+          COOLIFY_FQDN: 'blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        container_name: blog-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - traefik.docker.network=referenceapplication0001
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceapplication0001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceapplication0001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-blog-126a.middlewares=gzip,redir-ghost-referenceapplication0001'
+          - 'traefik.http.routers.https-0-referenceapplication0001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-blog-126a.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/blog:2368*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceapplication0001
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        volumes:
+          - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-20260102T030405
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        environment:
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        env_file:
+          - .env
+      worker:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"main"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-20260102T030405
+          SERVICE_URL_WEB: 'https://web.example.com'
+          SERVICE_FQDN_WEB: web.example.com
+          SERVICE_URL_API: 'https://www.api.example.com'
+          SERVICE_FQDN_API: www.api.example.com
+          SERVICE_URL_MY_APP: 'https://my-app.example.com'
+          SERVICE_FQDN_MY_APP: my-app.example.com
+          SERVICE_URL_ADMIN: 'https://admin.example.com'
+          SERVICE_FQDN_ADMIN: admin.example.com
+          SERVICE_URL_BLOG: 'https://blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: blog.example.com
+          SERVICE_URL_API_V2: 'https://api-v2.example.com'
+          SERVICE_FQDN_API_V2: api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_API_V2: api.v2
+          SERVICE_NAME_ADMIN: admin
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+          SERVICE_NAME_WORKER: worker
+        depends_on:
+          - db
+        container_name: worker-referenceapplication0001-20260102T030405
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-20260102t030405
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+        networks:
+          referenceapplication0001: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceapplication0001_web-data:
+        name: referenceapplication0001_web-data
+      referenceapplication0001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceapplication0001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001:
+        name: referenceapplication0001
+        external: true
+3_preview:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-7
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-7
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: 7.admin.example.com
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: 7.www.api.example.com
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-7:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.web.example.com'
+          COOLIFY_FQDN: 7.web.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-web-2567.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-web-2567.rule=Host(`7.web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-web-2567.service=http-0-referenceapplication0001-7-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-web-2567.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-web-2567.rule=Host(`7.web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.service=https-0-referenceapplication0001-7-web-2567
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-web-2567.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-web-2567.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceapplication0001-7-web-2567.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.web.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        volumes:
+          - 'referenceapplication0001_web-data-pr-7:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-7:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-7:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-7
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-7:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-7
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-7'
+      api-pr-7:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.www.api.example.com'
+          COOLIFY_FQDN: 7.www.api.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-7:/shared'
+          - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.rule=Host(`7.www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-8a5d.service=http-0-referenceapplication0001-7-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.rule=Host(`7.www.api.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.service=https-0-referenceapplication0001-7-api-8a5d
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-api-8a5d.loadbalancer.server.port=3001
+          - traefik.http.services.https-0-referenceapplication0001-7-api-8a5d.loadbalancer.server.port=3001
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3001}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.www.api.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      my-app-pr-7:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.my-app.example.com'
+          COOLIFY_FQDN: 7.my-app.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: my-app-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.rule=Host(`7.my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-my-app-4dcb.service=http-0-referenceapplication0001-7-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.rule=Host(`7.my-app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.service=https-0-referenceapplication0001-7-my-app-4dcb
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceapplication0001-7-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.my-app.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      api.v2-pr-7:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-api-v2-b0fa.rule=Host(`7.api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.rule=Host(`7.api-v2.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-api-v2-b0fa.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.api-v2.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.api-v2.example.com'
+          COOLIFY_FQDN: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        env_file:
+          - .env
+      admin-pr-7:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.admin.example.com'
+          COOLIFY_FQDN: 7.admin.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-7: null
+        container_name: admin-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.rule=Host(`7.admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceapplication0001-7-admin-2123.service=http-0-referenceapplication0001-7-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.middlewares=gzip,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.rule=Host(`7.admin.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.service=https-0-referenceapplication0001-7-admin-2123
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-admin-2123.tls=true
+          - traefik.http.services.http-0-referenceapplication0001-7-admin-2123.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceapplication0001-7-admin-2123.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.admin.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        env_file:
+          - .env
+      blog-pr-7:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_URL: 'https://7.blog.example.com/blog:2368'
+          COOLIFY_FQDN: '7.blog.example.com/blog:2368'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        container_name: blog-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+          - traefik.docker.network=referenceapplication0001-7
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.rewrite.regexp=^/blog:2368/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceapplication0001-7.rewrite.replacement=/$1
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceapplication0001-7-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceapplication0001-7.redirectregex.regex=^/blog:2368/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceapplication0001-7.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.middlewares=0-referenceapplication0001-7-noindex,redirect-to-https'
+          - 'traefik.http.routers.http-0-referenceapplication0001-7-blog-126a.rule=Host(`7.blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.middlewares=gzip,redir-ghost-referenceapplication0001-7,0-referenceapplication0001-7-noindex'
+          - 'traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.rule=Host(`7.blog.example.com`) && PathPrefix(`/blog:2368`)'
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceapplication0001-7-blog-126a.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/blog:2368*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://7.blog.example.com'
+          - caddy_ingress_network=referenceapplication0001-7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+      db-pr-7:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        volumes:
+          - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-7: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        env_file:
+          - .env
+      sidecar-pr-7:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-7
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        environment:
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        env_file:
+          - .env
+      worker-pr-7:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/7/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-7
+          SERVICE_URL_WEB: 'https://7.web.example.com'
+          SERVICE_FQDN_WEB: 7.web.example.com
+          SERVICE_URL_API: 'https://7.www.api.example.com'
+          SERVICE_FQDN_API: 7.www.api.example.com
+          SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+          SERVICE_FQDN_MY_APP: 7.my-app.example.com
+          SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+          SERVICE_FQDN_ADMIN: 7.admin.example.com
+          SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+          SERVICE_FQDN_BLOG: 7.blog.example.com
+          SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+          SERVICE_FQDN_API_V2: 7.api-v2.example.com
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-7
+          SERVICE_NAME_API: api-pr-7
+          SERVICE_NAME_MY_APP: my-app-pr-7
+          SERVICE_NAME_API_V2: api.v2-pr-7
+          SERVICE_NAME_ADMIN: admin-pr-7
+          SERVICE_NAME_BLOG: blog-pr-7
+          SERVICE_NAME_DB: db-pr-7
+          SERVICE_NAME_SIDECAR: sidecar-pr-7
+          SERVICE_NAME_WORKER: worker-pr-7
+        depends_on:
+          - db-pr-7
+        container_name: worker-referenceapplication0001-pr-7
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-7
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=7
+        networks:
+          referenceapplication0001-7: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-7:
+        name: referenceapplication0001_web-data-pr-7
+      referenceapplication0001_shared-external-pr-7:
+        name: referenceapplication0001_shared-external-pr-7
+      referenceapplication0001_nfs-data-pr-7:
+        name: referenceapplication0001_nfs-data-pr-7
+      referenceapplication0001_db-data-pr-7:
+        name: referenceapplication0001_db-data-pr-7
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-7:
+        name: referenceapplication0001-7
+        external: true
+4_preview_without_generated_domains:
+  docker_compose_domains:
+    web:
+      domain: 'https://web.example.com:3000'
+    api:
+      domain: 'https://www.api.example.com'
+      redirect: non-www
+    my-app:
+      domain: 'https://my-app.example.com:80'
+    admin:
+      domain: 'https://admin.example.com:8080'
+    blog:
+      domain: 'https://blog.example.com/blog:2368'
+    api.v2:
+      domain: 'https://api-v2.example.com'
+  previews:
+    8: {}
+    7:
+      fqdn: 'https://7.web.example.com,https://7.www.api.example.com,https://7.my-app.example.com,https://7.admin.example.com,https://7.blog.example.com/blog:2368,https://7.api-v2.example.com'
+      docker_compose_domains:
+        web:
+          domain: 'https://7.web.example.com'
+        api:
+          domain: 'https://7.www.api.example.com'
+        my-app:
+          domain: 'https://7.my-app.example.com'
+        admin:
+          domain: 'https://7.admin.example.com'
+        blog:
+          domain: 'https://7.blog.example.com/blog:2368'
+        api.v2:
+          domain: 'https://7.api-v2.example.com'
+        sidecar:
+          domain: ''
+        worker:
+          domain: ''
+  volumes:
+    - 'referenceapplication0001_db-data:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-7:/var/lib/postgresql/data'
+    - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+    - 'referenceapplication0001_nfs-data-pr-7:/mnt/nfs'
+    - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+    - 'referenceapplication0001_shared-external-pr-7:/shared'
+    - 'referenceapplication0001_shared-external-pr-8:/shared'
+    - 'referenceapplication0001_web-data:/app/data'
+    - 'referenceapplication0001_web-data-pr-7:/app/data'
+    - 'referenceapplication0001_web-data-pr-8:/app/data'
+  files:
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/config-pr-8
+      mount_path: /app/config
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/selinux-pr-8
+      mount_path: /app/selinux
+      is_directory: true
+    -
+      fs_path: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+      mount_path: /docker-entrypoint.d/init.sh
+      is_directory: false
+      content: |
+        #!/bin/sh
+        echo "application reference fixture"
+  environment_variables:
+    BARE_PASSTHROUGH: null
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+    NO_BRACES_VALUE: null
+    REQUIRED:
+      value: null
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_FQDN_ADMIN: referenceapplication0001.10.0.0.1.sslip.io
+    SERVICE_FQDN_ADMIN_8080: null
+    SERVICE_FQDN_API: referenceapplication0001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_API_V2: 7.api-v2.example.com
+    SERVICE_FQDN_BLOG: 7.blog.example.com
+    SERVICE_FQDN_MY_APP: 7.my-app.example.com
+    SERVICE_FQDN_WEB: 7.web.example.com
+    SERVICE_FQDN_WEB_3000: null
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_NOBRACES: '<generated:SERVICE_PASSWORD_NOBRACES:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_URL_ADMIN: 'https://7.admin.example.com'
+    SERVICE_URL_API: 'https://7.www.api.example.com'
+    SERVICE_URL_API_V2: 'https://7.api-v2.example.com'
+    SERVICE_URL_BLOG: 'https://7.blog.example.com/blog:2368'
+    SERVICE_URL_MY_APP: 'https://7.my-app.example.com'
+    SERVICE_URL_MY_APP_80: null
+    SERVICE_URL_WEB: 'https://7.web.example.com'
+    SERVICE_URL_WEB_3000: null
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web-pr-8:
+        build:
+          context: .
+          dockerfile: Dockerfile
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          SERVICE_URL_WEB_3000: ''
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          NO_BRACES_MAGIC: $SERVICE_PASSWORD_NOBRACES
+          SELF_REF: '${SELF_REF}'
+          SHARED: shared-value
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          USER: '${SERVICE_USER_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          NO_BRACES_VALUE: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: web-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=web-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        volumes:
+          - 'referenceapplication0001_web-data-pr-8:/app/data'
+          - '/data/coolify/applications/referenceapplication0001/config-pr-8:/app/config:ro'
+          - '/data/coolify/applications/referenceapplication0001/selinux-pr-8:/app/selinux:z'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/applications/referenceapplication0001/web-init.sh-pr-8
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        depends_on:
+          db-pr-8:
+            condition: service_healthy
+        container_name: web-referenceapplication0001-pr-8
+        restart: unless-stopped
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+        image: 'referenceapplication0001_web:pr-8'
+      api-pr-8:
+        image: 'node:22-alpine'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        ports:
+          - '3001:3001'
+          -
+            target: 3002
+            published: 3002
+            protocol: tcp
+        expose:
+          - 3001
+        volumes:
+          - 'referenceapplication0001_shared-external-pr-8:/shared'
+          - 'referenceapplication0001_nfs-data-pr-8:/mnt/nfs'
+        container_name: api-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=api-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      my-app-pr-8:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: ''
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: my-app-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: my-app-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=my-app-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      api.v2-pr-8:
+        image: traefik/whoami
+        container_name: api.v2-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=apiv2-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: api.v2-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        env_file:
+          - .env
+      admin-pr-8:
+        image: 'nginx:alpine'
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: admin-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        networks:
+          internal:
+            ipv4_address: 172.30.0.10
+          referenceapplication0001-8: null
+        container_name: admin-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=admin-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        env_file:
+          - .env
+      blog-pr-8:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: blog-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        container_name: blog-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=blog-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+      db-pr-8:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: db-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        volumes:
+          - 'referenceapplication0001_db-data-pr-8:/var/lib/postgresql/data'
+        networks:
+          internal: null
+          referenceapplication0001-8: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=db-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        env_file:
+          - .env
+      sidecar-pr-8:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceapplication0001-pr-8
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=sidecar-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        environment:
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        env_file:
+          - .env
+      worker-pr-8:
+        image: 'node:22-alpine'
+        command:
+          - node
+          - worker.js
+        environment:
+          APP_URL: '${SERVICE_URL_WEB}'
+          APP_URL_WITH_PORT: '${SERVICE_URL_WEB_3000}'
+          API_HOST: '${SERVICE_FQDN_API}'
+          COOLIFY_BRANCH: '"pull/8/head"'
+          COOLIFY_RESOURCE_UUID: referenceapplication0001
+          COOLIFY_CONTAINER_NAME: worker-referenceapplication0001-pr-8
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web-pr-8
+          SERVICE_NAME_API: api-pr-8
+          SERVICE_NAME_MY_APP: my-app-pr-8
+          SERVICE_NAME_API_V2: api.v2-pr-8
+          SERVICE_NAME_ADMIN: admin-pr-8
+          SERVICE_NAME_BLOG: blog-pr-8
+          SERVICE_NAME_DB: db-pr-8
+          SERVICE_NAME_SIDECAR: sidecar-pr-8
+          SERVICE_NAME_WORKER: worker-pr-8
+        depends_on:
+          - db-pr-8
+        container_name: worker-referenceapplication0001-pr-8
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.applicationUuid=referenceapplication0001
+          - coolify.type=application
+          - coolify.name=worker-referenceapplication0001-pr-8
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=reference
+          - coolify.environmentName=production
+          - coolify.pullRequestId=8
+        networks:
+          referenceapplication0001-8: null
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      referenceapplication0001_web-data-pr-8:
+        name: referenceapplication0001_web-data-pr-8
+      referenceapplication0001_shared-external-pr-8:
+        name: referenceapplication0001_shared-external-pr-8
+      referenceapplication0001_nfs-data-pr-8:
+        name: referenceapplication0001_nfs-data-pr-8
+      referenceapplication0001_db-data-pr-8:
+        name: referenceapplication0001_db-data-pr-8
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceapplication0001-8:
+        name: referenceapplication0001-8
+        external: true
diff --git a/tests/Fixtures/parser/expected/invalid-yaml.yaml b/tests/Fixtures/parser/expected/invalid-yaml.yaml
new file mode 100644
index 0000000000..34484411b7
--- /dev/null
+++ b/tests/Fixtures/parser/expected/invalid-yaml.yaml
@@ -0,0 +1,15 @@
+1_deploy:
+  applications: {}
+  databases: {}
+  environment_variables: {}
+  compose: {}
+2_custom_domains:
+  applications: {}
+  databases: {}
+  environment_variables: {}
+  compose: {}
+3_domain_on_applications_without_one:
+  applications: {}
+  databases: {}
+  environment_variables: {}
+  compose: {}
diff --git a/tests/Fixtures/parser/expected/reference-with-application-settings.yaml b/tests/Fixtures/parser/expected/reference-with-application-settings.yaml
new file mode 100644
index 0000000000..0e2c25577e
--- /dev/null
+++ b/tests/Fixtures/parser/expected/reference-with-application-settings.yaml
@@ -0,0 +1,2764 @@
+1_deploy:
+  applications:
+    api:
+      fqdn: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api-referenceservice00000001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_BLOG: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+    SERVICE_FQDN_BLOG_2368: 'blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP_80: 'my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_FQDN_WEB: web-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_8080: 'web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_FQDN_WWW: www-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+    SERVICE_URL_BLOG: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+    SERVICE_URL_BLOG_2368: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_URL_WEB: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - 'traefik.http.middlewares.0-referenceservice00000001-noindex.headers.customresponseheaders.X-Robots-Tag=noindex, nofollow'
+          - traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.regex=^(http|https)://(?:www\.)?(.+)'
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.replacement=$${1}://www.$${2}'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=0-referenceservice00000001-to-www,0-referenceservice00000001-noindex,reference-headers'
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header.0_-Server=
+          - 'caddy_0.header.1_X-Robots-Tag="noindex, nofollow"'
+          - 'caddy_0.redir={scheme}://www.web-referenceservice00000001.10.0.0.1.sslip.io{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api-referenceservice00000001.10.0.0.1.sslip.io/api
+          COOLIFY_URL: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+          COOLIFY_URL: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=http-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/ws`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+2_custom_domains:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.regex=^(http|https)://(?:www\.)?(.+)'
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.replacement=$${1}://www.$${2}'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=0-referenceservice00000001-to-www,reference-headers'
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=0-referenceservice00000001-to-www,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir={scheme}://www.web.example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web.example.com, https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceservice00000001-to-non-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-non-www.redirectregex.regex=^(http|https)://www\.(.+)'
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-non-www.redirectregex.replacement=$${1}://$${2}'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip,0-referenceservice00000001-to-non-www'
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir=https://example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+3_domain_on_applications_without_one:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      fqdn: 'https://scheduler-extra.example.com'
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      fqdn: 'https://sidecar-extra.example.com'
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      fqdn: 'https://worker-extra.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.regex=^(http|https)://(?:www\.)?(.+)'
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-www.redirectregex.replacement=$${1}://www.$${2}'
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=0-referenceservice00000001-to-www,reference-headers'
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=0-referenceservice00000001-to-www,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir={scheme}://www.web.example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web.example.com, https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+        logging:
+          driver: fluentd
+          options:
+            fluentd-address: 'tcp://127.0.0.1:24224'
+            fluentd-async: 'true'
+            fluentd-sub-second-precision: 'true'
+            env: 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME'
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.0-referenceservice00000001-to-non-www.redirectregex.permanent=false
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-non-www.redirectregex.regex=^(http|https)://www\.(.+)'
+          - 'traefik.http.middlewares.0-referenceservice00000001-to-non-www.redirectregex.replacement=$${1}://$${2}'
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip,0-referenceservice00000001-to-non-www'
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.redir=https://example.com{uri}'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_FQDN: worker-extra.example.com
+          COOLIFY_URL: 'https://worker-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.service=http-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.service=https-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://worker-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_FQDN: scheduler-extra.example.com
+          COOLIFY_URL: 'https://scheduler-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.service=http-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.service=https-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://scheduler-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.rule=Host(`sidecar-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.rule=Host(`sidecar-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://sidecar-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_FQDN: sidecar-extra.example.com
+          COOLIFY_URL: 'https://sidecar-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
diff --git a/tests/Fixtures/parser/expected/reference-with-exact-caddy-labels.yaml b/tests/Fixtures/parser/expected/reference-with-exact-caddy-labels.yaml
new file mode 100644
index 0000000000..2042347003
--- /dev/null
+++ b/tests/Fixtures/parser/expected/reference-with-exact-caddy-labels.yaml
@@ -0,0 +1,2529 @@
+1_deploy:
+  applications:
+    api:
+      fqdn: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api-referenceservice00000001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_BLOG: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+    SERVICE_FQDN_BLOG_2368: 'blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP_80: 'my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_FQDN_WEB: web-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_8080: 'web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_FQDN_WWW: www-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+    SERVICE_URL_BLOG: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+    SERVICE_URL_BLOG_2368: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_URL_WEB: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api-referenceservice00000001.10.0.0.1.sslip.io/api
+          COOLIFY_URL: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+          COOLIFY_URL: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+2_custom_domains:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+3_domain_on_applications_without_one:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      fqdn: 'https://scheduler-extra.example.com'
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      fqdn: 'https://sidecar-extra.example.com'
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      fqdn: 'https://worker-extra.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_FQDN: worker-extra.example.com
+          COOLIFY_URL: 'https://worker-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://worker-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_FQDN: scheduler-extra.example.com
+          COOLIFY_URL: 'https://scheduler-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://scheduler-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - caddy_0.log.format=json
+          - caddy_0.log.output.roll_keep=5
+          - caddy_0.log.output.roll_keep_for=168h
+          - caddy_0.log.output.roll_size=20MiB
+          - 'caddy_0.log.output=file /traffic/access.log'
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://sidecar-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_FQDN: sidecar-extra.example.com
+          COOLIFY_URL: 'https://sidecar-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
diff --git a/tests/Fixtures/parser/expected/reference-with-exact-traefik-labels.yaml b/tests/Fixtures/parser/expected/reference-with-exact-traefik-labels.yaml
new file mode 100644
index 0000000000..76fc97ee27
--- /dev/null
+++ b/tests/Fixtures/parser/expected/reference-with-exact-traefik-labels.yaml
@@ -0,0 +1,2562 @@
+1_deploy:
+  applications:
+    api:
+      fqdn: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api-referenceservice00000001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_BLOG: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+    SERVICE_FQDN_BLOG_2368: 'blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP_80: 'my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_FQDN_WEB: web-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_8080: 'web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_FQDN_WWW: www-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+    SERVICE_URL_BLOG: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+    SERVICE_URL_BLOG_2368: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_URL_WEB: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api-referenceservice00000001.10.0.0.1.sslip.io/api
+          COOLIFY_URL: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=http-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+          COOLIFY_URL: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=http-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/ws`)'
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+2_custom_domains:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=https-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+3_domain_on_applications_without_one:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      fqdn: 'https://scheduler-extra.example.com'
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      fqdn: 'https://sidecar-extra.example.com'
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      fqdn: 'https://worker-extra.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=https-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_FQDN: worker-extra.example.com
+          COOLIFY_URL: 'https://worker-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.service=http-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.service=https-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_FQDN: scheduler-extra.example.com
+          COOLIFY_URL: 'https://scheduler-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.service=http-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.service=https-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.rule=Host(`sidecar-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.rule=Host(`sidecar-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.tls=true
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_FQDN: sidecar-extra.example.com
+          COOLIFY_URL: 'https://sidecar-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
diff --git a/tests/Fixtures/parser/expected/reference-with-migrated-services.yaml b/tests/Fixtures/parser/expected/reference-with-migrated-services.yaml
new file mode 100644
index 0000000000..3503c1635c
--- /dev/null
+++ b/tests/Fixtures/parser/expected/reference-with-migrated-services.yaml
@@ -0,0 +1,2783 @@
+1_deploy:
+  applications:
+    api:
+      fqdn: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    db:
+      fqdn: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 5432
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+    gateway:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    sidecar:
+      exclude_from_status: true
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api-referenceservice00000001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_BLOG: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+    SERVICE_FQDN_BLOG_2368: 'blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP_80: 'my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_FQDN_WEB: web-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_8080: 'web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_FQDN_WWW: www-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+    SERVICE_URL_BLOG: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+    SERVICE_URL_BLOG_2368: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_URL_WEB: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api-referenceservice00000001.10.0.0.1.sslip.io/api
+          COOLIFY_URL: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=http-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+          COOLIFY_URL: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=http-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/ws`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_FQDN: db-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=application
+          - coolify.service.subName=db
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-db-d77d.rule=Host(`db-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.service=http-0-referenceservice00000001-db-d77d
+          - traefik.http.services.http-0-referenceservice00000001-db-d77d.loadbalancer.server.port=5432
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 5432}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://db-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=database
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+2_custom_domains:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    db:
+      fqdn: 'https://db.example.com'
+      required_port: 5432
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    sidecar:
+      exclude_from_status: true
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db.example.com
+    SERVICE_FQDN_DB_5432: 'db.example.com:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'https://db.example.com'
+    SERVICE_URL_DB_5432: 'https://db.example.com:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=https-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'https://db.example.com:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_FQDN: db.example.com
+          COOLIFY_URL: 'https://db.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=application
+          - coolify.service.subName=db
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-db-d77d.rule=Host(`db.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.service=http-0-referenceservice00000001-db-d77d
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-db-d77d.rule=Host(`db.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.service=https-0-referenceservice00000001-db-d77d
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-db-d77d.loadbalancer.server.port=5432
+          - traefik.http.services.https-0-referenceservice00000001-db-d77d.loadbalancer.server.port=5432
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 5432}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://db.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=database
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+3_domain_on_applications_without_one:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    db:
+      fqdn: 'https://db.example.com'
+      required_port: 5432
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      fqdn: 'https://scheduler-extra.example.com'
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      fqdn: 'https://worker-extra.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    sidecar:
+      exclude_from_status: true
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db.example.com
+    SERVICE_FQDN_DB_5432: 'db.example.com:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'https://db.example.com'
+    SERVICE_URL_DB_5432: 'https://db.example.com:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=https-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_FQDN: worker-extra.example.com
+          COOLIFY_URL: 'https://worker-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.service=http-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.service=https-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://worker-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_FQDN: scheduler-extra.example.com
+          COOLIFY_URL: 'https://scheduler-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.service=http-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.service=https-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://scheduler-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'https://db.example.com:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_FQDN: db.example.com
+          COOLIFY_URL: 'https://db.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=application
+          - coolify.service.subName=db
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-db-d77d.rule=Host(`db.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-db-d77d.service=http-0-referenceservice00000001-db-d77d
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-db-d77d.rule=Host(`db.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.service=https-0-referenceservice00000001-db-d77d
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-db-d77d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-db-d77d.loadbalancer.server.port=5432
+          - traefik.http.services.https-0-referenceservice00000001-db-d77d.loadbalancer.server.port=5432
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 5432}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://db.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=database
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
diff --git a/tests/Fixtures/parser/expected/reference.yaml b/tests/Fixtures/parser/expected/reference.yaml
new file mode 100644
index 0000000000..5a643caf67
--- /dev/null
+++ b/tests/Fixtures/parser/expected/reference.yaml
@@ -0,0 +1,2730 @@
+1_deploy:
+  applications:
+    api:
+      fqdn: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api-referenceservice00000001.10.0.0.1.sslip.io/api
+    SERVICE_FQDN_BLOG: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+    SERVICE_FQDN_BLOG_2368: 'blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP_80: 'my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_FQDN_WEB: web-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_WEB_8080: 'web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_FQDN_WWW: www-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+    SERVICE_URL_BLOG: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+    SERVICE_URL_BLOG_2368: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+    SERVICE_URL_WEB: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+    SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://web-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api-referenceservice00000001.10.0.0.1.sslip.io/api
+          COOLIFY_URL: 'http://api-referenceservice00000001.10.0.0.1.sslip.io/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=http-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://api-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://my_app-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://www-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog-referenceservice00000001.10.0.0.1.sslip.io/blog
+          COOLIFY_URL: 'http://blog-referenceservice00000001.10.0.0.1.sslip.io/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://blog-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway-referenceservice00000001.10.0.0.1.sslip.io/ws
+          COOLIFY_URL: 'http://gateway-referenceservice00000001.10.0.0.1.sslip.io/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.http-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=http-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway-referenceservice00000001.10.0.0.1.sslip.io`) && PathPrefix(`/ws`)'
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=http://gateway-referenceservice00000001.10.0.0.1.sslip.io'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'http://web-referenceservice00000001.10.0.0.1.sslip.io:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+2_custom_domains:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=https-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
+3_domain_on_applications_without_one:
+  applications:
+    api:
+      fqdn: 'https://api.example.com/api'
+      required_port: 3000
+      exclude_from_status: false
+      ports: '3000:3000,3001:3001/tcp'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/api-data
+          mount_path: /data
+          is_directory: true
+    blog:
+      fqdn: 'https://blog.example.com/blog'
+      required_port: 2368
+      exclude_from_status: false
+      ports: ''
+    gateway:
+      fqdn: 'https://gateway.example.com'
+      exclude_from_status: false
+      ports: ''
+    gateway-ws:
+      fqdn: 'https://gateway.example.com/ws'
+      exclude_from_status: false
+      ports: ''
+    my-app:
+      fqdn: 'https://my_app.example.com'
+      required_port: 80
+      exclude_from_status: false
+      ports: ''
+    scheduler:
+      fqdn: 'https://scheduler-extra.example.com'
+      required_port: 8080
+      exclude_from_status: true
+      ports: ''
+    sidecar:
+      fqdn: 'https://sidecar-extra.example.com'
+      exclude_from_status: true
+      ports: ''
+    web:
+      fqdn: 'https://web.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+      volumes:
+        - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+      files:
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/web-init.sh
+          mount_path: /docker-entrypoint.d/init.sh
+          is_directory: false
+          content: |
+            #!/bin/sh
+            echo "reference fixture"
+        -
+          fs_path: /data/coolify/services/referenceservice00000001/config
+          mount_path: /etc/nginx/conf.d
+          is_directory: true
+    worker:
+      fqdn: 'https://worker-extra.example.com'
+      required_port: 8080
+      exclude_from_status: false
+      ports: ''
+    www:
+      fqdn: 'https://www.example.com'
+      exclude_from_status: false
+      ports: ''
+  databases:
+    db:
+      exclude_from_status: false
+      volumes:
+        - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+  environment_variables:
+    API_URL: '${SERVICE_URL_API}'
+    APP_URL: '${SERVICE_URL_WEB}'
+    BARE_PASSTHROUGH: null
+    BASE64: '${SERVICE_BASE64_WEB}'
+    BASE64_64: '${SERVICE_BASE64_64_WEB}'
+    BUILD_VERSION: null
+    DASH_DEFAULT_VAR: null
+    GHOST_URL: '${SERVICE_URL_GHOST}'
+    HEX_128: '${SERVICE_HEX_128_WEB}'
+    HEX_32: '${SERVICE_HEX_32_WEB}'
+    INTERPOLATED_HOST: null
+    LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+    MAP_NULL: null
+    NESTED_INNER: null
+    NESTED_NO_DEFAULT_INNER: null
+    NESTED_NO_DEFAULT_OUTER: null
+    NESTED_OUTER: null
+    NO_BRACES_DEFAULT_VAR: null
+    NO_BRACES_VALUE: null
+    PASSWORD: '${SERVICE_PASSWORD_WEB}'
+    PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+    PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+    PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+    POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+    POSTGRES_USER: '${SERVICE_USER_DB}'
+    REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+    REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+    REQUIRED:
+      value: 'REQUIRED must be set'
+      required: true
+    SELF_REF: null
+    SERVICE_BASE64_64_WEB: '<generated:SERVICE_BASE64_64_WEB:64>'
+    SERVICE_BASE64_WEB: '<generated:SERVICE_BASE64_WEB:32>'
+    SERVICE_FOO_WEB: null
+    SERVICE_FQDN_API: api.example.com/api
+    SERVICE_FQDN_BLOG: blog.example.com/blog
+    SERVICE_FQDN_BLOG_2368: 'blog.example.com/blog:2368'
+    SERVICE_FQDN_DB: db-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_DB_5432: 'db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_FQDN_GATEWAY: gateway.example.com/ws
+    SERVICE_FQDN_GHOST: ghost-referenceservice00000001.10.0.0.1.sslip.io
+    SERVICE_FQDN_MY_APP: my_app.example.com
+    SERVICE_FQDN_MY_APP_80: 'my_app.example.com:80'
+    SERVICE_FQDN_WEB: web.example.com
+    SERVICE_FQDN_WEB_8080: 'web.example.com:8080'
+    SERVICE_FQDN_WWW: www.example.com
+    SERVICE_HEX_128_WEB: '<generated:SERVICE_HEX_128_WEB:128>'
+    SERVICE_HEX_32_WEB: '<generated:SERVICE_HEX_32_WEB:32>'
+    SERVICE_LOWERCASEUSER_WEB: '<generated:SERVICE_LOWERCASEUSER_WEB:16>'
+    SERVICE_PASSWORDWITHSYMBOLS_64_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_64_WEB:64>'
+    SERVICE_PASSWORDWITHSYMBOLS_WEB: '<generated:SERVICE_PASSWORDWITHSYMBOLS_WEB:32>'
+    SERVICE_PASSWORD_64_WEB: '<generated:SERVICE_PASSWORD_64_WEB:64>'
+    SERVICE_PASSWORD_DB: '<generated:SERVICE_PASSWORD_DB:32>'
+    SERVICE_PASSWORD_WEB: '<generated:SERVICE_PASSWORD_WEB:32>'
+    SERVICE_REALBASE64_128_WEB: '<generated:SERVICE_REALBASE64_128_WEB:172>'
+    SERVICE_REALBASE64_64_WEB: '<generated:SERVICE_REALBASE64_64_WEB:88>'
+    SERVICE_SUPABASEANON_KEY: null
+    SERVICE_URL_API: 'https://api.example.com/api'
+    SERVICE_URL_BLOG: 'https://blog.example.com/blog'
+    SERVICE_URL_BLOG_2368: 'https://blog.example.com/blog:2368'
+    SERVICE_URL_DB: 'http://db-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+    SERVICE_URL_GATEWAY: 'https://gateway.example.com/ws'
+    SERVICE_URL_GHOST: 'http://ghost-referenceservice00000001.10.0.0.1.sslip.io'
+    SERVICE_URL_MY_APP: 'https://my_app.example.com'
+    SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+    SERVICE_URL_WEB: 'https://web.example.com'
+    SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+    SERVICE_URL_WWW: 'https://www.example.com'
+    SERVICE_USER_DB: '<generated:SERVICE_USER_DB:16>'
+    SERVICE_USER_WEB: '<generated:SERVICE_USER_WEB:16>'
+    SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+    UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+    USER: '${SERVICE_USER_WEB}'
+    WITH_DEFAULT: null
+  compose:
+    services:
+      web:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          LITERAL: plain-value
+          BARE_PASSTHROUGH: ''
+          SELF_REF: '${SELF_REF}'
+          WITH_DEFAULT: '${WITH_DEFAULT:-fallback}'
+          REQUIRED: '${REQUIRED:?REQUIRED must be set}'
+          NO_BRACES: $NO_BRACES_VALUE
+          NESTED: '${NESTED_OUTER:-${NESTED_INNER:-inner-default}}'
+          NESTED_NO_DEFAULT: '${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}'
+          DASH_DEFAULT: '${DASH_DEFAULT_VAR-dash-default}'
+          NO_BRACES_DEFAULT: '$NO_BRACES_DEFAULT_VAR:-no-braces-default'
+          SHARED: shared-value
+          SHARED_MISSING: '{{environment.NOT_DEFINED}}'
+          INTERPOLATED: 'http://${INTERPOLATED_HOST:-localhost}/path'
+          PASSWORD: '${SERVICE_PASSWORD_WEB}'
+          PASSWORD_64: '${SERVICE_PASSWORD_64_WEB}'
+          PASSWORD_SYMBOLS: '${SERVICE_PASSWORDWITHSYMBOLS_WEB}'
+          BASE64: '${SERVICE_BASE64_WEB}'
+          BASE64_64: '${SERVICE_BASE64_64_WEB}'
+          REALBASE64_64: '${SERVICE_REALBASE64_64_WEB}'
+          PASSWORD_SYMBOLS_64: '${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}'
+          REALBASE64_128: '${SERVICE_REALBASE64_128_WEB}'
+          HEX_32: '${SERVICE_HEX_32_WEB}'
+          HEX_128: '${SERVICE_HEX_128_WEB}'
+          SUPABASE_ANON_WITHOUT_JWT: '${SERVICE_SUPABASEANON_KEY}'
+          USER: '${SERVICE_USER_WEB}'
+          LOWERCASE_USER: '${SERVICE_LOWERCASEUSER_WEB}'
+          UNKNOWN_MAGIC: '${SERVICE_FOO_WEB}'
+          API_URL: '${SERVICE_URL_API}'
+          NO_BRACES_VALUE: null
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: web-referenceservice00000001
+          COOLIFY_FQDN: web.example.com
+          COOLIFY_URL: 'https://web.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        labels:
+          - com.example.team=platform
+          - com.example.dollar=price-$$5
+          - traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference=1
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=web-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=web
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:web>'
+          - coolify.service.subType=application
+          - coolify.service.subName=web
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-web-2567.service=http-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.middlewares=gzip,reference-headers'
+          - 'traefik.http.routers.https-0-referenceservice00000001-web-2567.rule=Host(`web.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.service=https-0-referenceservice00000001-web-2567
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-web-2567.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-web-2567.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://web.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        volumes:
+          - 'referenceservice00000001_web-data:/usr/share/nginx/html'
+          - '/data/coolify/services/referenceservice00000001/config:/etc/nginx/conf.d:ro'
+          - '/var/run/docker.sock:/var/run/docker.sock:ro'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/web-init.sh
+            target: /docker-entrypoint.d/init.sh
+            read_only: true
+            bind:
+              create_host_path: true
+        healthcheck:
+          test:
+            - CMD
+            - wget
+            - '-qO-'
+            - 'http://127.0.0.1:8080'
+          interval: 10s
+        depends_on:
+          db:
+            condition: service_healthy
+        env_file:
+          - custom.env
+          - .env
+        container_name: web-referenceservice00000001
+        restart: unless-stopped
+        networks:
+          referenceservice00000001: null
+      api:
+        image: 'node:22-alpine'
+        build:
+          context: .
+          args:
+            - 'BUILD_VERSION=${BUILD_VERSION:-1.0.0}'
+        environment:
+          MAP_LITERAL: map-value
+          MAP_NULL: null
+          GHOST_URL: '${SERVICE_URL_GHOST}'
+          DB_URL: 'postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app'
+          BUILD_VERSION: '${BUILD_VERSION:-1.0.0}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: api-referenceservice00000001
+          COOLIFY_FQDN: api.example.com/api
+          COOLIFY_URL: 'https://api.example.com/api'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        ports:
+          - '3000:3000'
+          -
+            target: 3001
+            published: 3001
+            protocol: tcp
+        volumes:
+          - 'nfs-data:/mnt/nfs'
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/api-data
+            target: /data
+            bind:
+              create_host_path: true
+          -
+            type: bind
+            source: /data/coolify/services/referenceservice00000001/optional
+            target: /optional
+            bind:
+              create_host_path: false
+        expose:
+          - 3000
+        container_name: api-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=api-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=api
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:api>'
+          - coolify.service.subType=application
+          - coolify.service.subName=api
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-api-8a5d-stripprefix.stripprefix.prefixes=/api
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.http-0-referenceservice00000001-api-8a5d.service=http-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.middlewares=https-0-referenceservice00000001-api-8a5d-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-api-8a5d.rule=Host(`api.example.com`) && PathPrefix(`/api`)'
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.service=https-0-referenceservice00000001-api-8a5d
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-api-8a5d.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - traefik.http.services.https-0-referenceservice00000001-api-8a5d.loadbalancer.server.port=3000
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'
+          - 'caddy_0.handle_path=/api*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://api.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      my-app:
+        image: 'httpd:2.4-alpine'
+        environment:
+          SERVICE_URL_MY_APP_80: 'https://my_app.example.com:80'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: my-app-referenceservice00000001
+          COOLIFY_FQDN: my_app.example.com
+          COOLIFY_URL: 'https://my_app.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: my-app-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=my-app-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=my-app
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:my-app>'
+          - coolify.service.subType=application
+          - coolify.service.subName=my-app
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-my-app-4dcb.service=http-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.rule=Host(`my_app.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.service=https-0-referenceservice00000001-my-app-4dcb
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-my-app-4dcb.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - traefik.http.services.https-0-referenceservice00000001-my-app-4dcb.loadbalancer.server.port=80
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 80}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://my_app.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      www:
+        image: 'nginx:alpine'
+        environment:
+          SERVICE_URL_WWW: 'https://www.example.com'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: www-referenceservice00000001
+          COOLIFY_FQDN: www.example.com
+          COOLIFY_URL: 'https://www.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: www-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=www-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=www
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:www>'
+          - coolify.service.subType=application
+          - coolify.service.subName=www
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-www-4eae.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-www-4eae.rule=Host(`www.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-www-4eae.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://www.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      blog:
+        image: 'ghost:5-alpine'
+        environment:
+          SERVICE_URL_BLOG_2368: /blog
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: blog-referenceservice00000001
+          COOLIFY_FQDN: blog.example.com/blog
+          COOLIFY_URL: 'https://blog.example.com/blog'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: blog-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=blog-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=blog
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:blog>'
+          - coolify.service.subType=application
+          - coolify.service.subName=blog
+          - traefik.docker.network=referenceservice00000001
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.handler=rewrite
+          - 'caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.regexp=^/blog/(.*)'
+          - caddy_0.handle_path.0_redir-ghost-referenceservice00000001.rewrite.replacement=/$1
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - 'traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.regex=^/blog/(.*)'
+          - traefik.http.middlewares.redir-ghost-referenceservice00000001.redirectregex.replacement=/$1
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.http-0-referenceservice00000001-blog-126a.service=http-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.middlewares=gzip,redir-ghost-referenceservice00000001'
+          - 'traefik.http.routers.https-0-referenceservice00000001-blog-126a.rule=Host(`blog.example.com`) && PathPrefix(`/blog`)'
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.service=https-0-referenceservice00000001-blog-126a
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-blog-126a.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - traefik.http.services.https-0-referenceservice00000001-blog-126a.loadbalancer.server.port=2368
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 2368}}'
+          - 'caddy_0.handle_path=/blog*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://blog.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com
+          COOLIFY_URL: 'https://gateway.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.rule=Host(`gateway.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-3e21.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      gateway-ws:
+        image: traefik/whoami
+        environment:
+          SERVICE_URL_GATEWAY: /ws
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: gateway-ws-referenceservice00000001
+          COOLIFY_FQDN: gateway.example.com/ws
+          COOLIFY_URL: 'https://gateway.example.com/ws'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: gateway-ws-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=gateway-ws-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=gateway-ws
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:gateway-ws>'
+          - coolify.service.subType=application
+          - coolify.service.subName=gateway-ws
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.https-0-referenceservice00000001-gateway-ws-d203-stripprefix.stripprefix.prefixes=/ws
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.entryPoints=https
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.middlewares=https-0-referenceservice00000001-gateway-ws-d203-stripprefix,gzip'
+          - 'traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.rule=Host(`gateway.example.com`) && PathPrefix(`/ws`)'
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-gateway-ws-d203.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/ws*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://gateway.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      worker:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          SERVICE_URL_WEB_8080: 'https://web.example.com:8080'
+          APP_URL: '${SERVICE_URL_WEB}'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: worker-referenceservice00000001
+          COOLIFY_FQDN: worker-extra.example.com
+          COOLIFY_URL: 'https://worker-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: worker-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=worker-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=worker
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:worker>'
+          - coolify.service.subType=application
+          - coolify.service.subName=worker
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-worker-b618.service=http-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-worker-b618.rule=Host(`worker-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.service=https-0-referenceservice00000001-worker-b618
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-worker-b618.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-worker-b618.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://worker-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      scheduler:
+        image: 'nginx:alpine'
+        command:
+          - sleep
+          - infinity
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: scheduler-referenceservice00000001
+          COOLIFY_FQDN: scheduler-extra.example.com
+          COOLIFY_URL: 'https://scheduler-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        container_name: scheduler-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=scheduler-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=scheduler
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:scheduler>'
+          - coolify.service.subType=application
+          - coolify.service.subName=scheduler
+          - traefik.docker.network=referenceservice00000001
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.http-0-referenceservice00000001-scheduler-499f.service=http-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.rule=Host(`scheduler-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.service=https-0-referenceservice00000001-scheduler-499f
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-scheduler-499f.tls=true
+          - traefik.http.services.http-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - traefik.http.services.https-0-referenceservice00000001-scheduler-499f.loadbalancer.server.port=8080
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams 8080}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://scheduler-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        networks:
+          referenceservice00000001: null
+        env_file:
+          - .env
+      db:
+        image: 'postgres:16-alpine'
+        environment:
+          POSTGRES_USER: '${SERVICE_USER_DB}'
+          POSTGRES_PASSWORD: '${SERVICE_PASSWORD_DB}'
+          POSTGRES_DB: app
+          SERVICE_URL_DB_5432: 'http://db-referenceservice00000001.10.0.0.1.sslip.io:5432'
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: db-referenceservice00000001
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        volumes:
+          - 'referenceservice00000001_db-data:/var/lib/postgresql/data'
+          - 'shared-external:/backups'
+        networks:
+          internal: null
+          referenceservice00000001: null
+        healthcheck:
+          test:
+            - CMD-SHELL
+            - 'pg_isready -U $${POSTGRES_USER}'
+          interval: 5s
+        container_name: db-referenceservice00000001
+        restart: unless-stopped
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=db-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=db
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:db>'
+          - coolify.service.subType=database
+          - coolify.service.subName=db
+        env_file:
+          - .env
+      sidecar:
+        image: busybox
+        restart: 'no'
+        network_mode: 'service:web'
+        command:
+          - 'true'
+        container_name: sidecar-referenceservice00000001
+        labels:
+          - coolify.managed=true
+          - coolify.version=<coolify-version>
+          - coolify.serviceUuid=referenceservice00000001
+          - coolify.type=service
+          - coolify.name=sidecar-referenceservice00000001
+          - coolify.resourceName=reference
+          - coolify.projectName=reference-project
+          - coolify.serviceName=sidecar
+          - coolify.environmentName=production
+          - coolify.pullRequestId=0
+          - 'coolify.service.subUuid=<uuid:sidecar>'
+          - coolify.service.subType=application
+          - coolify.service.subName=sidecar
+          - traefik.enable=true
+          - traefik.http.middlewares.gzip.compress=true
+          - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+          - traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.entryPoints=http
+          - traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.middlewares=redirect-to-https
+          - 'traefik.http.routers.http-0-referenceservice00000001-sidecar-9523.rule=Host(`sidecar-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.entryPoints=https
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.middlewares=gzip
+          - 'traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.rule=Host(`sidecar-extra.example.com`) && PathPrefix(`/`)'
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.tls.certresolver=letsencrypt
+          - traefik.http.routers.https-0-referenceservice00000001-sidecar-9523.tls=true
+          - 'caddy_0.encode=zstd gzip'
+          - 'caddy_0.handle_path.0_reverse_proxy={{upstreams}}'
+          - 'caddy_0.handle_path=/*'
+          - caddy_0.header=-Server
+          - 'caddy_0.try_files={path} /index.html /index.php'
+          - 'caddy_0=https://sidecar-extra.example.com'
+          - caddy_ingress_network=referenceservice00000001
+        environment:
+          COOLIFY_RESOURCE_UUID: referenceservice00000001
+          COOLIFY_CONTAINER_NAME: sidecar-referenceservice00000001
+          COOLIFY_FQDN: sidecar-extra.example.com
+          COOLIFY_URL: 'https://sidecar-extra.example.com'
+          COOLIFY_APP_NAME: reference
+          COOLIFY_PROJECT_NAME: 'Reference Project'
+          COOLIFY_ENVIRONMENT_NAME: production
+          COOLIFY_SERVER_IP: 10.0.0.1
+          SERVICE_NAME_WEB: web
+          SERVICE_NAME_API: api
+          SERVICE_NAME_MY_APP: my-app
+          SERVICE_NAME_WWW: www
+          SERVICE_NAME_BLOG: blog
+          SERVICE_NAME_GATEWAY: gateway
+          SERVICE_NAME_GATEWAY_WS: gateway-ws
+          SERVICE_NAME_WORKER: worker
+          SERVICE_NAME_SCHEDULER: scheduler
+          SERVICE_NAME_DB: db
+          SERVICE_NAME_SIDECAR: sidecar
+        env_file:
+          - .env
+    volumes:
+      db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+      shared-external:
+        external: true
+      nfs-data:
+        driver_opts:
+          type: nfs
+          o: 'addr=10.0.0.2,rw'
+          device: ':/exports/data'
+      referenceservice00000001_web-data:
+        name: referenceservice00000001_web-data
+      referenceservice00000001_db-data:
+        driver_opts:
+          type: none
+          o: bind
+          device: /srv/db
+        name: referenceservice00000001_db-data
+    networks:
+      internal: null
+      default: null
+      aliased:
+        aliases:
+          - alias-name
+      referenceservice00000001:
+        name: referenceservice00000001
+        external: true
diff --git a/tests/Fixtures/parser/expected/unsafe-service-name.yaml b/tests/Fixtures/parser/expected/unsafe-service-name.yaml
new file mode 100644
index 0000000000..7e7f49e9f9
--- /dev/null
+++ b/tests/Fixtures/parser/expected/unsafe-service-name.yaml
@@ -0,0 +1,2 @@
+1_deploy:
+  error: "Exception: Invalid Docker Compose service name: Invalid service name: contains forbidden character ';' (command separator). Shell metacharacters are not allowed for security reasons. Service names must not contain shell metacharacters."
diff --git a/tests/Fixtures/parser/expected/unsafe-volume-path.yaml b/tests/Fixtures/parser/expected/unsafe-volume-path.yaml
new file mode 100644
index 0000000000..5370991291
--- /dev/null
+++ b/tests/Fixtures/parser/expected/unsafe-volume-path.yaml
@@ -0,0 +1,2 @@
+1_deploy:
+  error: "Exception: Invalid Docker volume definition: Invalid volume source: contains forbidden character ';' (command separator). Shell metacharacters are not allowed for security reasons. Please use safe path names without shell metacharacters."
diff --git a/tests/Fixtures/parser/service-invalid-yaml.yaml b/tests/Fixtures/parser/service-invalid-yaml.yaml
new file mode 100644
index 0000000000..914aeeb100
--- /dev/null
+++ b/tests/Fixtures/parser/service-invalid-yaml.yaml
@@ -0,0 +1,5 @@
+# Reference compose for the service parser: invalid YAML gives an empty result.
+services:
+  web:
+    image: nginx:alpine
+    environment: [unclosed
diff --git a/tests/Fixtures/parser/service-reference.yaml b/tests/Fixtures/parser/service-reference.yaml
new file mode 100644
index 0000000000..8da5c33869
--- /dev/null
+++ b/tests/Fixtures/parser/service-reference.yaml
@@ -0,0 +1,181 @@
+# Reference compose for the service parser (serviceParser + updateCompose).
+# Test-only: tests/Feature/ServiceParserReferenceTest.php parses it and compares the result
+# with service-reference.expected.yaml. Each service covers one group of parser features.
+services:
+  # Domain with a port, magic secrets, all environment syntaxes, labels, volumes.
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_URL_WEB_8080
+      - LITERAL=plain-value
+      - BARE_PASSTHROUGH
+      - SELF_REF=${SELF_REF}
+      - WITH_DEFAULT=${WITH_DEFAULT:-fallback}
+      - REQUIRED=${REQUIRED:?REQUIRED must be set}
+      - NO_BRACES=$NO_BRACES_VALUE
+      - NESTED=${NESTED_OUTER:-${NESTED_INNER:-inner-default}}
+      - NESTED_NO_DEFAULT=${NESTED_NO_DEFAULT_OUTER:-${NESTED_NO_DEFAULT_INNER}}
+      - DASH_DEFAULT=${DASH_DEFAULT_VAR-dash-default}
+      - NO_BRACES_DEFAULT=$NO_BRACES_DEFAULT_VAR:-no-braces-default
+      - SHARED={{environment.SHARED_KEY}}
+      - SHARED_MISSING={{environment.NOT_DEFINED}}
+      - INTERPOLATED=http://${INTERPOLATED_HOST:-localhost}/path
+      - PASSWORD=${SERVICE_PASSWORD_WEB}
+      - PASSWORD_64=${SERVICE_PASSWORD_64_WEB}
+      - PASSWORD_SYMBOLS=${SERVICE_PASSWORDWITHSYMBOLS_WEB}
+      - BASE64=${SERVICE_BASE64_WEB}
+      - BASE64_64=${SERVICE_BASE64_64_WEB}
+      - REALBASE64_64=${SERVICE_REALBASE64_64_WEB}
+      - PASSWORD_SYMBOLS_64=${SERVICE_PASSWORDWITHSYMBOLS_64_WEB}
+      - REALBASE64_128=${SERVICE_REALBASE64_128_WEB}
+      - HEX_32=${SERVICE_HEX_32_WEB}
+      - HEX_128=${SERVICE_HEX_128_WEB}
+      - SUPABASE_ANON_WITHOUT_JWT=${SERVICE_SUPABASEANON_KEY}
+      - USER=${SERVICE_USER_WEB}
+      - LOWERCASE_USER=${SERVICE_LOWERCASEUSER_WEB}
+      - UNKNOWN_MAGIC=${SERVICE_FOO_WEB}
+      - API_URL=${SERVICE_URL_API}
+    labels:
+      com.example.team: platform
+      com.example.dollar: price-$5
+      traefik.http.middlewares.reference-headers.headers.customresponseheaders.X-Reference: "1"
+    volumes:
+      - web-data:/usr/share/nginx/html
+      - ./config:/etc/nginx/conf.d:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - type: bind
+        source: ./web-init.sh
+        target: /docker-entrypoint.d/init.sh
+        read_only: true
+        content: |
+          #!/bin/sh
+          echo "reference fixture"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080"]
+      interval: 10s
+    depends_on:
+      db:
+        condition: service_healthy
+    env_file: custom.env
+
+  # Path value with FQDN declaration, map-style environment, build args, ports.
+  api:
+    image: node:22-alpine
+    build:
+      context: .
+      args:
+        - BUILD_VERSION=${BUILD_VERSION:-1.0.0}
+    environment:
+      SERVICE_FQDN_API: /api
+      MAP_LITERAL: map-value
+      MAP_NULL:
+      GHOST_URL: ${SERVICE_URL_GHOST}
+      DB_URL: postgres://${SERVICE_USER_DB}:${SERVICE_PASSWORD_DB}@db:5432/app
+    ports:
+      - "3000:3000"
+      - target: 3001
+        published: 3001
+        protocol: tcp
+    volumes:
+      - nfs-data:/mnt/nfs
+      - type: bind
+        source: ./api-data
+        target: /data
+      - type: bind
+        source: ./optional
+        target: /optional
+        bind:
+          create_host_path: false
+    expose:
+      - 3000
+
+  # Hyphenated service name: SERVICE_URL_MY_APP maps to compose service "my-app".
+  my-app:
+    image: httpd:2.4-alpine
+    environment:
+      - SERVICE_URL_MY_APP_80
+
+  # Host www.example.com after the custom domain step (redirect to non-www in the settings case).
+  www:
+    image: nginx:alpine
+    environment:
+      - SERVICE_URL_WWW
+
+  # Ghost image with a path domain: extra redirect labels for the path.
+  blog:
+    image: ghost:5-alpine
+    environment:
+      - SERVICE_URL_BLOG_2368=/blog
+
+  # Shared host with path routing (Appwrite style): same variable, different paths.
+  gateway:
+    image: traefik/whoami
+    environment:
+      - SERVICE_URL_GATEWAY=/
+  gateway-ws:
+    image: traefik/whoami
+    environment:
+      - SERVICE_URL_GATEWAY=/ws
+
+  # Exact copy of web's declaration (old Twenty template, #11924): no domain, no variable writes.
+  worker:
+    image: nginx:alpine
+    command: ["sleep", "infinity"]
+    environment:
+      - SERVICE_URL_WEB_8080
+      - APP_URL=${SERVICE_URL_WEB}
+
+  # SERVICE_FQDN_ twin of web's SERVICE_URL_ declaration: also a copy.
+  scheduler:
+    image: nginx:alpine
+    command: ["sleep", "infinity"]
+    environment:
+      - SERVICE_FQDN_WEB_8080
+    exclude_from_hc: true
+
+  # Database image: ServiceDatabase row, no domain, no proxy labels.
+  db:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=${SERVICE_USER_DB}
+      - POSTGRES_PASSWORD=${SERVICE_PASSWORD_DB}
+      - POSTGRES_DB=app
+      - SERVICE_URL_DB_5432
+    volumes:
+      - db-data:/var/lib/postgresql/data
+      - shared-external:/backups
+    networks:
+      - internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
+      interval: 5s
+
+  # restart "no": excluded from status checks; shares web's network namespace.
+  sidecar:
+    image: busybox
+    restart: "no"
+    network_mode: "service:web"
+    command: ["true"]
+
+volumes:
+  web-data:
+  db-data:
+    driver_opts:
+      type: none
+      o: bind
+      device: /srv/db
+  shared-external:
+    external: true
+  nfs-data:
+    driver_opts:
+      type: nfs
+      o: addr=10.0.0.2,rw
+      device: ":/exports/data"
+
+networks:
+  internal:
+  default:
+  # Networks with aliases are not added to every service.
+  aliased:
+    aliases:
+      - alias-name
diff --git a/tests/Fixtures/parser/service-unsafe-name.yaml b/tests/Fixtures/parser/service-unsafe-name.yaml
new file mode 100644
index 0000000000..75c6a8acb4
--- /dev/null
+++ b/tests/Fixtures/parser/service-unsafe-name.yaml
@@ -0,0 +1,4 @@
+# Reference compose for the service parser: a service name with shell metacharacters is rejected.
+services:
+  "web;rm -rf /":
+    image: nginx:alpine
diff --git a/tests/Fixtures/parser/service-unsafe.yaml b/tests/Fixtures/parser/service-unsafe.yaml
new file mode 100644
index 0000000000..b148e6f7cc
--- /dev/null
+++ b/tests/Fixtures/parser/service-unsafe.yaml
@@ -0,0 +1,6 @@
+# Reference compose for the service parser error path: a bind source with shell metacharacters must be rejected.
+services:
+  web:
+    image: nginx:alpine
+    volumes:
+      - "./data;touch /tmp/pwned:/data"
diff --git a/tests/Unit/ApplicationAdditionalServerStatusTest.php b/tests/Unit/ApplicationAdditionalServerStatusTest.php
new file mode 100644
index 0000000000..71dd48bbf2
--- /dev/null
+++ b/tests/Unit/ApplicationAdditionalServerStatusTest.php
@@ -0,0 +1,28 @@
+<?php
+
+use App\Models\Application;
+
+function applicationWithAdditionalServerStatuses(string $mainStatus, array $additionalStatuses): Application
+{
+    $application = new Application;
+    $application->setRawAttributes(['status' => $mainStatus]);
+    $application->setRelation('additional_servers', collect($additionalStatuses)
+        ->map(fn (string $status) => (object) ['pivot' => (object) ['status' => $status]]));
+
+    return $application;
+}
+
+it('stays healthy when an additional server status has no health segment', function () {
+    expect(applicationWithAdditionalServerStatuses('running:healthy', ['running'])->status)
+        ->toBe('running:healthy');
+});
+
+it('reports unhealthy when an additional server has an explicit unhealthy status', function () {
+    expect(applicationWithAdditionalServerStatuses('running:healthy', ['running:unhealthy'])->status)
+        ->toBe('running:unhealthy');
+});
+
+it('reports degraded when an additional server status without health differs', function () {
+    expect(applicationWithAdditionalServerStatuses('running:healthy', ['exited'])->status)
+        ->toBe('degraded:healthy');
+});
diff --git a/tests/Unit/ApplicationGitCommitLinkTest.php b/tests/Unit/ApplicationGitCommitLinkTest.php
index 7d9bb2b8ca..55eaaf3da5 100644
--- a/tests/Unit/ApplicationGitCommitLinkTest.php
+++ b/tests/Unit/ApplicationGitCommitLinkTest.php
@@ -47,7 +47,7 @@ it('does not generate commit links from incomplete repository URLs', function (s
     'git protocol' => 'git://git.example.com/coollabsio/coolify.git',
 ]);
 
-it('converts scp-style remotes with generic usernames into https repository links', function (string $repository, string $expectedBranch, string $expectedCommits, string $expectedWebhook) {
+it('converts ssh remotes with generic usernames into https repository links', function (string $repository, string $expectedBranch, string $expectedCommits, string $expectedWebhook) {
     $application = new Application;
     $application->setRelation('source', null);
     $application->git_repository = $repository;
@@ -76,4 +76,10 @@ it('converts scp-style remotes with generic usernames into https repository link
         'https://git.example.com/organization/repository/commits/main',
         'https://git.example.com/organization/repository/settings/hooks',
     ],
+    'ssh scheme with port' => [
+        'ssh://git@gitea.example.com:2222/organization/repository.git',
+        'https://gitea.example.com/organization/repository/tree/main/',
+        'https://gitea.example.com/organization/repository/commits/main',
+        'https://gitea.example.com/organization/repository/settings/hooks',
+    ],
 ]);
diff --git a/tests/Unit/DockerComposeImagePullOrderTest.php b/tests/Unit/DockerComposeImagePullOrderTest.php
index 5593d37b83..fb3f95a508 100644
--- a/tests/Unit/DockerComposeImagePullOrderTest.php
+++ b/tests/Unit/DockerComposeImagePullOrderTest.php
@@ -3,6 +3,7 @@
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationSetting;
 use App\Models\Server;
 
 class TestableDockerComposeImagePullDeploymentJob extends ApplicationDeploymentJob
@@ -27,17 +28,33 @@ class TestableDockerComposeImagePullDeploymentJob extends ApplicationDeploymentJ
     }
 }
 
-function makeDockerComposeImagePullJob(bool $useBuildServer = false): array
+function makeDockerComposeImagePullJob(bool $useBuildServer = false, ?string $customBuildCommand = null, ?string $compose = null): array
 {
+    $compose ??= <<<'YAML'
+        services:
+          app:
+            build: .
+            image: 'myapp:latest'
+          worker:
+            image: 'myapp:latest'
+          db:
+            image: 'postgres:16'
+          cache:
+            image: 'redis:7'
+        YAML;
+
     $job = new TestableDockerComposeImagePullDeploymentJob;
     $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
 
     $application = Mockery::mock(Application::class)->makePartial();
     $application->uuid = 'application-uuid';
+    $application->name = 'application';
+    $application->setRelation('settings', new ApplicationSetting(['is_raw_compose_deployment_enabled' => false]));
     $application->shouldReceive('workdir')->andReturn('/runtime/application');
 
     $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
-    $queue->shouldReceive('addLogEntry')->once()->andReturnNull();
+    $queue->shouldReceive('getAttribute')->with('updated_at')->andReturn('2026-10-16 00:00:00');
+    $queue->shouldReceive('addLogEntry')->andReturnNull();
 
     $buildServer = new Server;
     $buildServer->id = 1;
@@ -52,9 +69,13 @@ function makeDockerComposeImagePullJob(bool $useBuildServer = false): array
         'mainServer' => $mainServer,
         'use_build_server' => $useBuildServer,
         'workdir' => '/artifacts/application',
+        'configuration_dir' => '/runtime/application',
+        'pull_request_id' => 0,
         'deployment_uuid' => 'deployment-uuid',
         'docker_compose_location' => '/docker-compose.yaml',
         'coolify_variables' => '',
+        'docker_compose_custom_build_command' => $customBuildCommand,
+        'generated_docker_compose' => $compose,
     ] as $property => $value) {
         $reflection->getProperty($property)->setValue($job, $value);
     }
@@ -70,15 +91,54 @@ it('aborts the deployment when pulling a compose image fails', function () {
 })->throws(RuntimeException::class, 'Image pull failed.');
 
 it('pulls compose images on the runtime server when using a build server', function () {
-    [$job, $reflection, $buildServer, $mainServer] = makeDockerComposeImagePullJob(useBuildServer: true);
+    [$job, $reflection, , $mainServer] = makeDockerComposeImagePullJob(useBuildServer: true);
 
     $reflection->getMethod('pull_docker_compose_images')->invoke($job);
 
-    $command = $job->recordedCommands[0][0][0];
+    $command = last($job->recordedCommands)[0][0];
 
-    expect($job->commandServers)->toHaveCount(1)
-        ->and($job->commandServers[0])->toBe($mainServer)
-        ->and($job->commandServers[0])->not->toBe($buildServer)
+    expect($job->commandServers)->each->toBe($mainServer)
         ->and($command)->toContain('pull --ignore-buildable')
         ->and($command)->toContain('--env-file /runtime/application/.env');
 });
+
+it('pulls only services whose image does not come from the build', function () {
+    [$job, $reflection] = makeDockerComposeImagePullJob();
+
+    $reflection->getMethod('pull_docker_compose_images')->invoke($job);
+
+    expect($job->recordedCommands)->toHaveCount(1)
+        ->and($job->recordedCommands[0][0][0])->toEndWith("pull --ignore-buildable '\\''db'\\'' '\\''cache'\\'''");
+});
+
+it('does not pull when all images come from the build', function () {
+    [$job, $reflection] = makeDockerComposeImagePullJob(compose: <<<'YAML'
+        services:
+          app:
+            build: .
+            image: 'myapp:latest'
+          worker:
+            image: 'myapp:latest'
+        YAML);
+
+    $reflection->getMethod('pull_docker_compose_images')->invoke($job);
+
+    expect($job->recordedCommands)->toBeEmpty();
+});
+
+it('does not pull when a custom build command builds the images', function () {
+    [$job, $reflection] = makeDockerComposeImagePullJob(customBuildCommand: 'docker buildx bake -f docker-bake.prod.hcl');
+
+    $reflection->getMethod('pull_docker_compose_images')->invoke($job);
+
+    expect($job->recordedCommands)->toBeEmpty();
+});
+
+it('pulls on the runtime server when a custom build command runs on a build server', function () {
+    [$job, $reflection, , $mainServer] = makeDockerComposeImagePullJob(useBuildServer: true, customBuildCommand: 'docker buildx bake');
+
+    $reflection->getMethod('pull_docker_compose_images')->invoke($job);
+
+    expect($job->commandServers)->each->toBe($mainServer)
+        ->and(last($job->recordedCommands)[0][0])->toEndWith("pull --ignore-buildable 'db' 'cache'");
+});
diff --git a/tests/Unit/FqdnLabelsNoindexTest.php b/tests/Unit/FqdnLabelsNoindexTest.php
index 49e9a6e8f1..3f77533d32 100644
--- a/tests/Unit/FqdnLabelsNoindexTest.php
+++ b/tests/Unit/FqdnLabelsNoindexTest.php
@@ -155,6 +155,15 @@ describe('Traefik noindex middleware', function () {
         expect(middlewaresOf($labels, 'https-0-testuuid'))->toContain('0-testuuid-noindex');
     });
 
+    test('a port in the configured domain does not silently drop the header', function () {
+        $labels = traefikLabels(
+            domains: ['https://app.example.com:3000'],
+            noindex: ['https://app.example.com'],
+        );
+
+        expect(middlewaresOf($labels, 'https-0-testuuid'))->toContain('0-testuuid-noindex');
+    });
+
     test('a domain that is not configured is ignored', function () {
         $labels = traefikLabels(
             domains: ['https://example.com'],
@@ -221,6 +230,15 @@ describe('Caddy noindex header', function () {
         expect(collect($labels)->filter(fn ($l) => str_contains($l, 'caddy_0.header.'))->all())->toBeEmpty();
     });
 
+    test('a port in the configured domain does not silently drop the header', function () {
+        $labels = caddyLabels(
+            domains: ['https://app.example.com:3000'],
+            noindex: ['https://app.example.com'],
+        );
+
+        expect($labels)->toContain('caddy_0.header.1_X-Robots-Tag="noindex, nofollow"');
+    });
+
     test('no flags means byte-identical output to before the feature', function () {
         $domains = ['https://example.com', 'https://other.example.com'];
 
diff --git a/tests/Unit/InstallScriptDirectoryPermissionsTest.php b/tests/Unit/InstallScriptDirectoryPermissionsTest.php
index 812af5bde0..e43e0ccff2 100644
--- a/tests/Unit/InstallScriptDirectoryPermissionsTest.php
+++ b/tests/Unit/InstallScriptDirectoryPermissionsTest.php
@@ -4,16 +4,22 @@
  * Runs the /data/coolify directory setup of the install script against a temporary data root.
  * chown is replaced with a logger because changing the owner to UID 9999 needs root.
  *
+ * @param  bool  $completeRun  false runs only the setup before step 1, as when a check or download fails
  * @return list<string> the paths that chown received
  */
-function runInstallScriptDirectorySetup(string $scriptPath, string $dataRoot): array
+function runInstallScriptDirectorySetup(string $scriptPath, string $dataRoot, bool $completeRun = true): array
 {
     $script = file_get_contents(dirname(__DIR__, 2).'/'.$scriptPath);
-    preg_match('/^# Resource directories.*?^set_coolify_directory_permissions$/ms', $script, $matches);
+    preg_match('/^# Resource directories.*?^mkdir -p \/data\/coolify\/source$/ms', $script, $matches);
     expect($matches)->not->toBeEmpty();
 
-    $setup = str_replace('/data/coolify', $dataRoot, $matches[0]);
+    $setup = $matches[0];
+    if ($completeRun) {
+        $setup .= "\ncreate_coolify_directories\nset_coolify_directory_permissions";
+    }
+    $setup = str_replace('/data/coolify', $dataRoot, $setup);
     $chownLog = "{$dataRoot}.chown";
+    touch($chownLog);
     $process = proc_open(
         ['bash', '-c', "set -e\nchown() { printf '%s\\n' \"\$@\" >> ".escapeshellarg($chownLog)."; }\n{$setup}"],
         [1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
@@ -95,11 +101,42 @@ it('keeps existing resource directories and their content unchanged on an upgrad
     }
 })->with($installScripts);
 
-it('does not change the whole data directory recursively', function (string $scriptPath) {
+it('does not change an existing data directory before the checks and downloads succeed', function (string $scriptPath, array $coolifyDirectories) {
+    $dataRoot = sys_get_temp_dir().'/coolify-install-permissions-'.bin2hex(random_bytes(6));
+
+    try {
+        mkdir($dataRoot, 0750);
+        chmod($dataRoot, 0750);
+        foreach ($coolifyDirectories as $directory) {
+            mkdir("{$dataRoot}/{$directory}/nested", 0755, true);
+            chmod("{$dataRoot}/{$directory}", 0750);
+            touch("{$dataRoot}/{$directory}/nested/file");
+            chmod("{$dataRoot}/{$directory}/nested/file", 0644);
+        }
+
+        $chownedPaths = runInstallScriptDirectorySetup($scriptPath, $dataRoot, completeRun: false);
+
+        expect($chownedPaths)->toBe([])
+            ->and(installScriptFileMode($dataRoot))->toBe('0750');
+        foreach ($coolifyDirectories as $directory) {
+            expect(installScriptFileMode("{$dataRoot}/{$directory}"))->toBe('0750')
+                ->and(installScriptFileMode("{$dataRoot}/{$directory}/nested"))->toBe('0755')
+                ->and(installScriptFileMode("{$dataRoot}/{$directory}/nested/file"))->toBe('0644');
+        }
+    } finally {
+        exec('rm -rf '.escapeshellarg($dataRoot));
+    }
+})->with($installScripts);
+
+it('changes the data directories only after the checks and downloads', function (string $scriptPath) {
     $script = file_get_contents(dirname(__DIR__, 2).'/'.$scriptPath);
+    $downloadStep = strpos($script, 'step_start "Downloading required files from CDN"');
 
     expect($script)
         ->not->toContain("chown -R 9999:root /data/coolify\n")
         ->not->toContain("chmod -R 700 /data/coolify\n")
-        ->and(substr_count($script, "\nset_coolify_directory_permissions\n"))->toBe(2);
+        ->and(substr_count($script, "\ncreate_coolify_directories\n"))->toBe(1)
+        ->and(substr_count($script, "\nset_coolify_directory_permissions\n"))->toBe(1)
+        ->and(strpos($script, "\ncreate_coolify_directories\n"))->toBeGreaterThan($downloadStep)
+        ->and(strpos($script, "\nset_coolify_directory_permissions\n"))->toBeGreaterThan($downloadStep);
 })->with(array_map(fn (array $script) => $script[0], $installScripts));
diff --git a/tests/Unit/InstallScriptDockerDaemonConfigTest.php b/tests/Unit/InstallScriptDockerDaemonConfigTest.php
new file mode 100644
index 0000000000..2dab67a70d
--- /dev/null
+++ b/tests/Unit/InstallScriptDockerDaemonConfigTest.php
@@ -0,0 +1,118 @@
+<?php
+
+/**
+ * Runs the "Configuring Docker daemon" step of the install script against a temporary /etc/docker.
+ * docker, restart_docker_service, and the terminal UI helpers are stubbed.
+ *
+ * @param  array<string, string>  $variables
+ * @return array{config: ?array<string, mixed>, restarted: bool, output: string}
+ */
+function runInstallScriptDockerDaemonStep(string $scriptPath, ?string $daemonJson, int $runningContainers, array $variables = []): array
+{
+    $script = file_get_contents(dirname(__DIR__, 2).'/'.$scriptPath);
+    preg_match('/^step_start "Configuring Docker daemon".*?^step_done$/ms', $script, $matches);
+    expect($matches)->not->toBeEmpty();
+
+    $etcDocker = sys_get_temp_dir().'/coolify-install-docker-'.bin2hex(random_bytes(6));
+    mkdir($etcDocker);
+    if ($daemonJson !== null) {
+        file_put_contents("{$etcDocker}/daemon.json", $daemonJson);
+    }
+
+    $variables = [
+        'DATE' => '20260101-000000',
+        'DOCKER_ADDRESS_POOL_BASE' => '10.0.0.0/8',
+        'DOCKER_ADDRESS_POOL_SIZE' => '24',
+        'DOCKER_POOL_FORCE_OVERRIDE' => 'false',
+        'EXISTING_POOL_CONFIGURED' => 'false',
+        ...$variables,
+    ];
+    $prelude = implode("\n", array_map(fn ($name, $value) => "{$name}=".escapeshellarg($value), array_keys($variables), $variables));
+    $stubs = <<<BASH
+    set -e
+    set -o pipefail
+    step_start() { :; }
+    step_done() { :; }
+    warn() { echo "WARNING: \$*"; }
+    restart_docker_service() { echo RESTARTED; }
+    docker() { for i in \$(seq 1 {$runningContainers}); do echo "container\$i"; done; }
+    BASH;
+
+    $process = proc_open(
+        ['bash', '-c', $stubs."\n".$prelude."\n".str_replace('/etc/docker', $etcDocker, $matches[0])],
+        [1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
+        $pipes
+    );
+    $output = stream_get_contents($pipes[1]).stream_get_contents($pipes[2]);
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+    $exitCode = proc_close($process);
+
+    $config = file_exists("{$etcDocker}/daemon.json") ? json_decode(file_get_contents("{$etcDocker}/daemon.json"), true) : null;
+    exec('rm -rf '.escapeshellarg($etcDocker));
+
+    expect($exitCode)->toBe(0, $output);
+
+    return ['config' => $config, 'restarted' => str_contains($output, 'RESTARTED'), 'output' => $output];
+}
+
+$installScripts = ['stable install' => 'scripts/install.sh', 'nightly install' => 'other/nightly/install.sh'];
+
+it('does not create daemon.json or restart Docker when containers are running', function (string $scriptPath) {
+    $result = runInstallScriptDockerDaemonStep($scriptPath, null, runningContainers: 30);
+
+    expect($result['config'])->toBeNull()
+        ->and($result['restarted'])->toBeFalse()
+        ->and($result['output'])->toContain('stops 30 running container(s)')
+        ->toContain('DOCKER_POOL_FORCE_OVERRIDE=true');
+})->with($installScripts);
+
+it('configures the network pool and restarts Docker when no containers are running', function (string $scriptPath) {
+    $result = runInstallScriptDockerDaemonStep($scriptPath, null, runningContainers: 0);
+
+    expect($result['config'])->toEqual([
+        'default-address-pools' => [['base' => '10.0.0.0/8', 'size' => 24]],
+        'log-driver' => 'json-file',
+        'log-opts' => ['max-file' => '3', 'max-size' => '10m'],
+    ])->and($result['restarted'])->toBeTrue();
+})->with($installScripts);
+
+it('keeps other daemon.json settings when it adds the network pool', function (string $scriptPath) {
+    $result = runInstallScriptDockerDaemonStep($scriptPath, '{"registry-mirrors":["https://mirror.example.com"],"log-opts":{"compress":"true"}}', runningContainers: 0);
+
+    expect($result['config'])->toMatchArray([
+        'registry-mirrors' => ['https://mirror.example.com'],
+        'default-address-pools' => [['base' => '10.0.0.0/8', 'size' => 24]],
+        'log-opts' => ['compress' => 'true', 'max-file' => '3', 'max-size' => '10m'],
+    ])->and($result['restarted'])->toBeTrue();
+})->with($installScripts);
+
+it('applies the network pool with running containers when DOCKER_POOL_FORCE_OVERRIDE is true', function (string $scriptPath) {
+    $result = runInstallScriptDockerDaemonStep($scriptPath, '{"default-address-pools":[{"base":"172.16.0.0/12","size":20}]}', runningContainers: 5, variables: [
+        'DOCKER_POOL_FORCE_OVERRIDE' => 'true',
+        'EXISTING_POOL_CONFIGURED' => 'true',
+    ]);
+
+    expect($result['config']['default-address-pools'])->toBe([['base' => '10.0.0.0/8', 'size' => 24]])
+        ->and($result['restarted'])->toBeTrue();
+})->with($installScripts);
+
+it('does not restart Docker when the configuration is already up to date', function (string $scriptPath) {
+    $daemonJson = '{"log-driver":"json-file","log-opts":{"max-size":"10m","max-file":"3"},"default-address-pools":[{"base":"10.0.0.0/8","size":24}]}';
+    $result = runInstallScriptDockerDaemonStep($scriptPath, $daemonJson, runningContainers: 0, variables: ['DOCKER_POOL_FORCE_OVERRIDE' => 'true']);
+
+    expect($result['restarted'])->toBeFalse()
+        ->and($result['output'])->toContain('Configuration is up to date');
+})->with($installScripts);
+
+it('does not change an existing network pool without DOCKER_POOL_FORCE_OVERRIDE', function (string $scriptPath) {
+    $daemonJson = '{"default-address-pools":[{"base":"172.16.0.0/12","size":20}]}';
+    $result = runInstallScriptDockerDaemonStep($scriptPath, $daemonJson, runningContainers: 0, variables: [
+        'DOCKER_ADDRESS_POOL_BASE' => '172.16.0.0/12',
+        'DOCKER_ADDRESS_POOL_SIZE' => '20',
+        'EXISTING_POOL_CONFIGURED' => 'true',
+    ]);
+
+    expect($result['config'])->toBe(json_decode($daemonJson, true))
+        ->and($result['restarted'])->toBeFalse();
+})->with($installScripts);
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 7be4d80802..98adac798b 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -222,3 +222,13 @@ it('guides issue authors to the correct contribution branch', function () {
         ->toContain('Feature code should branch from `next` and target `next`')
         ->toContain('Small fixes should target `main`; larger changes should target `next`');
 });
+
+it('ships versions.json in the production image so version checks work right after an upgrade', function () {
+    $dockerfile = file_get_contents(dirname(__DIR__, 2).'/docker/production/Dockerfile');
+    $dockerignore = file_get_contents(dirname(__DIR__, 2).'/.dockerignore');
+
+    expect($dockerfile)
+        ->toContain('COPY --chown=www-data:www-data versions.json ./versions.json')
+        ->and($dockerignore)
+        ->not->toMatch('/^\/?versions\.json$/m');
+});
diff --git a/tests/Unit/RawComposeVolumePathTest.php b/tests/Unit/RawComposeVolumePathTest.php
index 685f84d84f..ec30253f58 100644
--- a/tests/Unit/RawComposeVolumePathTest.php
+++ b/tests/Unit/RawComposeVolumePathTest.php
@@ -246,3 +246,14 @@ YAML);
 
     expect($application->docker_compose_raw)->toContain('appdata');
 });
+
+it('resolves parent directory segments in long-form bind sources before remote work', function () {
+    Process::fake();
+
+    $application = makeRawComposeApplication(rawComposeBindSource('../../../../../../outside'));
+
+    expect(fn () => $application->oldRawParser())
+        ->toThrow(Exception::class, 'resolves to a path above /');
+
+    Process::assertNothingRan();
+});
diff --git a/tests/Unit/ScpStyleGitUrlTest.php b/tests/Unit/ScpStyleGitUrlTest.php
index 7e81484f9b..2c7372186b 100644
--- a/tests/Unit/ScpStyleGitUrlTest.php
+++ b/tests/Unit/ScpStyleGitUrlTest.php
@@ -50,8 +50,8 @@ it('parses scp-style ssh git urls including custom usernames and ports', functio
     ],
 ]);
 
-it('converts scp-style ssh git urls to https without embedding custom ports in the path', function (string $url, string $expected) {
-    expect(scpStyleGitUrlToHttps($url))->toBe($expected);
+it('converts ssh git urls to https without embedding custom ports in the path', function (string $url, string $expected) {
+    expect(sshGitUrlToHttps($url))->toBe($expected);
 })->with([
     'git username' => [
         'git@github.com:organization/repository.git',
@@ -69,19 +69,30 @@ it('converts scp-style ssh git urls to https without embedding custom ports in t
         'git@[fd00::5]:2222/organization/repository.git',
         'https://[fd00::5]/organization/repository.git',
     ],
+    'ssh scheme' => [
+        'ssh://git@github.com/organization/repository.git',
+        'https://github.com/organization/repository.git',
+    ],
+    'ssh scheme with port' => [
+        'ssh://git@gitea.example.com:2222/organization/repository.git',
+        'https://gitea.example.com/organization/repository.git',
+    ],
+    'ssh scheme with IPv6 host and port' => [
+        'ssh://git@[fd00::5]:2222/organization/repository.git',
+        'https://[fd00::5]/organization/repository.git',
+    ],
 ]);
 
 it('rejects non-scp-style git urls', function (string $url) {
     expect(parseScpStyleGitUrl($url))->toBeNull()
-        ->and(scpStyleGitUrlToHttps($url))->toBeNull();
+        ->and(sshGitUrlToHttps($url))->toBeNull();
 })->with([
     'https' => 'https://github.com/organization/repository.git',
     'email without path' => 'custom-user@git.example.com',
-    'ssh scheme' => 'ssh://git@github.com/organization/repository.git',
     'empty' => '',
 ]);
 
-it('normalizes github app repository slugs from scp-style ssh urls', function (string $url, string $expected) {
+it('normalizes github app repository slugs from ssh urls', function (string $url, string $expected) {
     expect(gitRepositorySlug($url))->toBe($expected);
 })->with([
     'https' => ['https://github.com/organization/repository.git', 'organization/repository'],
@@ -89,4 +100,6 @@ it('normalizes github app repository slugs from scp-style ssh urls', function (s
     'git username' => ['git@github.com:organization/repository.git', 'organization/repository'],
     'custom username' => ['custom-user@git.example.com:organization/repository.git', 'organization/repository'],
     'custom username and port' => ['custom-user@git.example.com:2222/organization/repository.git', 'organization/repository'],
+    'ssh scheme' => ['ssh://git@github.com/organization/repository.git', 'organization/repository'],
+    'ssh scheme with port' => ['ssh://git@ghe.example.com:2222/organization/repository.git', 'organization/repository'],
 ]);
diff --git a/tests/Unit/SeafileServiceTemplateTest.php b/tests/Unit/SeafileServiceTemplateTest.php
new file mode 100644
index 0000000000..ad4a05a143
--- /dev/null
+++ b/tests/Unit/SeafileServiceTemplateTest.php
@@ -0,0 +1,23 @@
+<?php
+
+use Symfony\Component\Yaml\Yaml;
+
+it('wires the seafile template to a seadoc server for wikis and sdoc files', function () {
+    $compose = Yaml::parseFile(__DIR__.'/../../templates/compose/seafile.yaml');
+    $seafile = $compose['services']['seafile']['environment'];
+    $seadoc = $compose['services']['seadoc']['environment'];
+
+    expect($compose['services']['seadoc']['image'])->toStartWith('seafileltd/sdoc-server:')
+        ->and($seadoc)->toContain('SERVICE_URL_SEADOC_80')
+        ->and($seafile)->toContain('ENABLE_SEADOC=${ENABLE_SEADOC:-true}')
+        // Seahub needs an absolute URL with a scheme, so SERVICE_FQDN_* (host only) does not work here.
+        ->and($seafile)->toContain('SEADOC_SERVER_URL=${SERVICE_URL_SEADOC}')
+        ->and($seadoc)->toContain('JWT_PRIVATE_KEY=${SERVICE_PASSWORD_64_JWT}')
+        ->and($seafile)->toContain('JWT_PRIVATE_KEY=${SERVICE_PASSWORD_64_JWT}')
+        ->and($seadoc)->toContain('DB_NAME=${SEAFILE_MYSQL_DB_SEAHUB_DB_NAME:-seahub_db}')
+        ->and($seafile)->toContain('SEAFILE_MYSQL_DB_SEAHUB_DB_NAME=${SEAFILE_MYSQL_DB_SEAHUB_DB_NAME:-seahub_db}');
+
+    $templates = json_decode(file_get_contents(__DIR__.'/../../templates/service-templates-latest.json'), true, flags: JSON_THROW_ON_ERROR);
+
+    expect(base64_decode($templates['seafile']['compose']))->toContain('SEADOC_SERVER_URL=${SERVICE_URL_SEADOC}');
+});
diff --git a/tests/Unit/ServerSupportedOsTest.php b/tests/Unit/ServerSupportedOsTest.php
new file mode 100644
index 0000000000..25b3fa0fb1
--- /dev/null
+++ b/tests/Unit/ServerSupportedOsTest.php
@@ -0,0 +1,24 @@
+<?php
+
+use App\Models\Server;
+
+it('matches the supported OS family from os-release', function (string $osRelease, string|false $expected) {
+    $result = Server::supportedOsFromOsRelease($osRelease);
+
+    expect($result === false ? false : $result->value())->toBe($expected);
+})->with([
+    'ubuntu by ID' => ["ID=ubuntu\nID_LIKE=debian", 'ubuntu debian raspbian pop'],
+    'arch by ID' => ['ID=arch', 'arch'],
+    'rocky by ID' => ["ID=\"rocky\"\nID_LIKE=\"rhel centos fedora\"", 'centos fedora rhel ol rocky amzn almalinux'],
+    'omarchy by ID_LIKE' => ["NAME=\"Omarchy\"\nID=omarchy\nID_LIKE=arch", 'arch'],
+    'manjaro by ID_LIKE' => ["ID=manjaro\nID_LIKE=arch", 'arch'],
+    'linux mint by ID_LIKE' => ["ID=linuxmint\nID_LIKE=\"ubuntu debian\"", 'ubuntu debian raspbian pop'],
+    'single-quoted ID_LIKE' => ["ID=zorin\nID_LIKE='ubuntu debian'", 'ubuntu debian raspbian pop'],
+    'unsupported without ID_LIKE' => ['ID=gentoo', false],
+    'unsupported ID_LIKE' => ["ID=foo\nID_LIKE=bar", false],
+    'empty output' => ['', false],
+]);
+
+it('returns false for null os-release output', function () {
+    expect(Server::supportedOsFromOsRelease(null))->toBeFalse();
+});
diff --git a/tests/Unit/ServerTransfer/ServerTransferBundleTest.php b/tests/Unit/ServerTransfer/ServerTransferBundleTest.php
index 5a476cf345..cd4d74019b 100644
--- a/tests/Unit/ServerTransfer/ServerTransferBundleTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferBundleTest.php
@@ -46,49 +46,32 @@ test('assertValid throws validation exception', function () {
     ServerTransferBundle::assertValid(['schema_version' => 99]);
 })->throws(ValidationException::class);
 
-test('passphrase encrypt decrypt round trip', function () {
-    $original = ServerTransferBundle::wrap([
-        'private_key' => ['private_key' => 'secret-key-material'],
-        'server' => [
-            'uuid' => 'srv-1',
-            'name' => 'web',
-            'ip' => '10.0.0.1',
-            'port' => 22,
-            'user' => 'root',
-        ],
-        'destinations' => [['uuid' => 'd1', 'name' => 'coolify', 'network' => 'coolify', 'type' => 'standalone']],
-        'projects' => [],
-    ]);
-
-    $encrypted = ServerTransferBundle::encryptWithPassphrase($original, 'correct horse battery staple');
-
-    expect($encrypted['encrypted'])->toBeTrue()
-        ->and($encrypted['payload'])->toBeString();
-
-    $restored = ServerTransferBundle::decryptWithPassphrase($encrypted, 'correct horse battery staple');
-
-    expect($restored['export_id'])->toBe($original['export_id'])
-        ->and($restored['server']['uuid'])->toBe('srv-1')
-        ->and($restored['private_key']['private_key'])->toBe('secret-key-material');
-});
-
-test('wrong passphrase fails decrypt', function () {
-    $original = ServerTransferBundle::wrap([
+function bundleTestMinimalBundle(): array
+{
+    return ServerTransferBundle::wrap([
         'private_key' => ['private_key' => 'x'],
         'server' => ['uuid' => 's', 'name' => 'n', 'ip' => '1.1.1.1', 'port' => 22, 'user' => 'root'],
         'destinations' => [],
         'projects' => [],
     ]);
+}
 
-    $encrypted = ServerTransferBundle::encryptWithPassphrase($original, 'good-pass');
+test('validate rejects a bundle from a newer or unknown Coolify version', function (?string $version, string $error) {
+    $bundle = bundleTestMinimalBundle();
+    $bundle['coolify_version'] = $version;
 
-    ServerTransferBundle::decryptWithPassphrase($encrypted, 'bad-pass');
-})->throws(RuntimeException::class);
+    $result = ServerTransferBundle::validate($bundle);
 
-test('app key seal unseal round trip', function () {
-    $original = ['hello' => 'world', 'n' => 1];
-    $sealed = ServerTransferBundle::sealWithAppKey($original);
-    $restored = ServerTransferBundle::unsealWithAppKey($sealed);
+    expect($result['valid'])->toBeFalse()
+        ->and(implode(' ', $result['errors']))->toContain($error);
+})->with([
+    'newer' => ['99.0.0', 'Upgrade this instance'],
+    'missing' => [null, 'Missing coolify_version'],
+]);
 
-    expect($restored)->toBe($original);
+test('validate accepts a bundle from an older Coolify version', function () {
+    $bundle = bundleTestMinimalBundle();
+    $bundle['coolify_version'] = '4.0.0';
+
+    expect(ServerTransferBundle::validate($bundle)['valid'])->toBeTrue();
 });
diff --git a/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php b/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php
index 11ef8e4369..c5c07e6195 100644
--- a/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferClaimerTest.php
@@ -1,16 +1,35 @@
 <?php
 
+use App\Enums\GithubRunnerStatus;
+use App\Jobs\CleanupGithubRunnerJob;
+use App\Jobs\DeregisterGithubRunnerJob;
+use App\Jobs\ProvisionGithubRunnerJob;
+use App\Models\Application;
+use App\Models\DnsProviderZone;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
 use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Services\ServerTransfer\ServerTransferClaimer;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
@@ -59,3 +78,213 @@ test('claim persists ownership metadata and always rebinds Sentinel', function (
         ->and((bool) $this->server->settings->is_sentinel_enabled)->toBeTrue()
         ->and((string) $this->server->settings->sentinel_custom_url)->toBe('https://coolify-a.test');
 });
+
+test('claim writes the owner marker with its claim id on the host', function () {
+    $result = app(ServerTransferClaimer::class)->claim($this->server);
+
+    $claimId = data_get($result, 'claim.claim_id');
+    expect($claimId)->toBeString()->not->toBeEmpty()
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.claim.claim_id'))->toBe($claimId);
+
+    Process::assertRan(function ($process) use ($claimId) {
+        $marker = json_decode((string) $process->input, true);
+
+        return str_contains($process->command, ServerTransferClaimer::OWNER_MARKER_PATH)
+            && data_get($marker, 'claim_id') === $claimId
+            && data_get($marker, 'instance_url') === 'https://coolify-a.test';
+    });
+});
+
+test('claim changes nothing when the owner marker cannot be written', function () {
+    Process::fake(['*' => Process::result(errorOutput: 'Permission denied', exitCode: 1)]);
+    $sentinelUrlBefore = $this->server->settings->sentinel_custom_url;
+
+    expect(fn () => app(ServerTransferClaimer::class)->claim($this->server))->toThrow(RuntimeException::class);
+
+    $this->server->refresh();
+    expect(data_get($this->server->server_metadata, 'transfer.status'))->toBe('imported')
+        ->and(data_get($this->server->server_metadata, 'transfer.claim'))->toBeNull()
+        ->and($this->server->settings->sentinel_custom_url)->toBe($sentinelUrlBefore);
+});
+
+test('a server is released when its owner marker names the claim of another instance', function () {
+    app(ServerTransferClaimer::class)->claim($this->server);
+
+    $released = app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server->fresh(), json_encode([
+        'claim_id' => 'claim-of-instance-b',
+        'instance_url' => 'https://coolify-b.test',
+    ]));
+
+    $this->server->refresh();
+    expect($released)->toBeTrue()
+        ->and($this->server->isTransferredAway())->toBeTrue()
+        ->and(data_get($this->server->server_metadata, 'transfer.target_instance_url'))->toBe('https://coolify-b.test')
+        ->and((bool) $this->server->settings->force_disabled)->toBeTrue()
+        ->and((bool) $this->server->settings->is_sentinel_enabled)->toBeFalse();
+});
+
+test('a server is not released when the owner marker is its own claim or missing', function (?string $marker) {
+    $claimId = data_get(app(ServerTransferClaimer::class)->claim($this->server), 'claim.claim_id');
+    $marker = $marker === 'own' ? json_encode(['claim_id' => $claimId, 'instance_url' => 'https://coolify-a.test']) : $marker;
+
+    $released = app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server->fresh(), $marker);
+
+    expect($released)->toBeFalse()
+        ->and($this->server->fresh()->isTransferredAway())->toBeFalse()
+        ->and((bool) $this->server->fresh()->settings->force_disabled)->toBeFalse();
+})->with([
+    'own claim' => 'own',
+    'no marker' => '',
+    'unreadable marker' => 'not json',
+    'marker without claim id' => '{"instance_url":"https://coolify-b.test"}',
+]);
+
+test('a server that this instance never claimed ignores the owner marker', function () {
+    $released = app(ServerTransferClaimer::class)->releaseIfClaimedElsewhere($this->server, json_encode([
+        'claim_id' => 'left-over-claim-of-a-deleted-instance',
+        'instance_url' => 'https://coolify-b.test',
+    ]));
+
+    expect($released)->toBeFalse()
+        ->and($this->server->fresh()->isTransferredAway())->toBeFalse();
+});
+
+test('markTransferred keeps the DNS records of the server resources as not owned, without provider calls', function () {
+    Http::fake();
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create(['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    $otherApplication = Application::factory()->create();
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $token->id]);
+    $onlyThisServer = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id]);
+    $onlyThisServer->addReference($application);
+    $shared = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id]);
+    $shared->addReference($application);
+    $shared->addReference($otherApplication);
+
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    Http::assertNothingSent();
+    expect($onlyThisServer->fresh()->owned)->toBeFalse()
+        ->and($onlyThisServer->fresh()->references()->pluck('resource_id')->all())->toBe([$application->id])
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.parked_dns_record_ids'))->toBe([$onlyThisServer->id])
+        ->and($shared->fresh()->owned)->toBeTrue()
+        ->and($shared->fresh()->references()->pluck('resource_id')->all())->toBe([$otherApplication->id]);
+});
+
+test('take back owns the parked DNS records again and starts the finish list', function (string $remoteComment, bool $reclaimed) {
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $application = Application::factory()->create(['destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $token->id]);
+    $record = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id, 'name' => 'app.example.test', 'type' => 'A', 'content' => '10.0.0.1']);
+    $record->addReference($application);
+    $claimer = app(ServerTransferClaimer::class);
+    $claimer->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+    $claimer->claim($this->server->fresh());
+    $remote = ['type' => 'A', 'name' => 'app.example.test', 'content' => '10.0.0.1', 'comment' => str_replace('{uuid}', $record->uuid, $remoteComment)];
+    Http::fake([
+        'api.cloudflare.com/*' => fn ($request) => $request->method() === 'GET'
+            ? Http::response(['success' => true, 'result' => $remote])
+            : Http::response(['success' => true, 'result' => [...$remote, 'comment' => $record->ownershipComment()]]),
+    ]);
+
+    $items = $claimer->restoreAfterTakeBack($this->server->fresh());
+
+    expect($record->fresh()->owned)->toBe($reclaimed)
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.parked_dns_record_ids'))->toBeNull()
+        ->and(array_column($items, 'key'))->toContain("dns_record:{$record->uuid}", "manual_webhook:{$application->uuid}")
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.finish.items'))->toBe($items);
+    if ($reclaimed) {
+        Http::assertSent(fn ($request) => $request->method() === 'PATCH' && $request['comment'] === $record->ownershipComment());
+    } else {
+        Http::assertNotSent(fn ($request) => $request->method() === 'PATCH');
+    }
+})->with([
+    'the other instance adopted the record' => ['managed-by: coolify other-instance/{uuid}', true],
+    'someone changed the record at the provider' => ['set by hand', false],
+]);
+
+function transferRunnerSetup(Server $server): array
+{
+    $githubApp = GithubApp::create([
+        'name' => 'runner-app',
+        'organization' => 'acme',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 5151,
+        'installation_id' => 5252,
+        'webhook_secret' => 'runner-secret',
+        'team_id' => $server->team_id,
+        'is_system_wide' => false,
+    ]);
+    $config = GithubRunnerConfig::create(['server_id' => $server->id, 'github_app_id' => $githubApp->id, 'labels' => ['coolify'], 'is_enabled' => true]);
+
+    return [$githubApp, $config];
+}
+
+test('markTransferred disables the runner config and stops tracking the runners without removing them at GitHub', function () {
+    Queue::fake();
+    [$githubApp, $config] = transferRunnerSetup($this->server);
+    $execution = fn (GithubRunnerStatus $status, array $attributes = []) => GithubRunnerExecution::create([
+        'github_app_id' => $githubApp->id,
+        'github_runner_config_id' => $config->id,
+        'server_id' => $this->server->id,
+        'trigger_workflow_job_id' => fake()->unique()->numberBetween(1000, 9999),
+        'status' => $status,
+        'runner_id' => fake()->unique()->numberBetween(1, 999),
+        ...$attributes,
+    ]);
+    $active = collect([
+        $execution(GithubRunnerStatus::Queued, ['runner_id' => null]),
+        $execution(GithubRunnerStatus::Provisioning),
+        $execution(GithubRunnerStatus::Idle),
+        $execution(GithubRunnerStatus::Running),
+    ]);
+    $completed = $execution(GithubRunnerStatus::Completed, ['completed_at' => now()->subDay(), 'error_message' => null]);
+
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    expect($config->fresh()->is_enabled)->toBeFalse()
+        ->and($completed->fresh()->only(['status', 'error_message']))->toBe(['status' => GithubRunnerStatus::Completed, 'error_message' => null]);
+    foreach ($active as $row) {
+        $row->refresh();
+        expect($row->status)->toBe(GithubRunnerStatus::Cancelled)
+            ->and($row->completed_at)->not->toBeNull()
+            ->and($row->error_message)->toBe('The server was transferred to another Coolify instance. This instance stopped managing its runners.');
+    }
+
+    // Deleting the archive later must not pull the runners that now belong to the target.
+    $this->server->fresh()->forceDelete();
+
+    Queue::assertNotPushed(DeregisterGithubRunnerJob::class);
+    Queue::assertNotPushed(CleanupGithubRunnerJob::class);
+});
+
+test('a GitHub webhook does not queue a runner for a transferred server', function () {
+    Queue::fake();
+    [$githubApp] = transferRunnerSetup($this->server);
+    $send = function () use ($githubApp) {
+        $body = json_encode([
+            'action' => 'queued',
+            'workflow_job' => ['id' => fake()->unique()->numberBetween(1000, 9999), 'labels' => ['self-hosted', 'coolify'], 'name' => 'test'],
+            'repository' => ['id' => 99, 'full_name' => 'acme/api'],
+            'installation' => ['id' => $githubApp->installation_id],
+        ], JSON_THROW_ON_ERROR);
+
+        return $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'workflow_job',
+            'HTTP_X-GitHub-Hook-Installation-Target-Id' => (string) $githubApp->app_id,
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'runner-secret'),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    };
+    $send()->assertSee('Runner queued.');
+    GithubRunnerExecution::query()->delete();
+
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    $send()->assertSee('No runner configuration matches the job labels.');
+    expect(GithubRunnerExecution::count())->toBe(0);
+    Queue::assertPushed(ProvisionGithubRunnerJob::class, 1);
+});
diff --git a/tests/Unit/ServerTransfer/ServerTransferCoverageTest.php b/tests/Unit/ServerTransfer/ServerTransferCoverageTest.php
new file mode 100644
index 0000000000..f7782f4d91
--- /dev/null
+++ b/tests/Unit/ServerTransfer/ServerTransferCoverageTest.php
@@ -0,0 +1,208 @@
+<?php
+
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\CloudProviderToken;
+use App\Models\DnsProviderZone;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\SslCertificate;
+use App\Models\StandaloneDocker;
+use App\Models\SwarmDocker;
+use App\Models\Tag;
+use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferCoverage;
+use App\Services\ServerTransfer\ServerTransferExporter;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+/**
+ * Saves a record without model events. Required columns that $attributes leaves out get a dummy value.
+ *
+ * @param  class-string<Model>  $modelClass
+ * @param  array<string, mixed>  $attributes
+ */
+function transferCoverageRecord(string $modelClass, array $attributes = []): Model
+{
+    $model = new $modelClass;
+    foreach (Schema::getColumns($model->getTable()) as $column) {
+        $name = $column['name'];
+        if (array_key_exists($name, $attributes) || $column['nullable'] || $column['default'] !== null || $name === 'id' || $column['auto_increment']) {
+            continue;
+        }
+        // The SQLite test schema reports dates as text, so the model casts decide first.
+        $type = strtolower($column['type_name']);
+        $attributes[$name] = match (true) {
+            $name === 'uuid' => new_public_id(),
+            $model->hasCast($name, ['date', 'datetime', 'immutable_date', 'immutable_datetime', 'timestamp']) => now(),
+            $model->hasCast($name, ['bool', 'boolean']) || str_contains($type, 'bool') => false,
+            $model->hasCast($name, ['array', 'json', 'collection', 'object']) || str_contains($type, 'json') => [],
+            str_contains($type, 'int') => 1,
+            default => 'coverage_'.$name,
+        };
+    }
+
+    return $modelClass::withoutEvents(function () use ($model, $attributes) {
+        $model->forceFill($attributes)->save();
+
+        return $model;
+    });
+}
+
+/**
+ * Every key that the records at these bundle paths contain, also the keys of their `attributes` object.
+ * A record with a `model` key counts only for that model.
+ *
+ * @param  array<string, mixed>  $bundle
+ * @param  list<string>  $paths
+ * @return array{keys: list<string>, records: int}
+ */
+function transferCoverageBundleKeys(array $bundle, array $paths, string $modelClass): array
+{
+    $records = collect($paths)
+        ->flatMap(function (string $path) use ($bundle) {
+            $found = data_get($bundle, $path);
+
+            // A path to one record returns the record itself; a path with `*` returns a list of records.
+            return is_array($found) && ! array_is_list($found) ? [$found] : Arr::wrap($found);
+        })
+        ->filter(fn ($record) => is_array($record) && ! array_is_list($record))
+        ->filter(fn (array $record) => ! isset($record['model']) || $record['model'] === $modelClass);
+
+    $keys = $records->flatMap(fn (array $record) => [...array_keys($record), ...array_keys((array) ($record['attributes'] ?? []))]);
+
+    return ['keys' => $keys->unique()->values()->all(), 'records' => $records->count()];
+}
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    Storage::fake('images');
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
+
+    $team = Team::factory()->create();
+    $teamId = ['team_id' => $team->id];
+    $privateKey = PrivateKey::factory()->create($teamId);
+    $deployKey = PrivateKey::factory()->create([...$teamId, 'private_key' => generateSSHKey('ed25519')['private']]);
+    $token = CloudProviderToken::factory()->create($teamId);
+    $this->server = Server::factory()->create([...$teamId, 'private_key_id' => $privateKey->id, 'cloud_provider_token_id' => $token->id, 'ip' => '10.88.0.10']);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    transferCoverageRecord(SwarmDocker::class, ['server_id' => $this->server->id]);
+    transferCoverageRecord(SslCertificate::class, ['server_id' => $this->server->id]);
+
+    $project = Project::factory()->create($teamId);
+    Storage::disk('images')->put("project-icons/{$project->uuid}/icon.jpg", "\xFF\xD8\xFF\xE0\x00\x10JFIF\x00coverage");
+    $project->forceFill(['icon_path' => "project-icons/{$project->uuid}/icon.jpg", 'icon_storage_type' => 'local'])->saveQuietly();
+    $environment = $project->environments()->first() ?? Environment::factory()->create(['project_id' => $project->id]);
+    $onDestination = ['environment_id' => $environment->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    $githubApp = transferCoverageRecord(GithubApp::class, [...$teamId, 'is_system_wide' => false, 'private_key_id' => $deployKey->id]);
+    $gitlabApp = transferCoverageRecord(GitlabApp::class, [...$teamId, 'is_system_wide' => false]);
+    $application = Application::factory()->create([...$onDestination, 'source_type' => GithubApp::class, 'source_id' => $githubApp->id, 'private_key_id' => $deployKey->id]);
+    Application::factory()->create([...$onDestination, 'source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id]);
+    $preview = transferCoverageRecord(ApplicationPreview::class, ['application_id' => $application->id]);
+
+    $s3 = transferCoverageRecord(S3Storage::class, $teamId);
+    $service = Service::factory()->create([...$onDestination, 'server_id' => $this->server->id]);
+    transferCoverageRecord(ResourceLink::class, [
+        'environment_id' => $environment->id,
+        'source_type' => $application->getMorphClass(), 'source_id' => $application->id,
+        'target_type' => $service->getMorphClass(), 'target_id' => $service->id,
+    ]);
+    transferCoverageRecord(GithubRunnerConfig::class, ['server_id' => $this->server->id, 'github_app_id' => $githubApp->id, 'labels' => ['coverage']]);
+    transferCoverageRecord(ServiceApplication::class, ['service_id' => $service->id]);
+    transferCoverageRecord(ServiceDatabase::class, ['service_id' => $service->id]);
+
+    $databases = collect(ServerTransferCoverage::TRANSFERRED)->keys()
+        ->filter(fn (string $class) => str_starts_with(class_basename($class), 'Standalone') && ! in_array($class, [StandaloneDocker::class], true))
+        ->map(fn (string $class) => transferCoverageRecord($class, $onDestination));
+
+    $volume = transferCoverageRecord(LocalPersistentVolume::class, ['resource_type' => $application->getMorphClass(), 'resource_id' => $application->id]);
+    transferCoverageRecord(LocalFileVolume::class, ['resource_type' => $application->getMorphClass(), 'resource_id' => $application->id]);
+    transferCoverageRecord(ScheduledVolumeBackup::class, [...$teamId, 'backupable_type' => $volume->getMorphClass(), 'backupable_id' => $volume->id, 's3_storage_id' => $s3->id]);
+    transferCoverageRecord(ScheduledTask::class, [...$teamId, 'application_id' => $application->id]);
+    transferCoverageRecord(ScheduledTask::class, [...$teamId, 'service_id' => $service->id]);
+    transferCoverageRecord(ScheduledDatabaseBackup::class, [...$teamId, 'database_type' => $databases->first()->getMorphClass(), 'database_id' => $databases->first()->id, 's3_storage_id' => $s3->id]);
+
+    $tag = transferCoverageRecord(Tag::class, $teamId);
+    foreach ([$application, $databases->first(), $service] as $tagged) {
+        $tagged->tags()->attach($tag->id);
+    }
+
+    foreach ([$application, $preview->application, $databases->first(), $service] as $resource) {
+        transferCoverageRecord(EnvironmentVariable::class, ['resourceable_type' => $resource->getMorphClass(), 'resourceable_id' => $resource->id, 'key' => 'COVERAGE_'.fake()->unique()->numberBetween(), 'value' => '{{team.COVERAGE_TEAM}}']);
+    }
+    transferCoverageRecord(EnvironmentVariable::class, ['resourceable_type' => $application->getMorphClass(), 'resourceable_id' => $application->id, 'key' => 'COVERAGE_PREVIEW', 'value' => 'x', 'is_preview' => true]);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'team', 'key' => 'COVERAGE_TEAM']);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'server', 'server_id' => $this->server->id]);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'project', 'project_id' => $project->id]);
+    transferCoverageRecord(SharedEnvironmentVariable::class, [...$teamId, 'type' => 'environment', 'environment_id' => $environment->id]);
+
+    $cloudflareToken = IntegrationToken::factory()->create([...$teamId, 'provider' => 'cloudflare', 'capabilities' => ['dns', 'tunnel'], 'metadata' => ['automatic_dns' => true]]);
+    $secretsToken = IntegrationToken::factory()->create([...$teamId, 'provider' => 'infisical', 'capabilities' => ['secrets'], 'metadata' => ['client_id' => 'coverage']]);
+    $zone = DnsProviderZone::factory()->create(['integration_token_id' => $cloudflareToken->id]);
+    ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => $zone->id])->addReference($application);
+    $application->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project_id' => 'coverage', 'environment' => 'prod']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $cloudflareToken->id])->saveQuietly();
+
+    $this->bundle = app(ServerTransferExporter::class)->export($this->server->fresh());
+});
+
+test('every model has a server transfer decision', function () {
+    $models = collect(glob(app_path('Models/*.php')))
+        ->map(fn (string $file) => 'App\\Models\\'.basename($file, '.php'))
+        ->filter(fn (string $class) => is_subclass_of($class, Model::class) && ! (new ReflectionClass($class))->isAbstract());
+
+    $undecided = $models
+        ->reject(fn (string $class) => array_key_exists($class, ServerTransferCoverage::TRANSFERRED)
+            || array_key_exists($class, ServerTransferCoverage::NOT_TRANSFERRED))
+        ->values()->all();
+
+    expect($undecided)->toBe([], 'Add these models to the server transfer (ServerTransferExporter/Importer and ServerTransferCoverage::TRANSFERRED), or to ServerTransferCoverage::NOT_TRANSFERRED with a reason.');
+});
+
+test('every column of a transferred model is in the bundle or has a reason why not', function (string $modelClass) {
+    ['keys' => $exported, 'records' => $records] = transferCoverageBundleKeys($this->bundle, ServerTransferCoverage::TRANSFERRED[$modelClass], $modelClass);
+    expect($records)->toBeGreaterThan(0, "The coverage fixture exports no {$modelClass}. Add a record of it to the beforeEach of this test.");
+
+    $notExported = [...ServerTransferCoverage::ALWAYS_NOT_EXPORTED, ...array_keys(ServerTransferCoverage::NOT_EXPORTED_COLUMNS[$modelClass] ?? [])];
+    $columns = Schema::getColumnListing((new $modelClass)->getTable());
+
+    expect(array_values(array_diff($columns, $exported, $notExported)))
+        ->toBe([], "These {$modelClass} columns are not in the transfer bundle. Export and import them (with a round-trip test), or add them to ServerTransferCoverage::NOT_EXPORTED_COLUMNS with a reason.")
+        ->and(array_values(array_intersect(array_keys(ServerTransferCoverage::NOT_EXPORTED_COLUMNS[$modelClass] ?? []), $exported)))
+        ->toBe([], "These {$modelClass} columns are exported, so remove them from ServerTransferCoverage::NOT_EXPORTED_COLUMNS.")
+        ->and(array_values(array_diff(array_keys(ServerTransferCoverage::NOT_EXPORTED_COLUMNS[$modelClass] ?? []), $columns)))
+        ->toBe([], "These {$modelClass} columns no longer exist, so remove them from ServerTransferCoverage::NOT_EXPORTED_COLUMNS.");
+})->with(array_keys(ServerTransferCoverage::TRANSFERRED));
diff --git a/tests/Unit/ServerTransfer/ServerTransferDnsTest.php b/tests/Unit/ServerTransfer/ServerTransferDnsTest.php
new file mode 100644
index 0000000000..3dc6aedef1
--- /dev/null
+++ b/tests/Unit/ServerTransfer/ServerTransferDnsTest.php
@@ -0,0 +1,250 @@
+<?php
+
+use App\Jobs\ReleaseManagedDnsRecordsJob;
+use App\Jobs\ValidateAndInstallServerJob;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\DnsProviderZone;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Services\ServerTransfer\ServerTransferExporter;
+use App\Services\ServerTransfer\ServerTransferImporter;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // Deleting the source resources must not release their DNS records at the provider.
+    Queue::fake([ValidateAndInstallServerJob::class, ReleaseManagedDnsRecordsJob::class]);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
+    config(['app.id' => 'source-instance']);
+
+    $this->team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $privateKey->id, 'ip' => '10.66.0.10']);
+    $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $project->environments()->first() ?? Environment::factory()->create(['project_id' => $project->id]);
+    $onDestination = ['environment_id' => $this->environment->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()];
+
+    $this->application = Application::factory()->create([...$onDestination, 'name' => 'web', 'fqdn' => 'https://app.example.com']);
+    $this->preview = new ApplicationPreview;
+    $this->preview->forceFill(['application_id' => $this->application->id, 'pull_request_id' => 3, 'pull_request_html_url' => '', 'fqdn' => 'https://pr-3.example.com']);
+    $this->preview->uuid = 'dns-transfer-preview';
+    $this->preview->saveQuietly();
+    $this->service = Service::factory()->create([...$onDestination, 'server_id' => $this->server->id]);
+    $this->serviceApplication = new ServiceApplication;
+    $this->serviceApplication->forceFill(['service_id' => $this->service->id, 'name' => 'whoami', 'fqdn' => 'https://svc.example.com']);
+    $this->serviceApplication->uuid = 'dns-transfer-service-app';
+    $this->serviceApplication->save();
+
+    $this->cloudflareToken = IntegrationToken::factory()->create([
+        'team_id' => $this->team->id, 'provider' => 'cloudflare', 'token' => 'cf-api-token', 'capabilities' => ['dns', 'tunnel'],
+    ]);
+    $this->zone = DnsProviderZone::factory()->create(['integration_token_id' => $this->cloudflareToken->id, 'name' => 'example.com', 'provider_zone_id' => 'zone-1']);
+
+    $this->exporter = app(ServerTransferExporter::class);
+    $this->importer = app(ServerTransferImporter::class);
+});
+
+/**
+ * @param  list<Model>  $resources
+ */
+function dnsTransferRecord(object $test, string $name, array $resources, bool $owned = true): ManagedDnsRecord
+{
+    $record = ManagedDnsRecord::factory()->create([
+        'dns_provider_zone_id' => $test->zone->id, 'provider_record_id' => 'cf-'.$name,
+        'type' => 'A', 'name' => $name, 'content' => '10.66.0.10', 'owned' => $owned,
+    ]);
+    foreach ($resources as $resource) {
+        $record->addReference($resource);
+    }
+
+    return $record;
+}
+
+/**
+ * The source rows are removed so the import can use the same UUIDs. The source forgets the DNS records at transfer.
+ */
+function removeDnsTransferSource(object $test): void
+{
+    ManagedDnsRecord::query()->delete();
+    ApplicationPreview::withoutEvents(fn () => ApplicationPreview::withTrashed()->get()->each->forceDelete());
+    ServiceApplication::withTrashed()->get()->each->forceDelete();
+    $test->service->forceDelete();
+    $test->application->forceDelete();
+    $test->server->forceDelete();
+}
+
+test('integration tokens move with the transfer and a token with the same uuid in the team is reused', function () {
+    $secretsToken = IntegrationToken::factory()->create([
+        'team_id' => $this->team->id, 'provider' => 'infisical', 'token' => 'infisical-secret', 'capabilities' => ['secrets'], 'metadata' => ['client_id' => 'client'],
+    ]);
+    $this->application->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project_id' => 'p1', 'environment' => 'prod']]);
+    $this->service->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project_id' => 'p2', 'environment' => 'dev']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $this->cloudflareToken->id])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect(collect($bundle['integration_tokens'])->pluck('token', 'uuid')->all())
+        ->toEqualCanonicalizing([$secretsToken->uuid => 'infisical-secret', $this->cloudflareToken->uuid => 'cf-api-token'])
+        ->and($bundle['server']['settings']['cloudflare_tunnel_integration_token_uuid'])->toBe($this->cloudflareToken->uuid)
+        ->and($bundle['server']['settings'])->not->toHaveKey('cloudflare_tunnel_integration_token_id')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('secret manager')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('Cloudflare API token');
+
+    removeDnsTransferSource($this);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $application = Application::where('uuid', $this->application->uuid)->firstOrFail();
+    $service = Service::where('uuid', $this->service->uuid)->firstOrFail();
+    expect(IntegrationToken::count())->toBe(2)
+        ->and($result['created']['integration_tokens'])->toBe(2)
+        ->and($application->secretManagerLink->integration_token_id)->toBe($secretsToken->id)
+        ->and($application->secretManagerLink->settings)->toBe(['project_id' => 'p1', 'environment' => 'prod'])
+        ->and($service->secretManagerLink->integration_token_id)->toBe($secretsToken->id)
+        ->and($service->secretManagerLink->settings)->toBe(['project_id' => 'p2', 'environment' => 'dev'])
+        ->and(Server::where('uuid', $result['server_uuid'])->firstOrFail()->settings->cloudflare_tunnel_integration_token_id)->toBe($this->cloudflareToken->id);
+});
+
+test('integration tokens get a new uuid in the target team when another team has the uuid', function () {
+    $secretsToken = IntegrationToken::factory()->create(['team_id' => $this->team->id, 'provider' => 'doppler', 'token' => 'dp.st.secret', 'capabilities' => ['secrets']]);
+    $this->application->secretManagerLink()->create(['integration_token_id' => $secretsToken->id, 'settings' => ['project' => 'web', 'config' => 'prd']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $this->cloudflareToken->id])->saveQuietly();
+    $bundle = $this->exporter->export($this->server->fresh());
+    $targetTeam = Team::factory()->create();
+
+    removeDnsTransferSource($this);
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $targetTokens = IntegrationToken::where('team_id', $targetTeam->id)->get()->keyBy('provider');
+    $link = Application::where('uuid', $this->application->uuid)->firstOrFail()->secretManagerLink;
+    expect($targetTokens)->toHaveCount(2)
+        ->and($targetTokens['doppler']->uuid)->not->toBe($secretsToken->uuid)
+        ->and($targetTokens['doppler']->token)->toBe('dp.st.secret')
+        ->and($targetTokens['cloudflare']->uuid)->not->toBe($this->cloudflareToken->uuid)
+        ->and($link->integration_token_id)->toBe($targetTokens['doppler']->id)
+        ->and(Server::where('uuid', $result['server_uuid'])->firstOrFail()->settings->cloudflare_tunnel_integration_token_id)->toBe($targetTokens['cloudflare']->id)
+        ->and($secretsToken->fresh()->team_id)->toBe($this->team->id);
+});
+
+test('managed DNS records, their zone and references move with the resources', function () {
+    Http::fake();
+    $appRecord = dnsTransferRecord($this, 'app.example.com', [$this->application]);
+    dnsTransferRecord($this, 'pr-3.example.com', [$this->preview], owned: false);
+    $serviceRecord = dnsTransferRecord($this, 'svc.example.com', [$this->serviceApplication]);
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect($bundle['dns_zones'])->toHaveCount(1)
+        ->and($bundle['integration_tokens'][0]['uuid'])->toBe($this->cloudflareToken->uuid)
+        ->and(collect($bundle['managed_dns_records'])->pluck('references', 'name')->all())->toBe([
+            'app.example.com' => [['kind' => 'application', 'uuid' => $this->application->uuid]],
+            'pr-3.example.com' => [['kind' => 'preview', 'uuid' => 'dns-transfer-preview']],
+            'svc.example.com' => [['kind' => 'service_application', 'uuid' => 'dns-transfer-service-app']],
+        ])
+        ->and($bundle['managed_dns_records'][0]['ownership_comment'])->toBe($appRecord->ownershipComment())
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('DNS record');
+
+    removeDnsTransferSource($this);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $records = ManagedDnsRecord::with('references.resource')->get()->keyBy('name');
+    expect($result['created']['managed_dns_records'])->toBe(3)
+        ->and(DnsProviderZone::count())->toBe(1)
+        ->and($records)->toHaveCount(3)
+        ->and($records['app.example.com']->uuid)->toBe($appRecord->uuid)
+        ->and($records['app.example.com']->dns_provider_zone_id)->toBe($this->zone->id)
+        ->and($records['app.example.com']->integration_token_id)->toBe($this->cloudflareToken->id)
+        ->and($records['app.example.com']->owned)->toBeTrue()
+        ->and($records['pr-3.example.com']->owned)->toBeFalse()
+        ->and($records['svc.example.com']->uuid)->toBe($serviceRecord->uuid)
+        ->and($records['app.example.com']->references->sole()->resource->uuid)->toBe($this->application->uuid)
+        ->and($records['pr-3.example.com']->references->sole()->resource)->toBeInstanceOf(ApplicationPreview::class)
+        ->and($records['pr-3.example.com']->references->sole()->resource->uuid)->toBe('dns-transfer-preview')
+        ->and($records['svc.example.com']->references->sole()->resource)->toBeInstanceOf(ServiceApplication::class)
+        ->and($records['svc.example.com']->references->sole()->resource->uuid)->toBe('dns-transfer-service-app');
+    // Same instance id and UUID: the provider comment already proves ownership here.
+    Http::assertNothingSent();
+});
+
+test('a DNS record that a resource staying on the source also uses is not exported', function () {
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->server->private_key_id, 'ip' => '10.66.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    $staying = Application::factory()->create([
+        'environment_id' => $this->environment->id, 'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(), 'fqdn' => 'https://shared.example.com',
+    ]);
+    dnsTransferRecord($this, 'shared.example.com', [$this->application, $staying]);
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect($bundle['managed_dns_records'])->toBe([])
+        ->and($bundle['dns_zones'])->toBe([])
+        ->and($bundle['integration_tokens'])->toBe([])
+        ->and(implode(' ', $bundle['warnings']))->toContain('DNS record shared.example.com stays managed by this instance');
+});
+
+test('the target takes ownership of an owned record when the provider still has the source comment', function () {
+    $record = dnsTransferRecord($this, 'app.example.com', [$this->application]);
+    dnsTransferRecord($this, 'pr-3.example.com', [$this->preview], owned: false);
+    $sourceComment = $record->ownershipComment();
+    $bundle = $this->exporter->export($this->server->fresh());
+    removeDnsTransferSource($this);
+
+    $state = fakeCloudflareDns([
+        ['id' => 'cf-app.example.com', 'type' => 'A', 'name' => 'app.example.com', 'content' => '10.66.0.10', 'comment' => $sourceComment],
+        ['id' => 'cf-pr-3.example.com', 'type' => 'A', 'name' => 'pr-3.example.com', 'content' => '10.66.0.10', 'comment' => null],
+    ]);
+    config(['app.id' => 'target-instance']);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $targetComment = ManagedDnsRecord::ownershipCommentFor($record->uuid);
+    expect($targetComment)->not->toBe($sourceComment)
+        ->and(sentDnsRequests('PATCH'))->toBe(1)
+        ->and(Http::recorded(fn (Request $request) => $request->method() === 'PATCH')->sole()[0]->data())->toBe(['comment' => $targetComment])
+        ->and($state['records']['cf-app.example.com']['comment'])->toBe($targetComment)
+        ->and(ManagedDnsRecord::where('name', 'app.example.com')->sole()->owned)->toBeTrue()
+        ->and(ManagedDnsRecord::where('name', 'pr-3.example.com')->sole()->owned)->toBeFalse()
+        ->and(implode(' ', $result['warnings']))->not->toContain('could not take ownership');
+});
+
+test('the target does not own a record it cannot adopt and the import still succeeds', function (Closure $fakeProvider) {
+    $record = dnsTransferRecord($this, 'app.example.com', [$this->application]);
+    $bundle = $this->exporter->export($this->server->fresh());
+    removeDnsTransferSource($this);
+
+    $fakeProvider($record);
+    config(['app.id' => 'target-instance']);
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    expect(sentDnsRequests('PATCH'))->toBe(0)
+        ->and(Server::where('uuid', $result['server_uuid'])->exists())->toBeTrue()
+        ->and(ManagedDnsRecord::where('name', 'app.example.com')->sole()->owned)->toBeFalse()
+        ->and($result['warnings'])->toContain('DNS record app.example.com: this instance could not take ownership; it will not change or delete it.');
+})->with([
+    'the provider comment changed' => [fn (ManagedDnsRecord $record) => fakeCloudflareDns([
+        ['id' => 'cf-app.example.com', 'type' => 'A', 'name' => 'app.example.com', 'content' => '10.66.0.10', 'comment' => 'edited by hand'],
+    ])],
+    'the provider cannot be reached' => [fn (ManagedDnsRecord $record) => Http::fake(fn () => throw new ConnectionException('Connection refused'))],
+]);
diff --git a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
index 1d57fe9aff..26eb2f9aad 100644
--- a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
@@ -1,17 +1,22 @@
 <?php
 
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
 use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
 use App\Models\IntegrationToken;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\ManagedDnsRecord;
 use App\Models\PrivateKey;
 use App\Models\Project;
+use App\Models\ResourceLink;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledTask;
 use App\Models\ScheduledVolumeBackup;
@@ -25,17 +30,28 @@ use App\Models\StandalonePostgresql;
 use App\Models\StandaloneSqlite;
 use App\Models\Tag;
 use App\Models\Team;
+use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferBundle;
+use App\Services\ServerTransfer\ServerTransferClaimer;
 use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\ValidationException;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
@@ -324,12 +340,98 @@ test('round trip import preserves uuids secrets and related resources after sour
         ->and($shared->value)->toBe('shared-secret');
 });
 
+test('import validates the claimed server in the background, but a dry run does not', function () {
+    $bundle = $this->exporter->export($this->server);
+    $serverUuid = $this->server->uuid;
+
+    $this->importer->import($bundle, teamId: $this->team->id, dryRun: true);
+    Queue::assertNotPushed(ValidateAndInstallServerJob::class);
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    expect($result['claimed'])->toBeTrue();
+    Queue::assertPushed(ValidateAndInstallServerJob::class, 1);
+    Queue::assertPushed(ValidateAndInstallServerJob::class, fn (ValidateAndInstallServerJob $job) => $job->server->uuid === $serverUuid);
+});
+
 test('import fails when server ip already exists', function () {
     $bundle = $this->exporter->export($this->server);
 
     $this->importer->import($bundle, teamId: $this->team->id);
 })->throws(ValidationException::class);
 
+test('the Cloudflare tunnel token moves with the server by uuid and the raw token id of an old bundle is ignored', function () {
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare', 'token' => 'cf-tunnel-token', 'capabilities' => ['dns', 'tunnel']]);
+    $this->server->settings->forceFill(['cloudflare_tunnel_integration_token_id' => $token->id])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+    expect(data_get($bundle, 'server.settings'))->not->toHaveKey('cloudflare_tunnel_integration_token_id')
+        ->and(data_get($bundle, 'server.settings.cloudflare_tunnel_integration_token_uuid'))->toBe($token->uuid)
+        ->and(data_get($bundle, 'integration_tokens.0.token'))->toBe('cf-tunnel-token')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('Cloudflare API token');
+
+    $bundle['server']['settings']['cloudflare_tunnel_integration_token_id'] = 999999;
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $token->delete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $imported = IntegrationToken::where('uuid', $token->uuid)->firstOrFail();
+    expect(Server::where('uuid', $result['server_uuid'])->first()->settings->cloudflare_tunnel_integration_token_id)->toBe($imported->id)
+        ->and($imported->team_id)->toBe($this->team->id)
+        ->and($imported->token)->toBe('cf-tunnel-token');
+});
+
+test('a transfer back replaces the archive of the same team in the import transaction', function () {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['server']['name'] = 'changed-on-the-other-instance';
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+    $archiveId = $this->server->id;
+
+    expect(collect($this->importer->importChecks($this->server->uuid, $this->server->ip, $this->team->id))->every(fn ($check) => $check['ok']))->toBeTrue();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $this->server->uuid)->firstOrFail();
+    expect($result['claimed'])->toBeTrue()
+        ->and($server->id)->not->toBe($archiveId)
+        ->and($server->name)->toBe('changed-on-the-other-instance')
+        ->and($server->isTransferredAway())->toBeFalse()
+        ->and(Server::withTrashed()->find($archiveId))->toBeNull()
+        ->and(Application::where('uuid', $this->application->uuid)->firstOrFail()->destination->server_id)->toBe($server->id);
+    Process::assertDidntRun(fn ($process) => str_contains($process->command, 'docker rm') || str_contains($process->command, 'docker stop'));
+});
+
+test('a failed transfer back keeps the archive', function () {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['projects'][0]['environments'][0]['databases'][] = [
+        'type' => 'NotARealDatabaseType', 'uuid' => 'broken-db-uuid', 'attributes' => ['name' => 'broken'], 'destination_uuid' => $this->destination->uuid,
+    ];
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id))->toThrow(RuntimeException::class, 'Unsupported database type');
+
+    expect($this->server->fresh()?->isTransferredAway())->toBeTrue()
+        ->and(Application::where('uuid', $this->application->uuid)->exists())->toBeTrue();
+});
+
+test('the archive of another team is not replaced', function () {
+    $bundle = $this->exporter->export($this->server);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://coolify-b.test');
+    $otherTeam = Team::factory()->create();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $otherTeam->id))
+        ->toThrow(ValidationException::class, 'Another team of this instance has the archived copy');
+});
+
 test('import rolls back all created rows when a later resource fails', function () {
     $bundle = $this->exporter->export($this->server);
     $originalServerUuid = $this->server->uuid;
@@ -370,6 +472,7 @@ test('import reuses existing private key fingerprint on same team', function ()
     $originalKeyId = $this->privateKey->id;
 
     // Free the IP without deleting the key.
+    $this->service->forceDelete();
     $this->application->forceDelete();
     $this->database->forceDelete();
     $this->server->forceDelete();
@@ -386,6 +489,7 @@ test('import into another team creates its own key when the same key exists in a
     $targetTeam = Team::factory()->create();
 
     // Free the IP without deleting the source team's key.
+    $this->service->forceDelete();
     $this->application->forceDelete();
     $this->database->forceDelete();
     $this->server->forceDelete();
@@ -400,21 +504,6 @@ test('import into another team creates its own key when the same key exists in a
         ->and(PrivateKey::whereKey($sourceKeyId)->where('team_id', $this->team->id)->exists())->toBeTrue();
 });
 
-test('encrypted export decrypts for import', function () {
-    $bundle = $this->exporter->export($this->server);
-    $encrypted = ServerTransferBundle::encryptWithPassphrase($bundle, 'transfer-pass');
-
-    $this->application->forceDelete();
-    $this->database->forceDelete();
-    $this->server->forceDelete();
-    $this->privateKey->delete();
-
-    $plain = ServerTransferBundle::decryptWithPassphrase($encrypted, 'transfer-pass');
-    $result = $this->importer->import($plain, teamId: $this->team->id);
-
-    expect(Server::where('uuid', $result['server_uuid'])->exists())->toBeTrue();
-});
-
 test('system-wide github apps are not exported and re-link on import by uuid', function () {
     $systemWide = new GithubApp;
     $systemWide->forceFill([
@@ -990,7 +1079,7 @@ test('transfer keeps the link between an application volume and its sqlite datab
     ScheduledTask::query()->delete();
     $this->privateKey->delete();
 
-    $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: false, adoptMode: true);
+    $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: false, adoptMode: false);
 
     $importedSqlite = StandaloneSqlite::where('name', 'app-sqlite')->sole();
     $connectedVolume = Application::where('name', $originalAppName)->sole()
@@ -1002,23 +1091,22 @@ test('transfer keeps the link between an application volume and its sqlite datab
         ->and($importedSqlite->persistentStorages()->sole()->isSharedWithAnotherResource())->toBeTrue();
 });
 
-test('export warns about secret manager links without exporting the integration token', function () {
+test('secret manager links of applications and databases move with their integration token', function () {
     $token = IntegrationToken::factory()->create([
         'team_id' => $this->team->id,
         'provider' => 'vault',
         'token' => 'vault-root-token',
         'capabilities' => ['secrets'],
     ]);
-    $this->application->secretManagerLink()->create(['integration_token_id' => $token->id]);
-    $this->database->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    $this->application->secretManagerLink()->create(['integration_token_id' => $token->id, 'settings' => ['mount' => 'secret', 'path' => 'app']]);
+    $this->database->secretManagerLink()->create(['integration_token_id' => $token->id, 'settings' => ['mount' => 'kv', 'path' => 'db']]);
 
     $bundle = $this->exporter->export($this->server);
-    $warning = collect($bundle['warnings'])->first(fn (string $warning) => str_contains($warning, 'secret manager'));
 
-    expect($warning)->not->toBeNull()
-        ->and($warning)->toContain('my-app')
-        ->and($warning)->toContain('app-db')
-        ->and(json_encode($bundle))->not->toContain('vault-root-token');
+    expect(collect($bundle['warnings'])->filter(fn (string $warning) => str_contains($warning, 'secret manager')))->toBeEmpty()
+        ->and($bundle['integration_tokens'])->toHaveCount(1)
+        ->and($bundle['integration_tokens'][0]['token'])->toBe('vault-root-token')
+        ->and(data_get($bundle, 'projects.0.environments.0.databases.0.secret_manager_link.integration_token_uuid'))->toBe($token->uuid);
 
     $this->service->forceDelete();
     $this->application->forceDelete();
@@ -1028,10 +1116,18 @@ test('export warns about secret manager links without exporting the integration
     ScheduledDatabaseBackup::query()->delete();
     ScheduledTask::query()->delete();
     $this->privateKey->delete();
+    $token->delete();
 
-    $result = $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: true, adoptMode: true);
+    $this->importer->import($bundle, teamId: $this->team->id, dryRun: false, preserveUuids: true, adoptMode: true);
 
-    expect($result['warnings'])->toContain($warning);
+    $imported = IntegrationToken::where('uuid', $token->uuid)->where('team_id', $this->team->id)->firstOrFail();
+    $application = Application::where('uuid', $this->application->uuid)->firstOrFail();
+    $database = StandalonePostgresql::where('uuid', $this->database->uuid)->firstOrFail();
+    expect($imported->token)->toBe('vault-root-token')
+        ->and($application->secretManagerLink->integration_token_id)->toBe($imported->id)
+        ->and($application->secretManagerLink->settings)->toBe(['mount' => 'secret', 'path' => 'app'])
+        ->and($database->secretManagerLink->integration_token_id)->toBe($imported->id)
+        ->and($database->secretManagerLink->settings)->toBe(['mount' => 'kv', 'path' => 'db']);
 });
 
 test('transfer keeps the Traefik certificate resolver of applications and service applications', function () {
@@ -1071,3 +1167,655 @@ test('transfer keeps the Traefik certificate resolver of applications and servic
     expect(Application::where('uuid', $originalAppUuid)->firstOrFail()->settings->traefik_certificate_resolver)->toBe('none')
         ->and(ServiceApplication::where('uuid', 'svc-app-resolver')->firstOrFail()->traefik_certificate_resolver)->toBe('cloudflare');
 });
+
+test('transfer keeps the cloud provider instance id of the server', function () {
+    $this->server->forceFill(['hetzner_server_id' => 4242, 'vultr_instance_id' => 'vultr-7'])->save();
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->sole();
+    expect((int) $server->hetzner_server_id)->toBe(4242)
+        ->and($server->vultr_instance_id)->toBe('vultr-7');
+});
+
+test('adopt mode stops the import when a resource uuid is already used', function () {
+    $bundle = $this->exporter->export($this->server);
+    $appUuid = $this->application->uuid;
+
+    // The server is gone, but the application row still holds its UUID on this instance.
+    $this->service->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id, adoptMode: true))
+        ->toThrow(ValidationException::class, "The application UUID {$appUuid} is already used");
+
+    expect(Server::where('uuid', $bundle['server']['uuid'])->exists())->toBeFalse();
+});
+
+test('import rejects a database model class that is not a supported database type', function () {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['projects'][0]['environments'][0]['databases'][] = [
+        'type' => 'Unknown',
+        'model' => Application::class,
+        'uuid' => 'not-a-database',
+        'attributes' => ['name' => 'not-a-database'],
+        'destination_uuid' => $this->destination->uuid,
+    ];
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id))
+        ->toThrow(RuntimeException::class, 'Unsupported database type');
+
+    expect(Application::where('uuid', 'not-a-database')->exists())->toBeFalse();
+});
+
+test('import rejects unsafe server connection fields', function (string $field, mixed $value) {
+    $bundle = $this->exporter->export($this->server);
+    $bundle['server'][$field] = $value;
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    expect(fn () => $this->importer->import($bundle, teamId: $this->team->id))
+        ->toThrow(ValidationException::class);
+})->with([
+    'ip with shell characters' => ['ip', '10.0.0.1;reboot'],
+    'user with shell characters' => ['user', 'root$(id)'],
+    'port out of range' => ['port', 70000],
+]);
+
+test('export refuses credentials of another team', function () {
+    $otherKey = PrivateKey::factory()->create(['team_id' => Team::factory()->create()->id]);
+    $this->application->forceFill(['private_key_id' => $otherKey->id])->save();
+
+    expect(fn () => $this->exporter->export($this->server))
+        ->toThrow(RuntimeException::class, 'does not belong to the server team');
+});
+
+test('transfer keeps maintenance mode, the server error page and swarm cluster, environment variable flags, and the Coolify default variables switch', function () {
+    $this->application->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>App down</h1>'])->saveQuietly();
+    $this->service->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>Service down</h1>', 'include_coolify_default_variables' => false])->saveQuietly();
+    $this->application->settings->forceFill(['include_coolify_default_variables' => false])->saveQuietly();
+    $this->database->forceFill(['include_coolify_default_variables' => false])->saveQuietly();
+    $this->server->forceFill(['proxy_error_page' => '<h1>Proxy error</h1>', 'swarm_cluster' => 7])->saveQuietly();
+    EnvironmentVariable::withoutEvents(function () {
+        $env = new EnvironmentVariable;
+        $env->forceFill([
+            'key' => 'COMPOSE_NULL',
+            'value' => null,
+            'preserve_compose_null' => true,
+            'version' => '4.0.0-beta.400',
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $this->application->id,
+        ]);
+        $env->uuid = new_public_id();
+        $env->save();
+    });
+    $appUuid = $this->application->uuid;
+    $serviceUuid = $this->service->uuid;
+    $databaseClass = $this->database::class;
+    $databaseUuid = $this->database->uuid;
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->sole();
+    $application = Application::where('uuid', $appUuid)->sole();
+    $service = Service::where('uuid', $serviceUuid)->sole();
+    $variable = $application->environment_variables()->where('key', 'COMPOSE_NULL')->sole();
+    expect($application->is_maintenance_enabled)->toBeTrue()
+        ->and($application->maintenance_page)->toBe('<h1>App down</h1>')
+        ->and($service->is_maintenance_enabled)->toBeTrue()
+        ->and($service->maintenance_page)->toBe('<h1>Service down</h1>')
+        ->and($server->proxy_error_page)->toBe('<h1>Proxy error</h1>')
+        ->and((int) $server->swarm_cluster)->toBe(7)
+        ->and($variable->preserve_compose_null)->toBeTrue()
+        ->and($variable->value)->toBeNull()
+        ->and($variable->version)->toBe('4.0.0-beta.400')
+        ->and($application->settings->include_coolify_default_variables)->toBeFalse()
+        ->and($service->include_coolify_default_variables)->toBeFalse()
+        ->and($databaseClass::where('uuid', $databaseUuid)->sole()->include_coolify_default_variables)->toBeFalse();
+});
+
+test('transfer keeps preview, backup, GitHub App runner fields and canvas positions when uuids change', function () {
+    $githubApp = new GithubApp;
+    $githubApp->forceFill([
+        'name' => 'Runner App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'team_id' => $this->team->id,
+        'organization' => 'acme',
+        'organization_self_hosted_runners' => 'write',
+        'actions' => 'read',
+        'webhook_events' => ['workflow_job', 'push'],
+        'runner_group_id' => 12,
+    ]);
+    $githubApp->uuid = 'runner-github-app';
+    $githubApp->save();
+    $this->application->forceFill(['source_type' => GithubApp::class, 'source_id' => $githubApp->id])->saveQuietly();
+
+    $preview = new ApplicationPreview;
+    $preview->forceFill([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 7,
+        'pull_request_html_url' => 'https://github.com/example/app/pull/7',
+        'fqdn' => 'https://pr-7.app.example.com',
+        'domain_port_overrides' => ['https://pr-7.app.example.com' => 8080],
+        'max_restart_count' => 5,
+    ]);
+    $preview->uuid = 'preview-pr-7';
+    $preview->saveQuietly();
+
+    $this->backup->update(['missing_backup_notification_days' => 3]);
+    ScheduledVolumeBackup::create([
+        'backupable_type' => LocalPersistentVolume::class,
+        'backupable_id' => $this->application->persistentStorages()->sole()->id,
+        'team_id' => $this->team->id,
+        'frequency' => '0 4 * * *',
+        'missing_backup_notification_days' => 2,
+    ]);
+
+    $this->environment->forceFill(['canvas_positions' => [
+        $this->application->uuid => ['x' => 10, 'y' => -20],
+        $this->database->uuid => ['x' => 300, 'y' => 40],
+        'resource-on-another-server' => ['x' => 1, 'y' => 1],
+    ]])->save();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['environments'][0]['canvas_positions'])->toHaveCount(2);
+
+    ApplicationPreview::withoutEvents(fn () => ApplicationPreview::withTrashed()->get()->each->forceDelete());
+    DB::table('scheduled_volume_backups')->delete();
+    DB::table('scheduled_database_backups')->delete();
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    GithubApp::where('uuid', 'runner-github-app')->delete();
+
+    $this->importer->import($bundle, teamId: $this->team->id, preserveUuids: false, adoptMode: false);
+
+    $application = Application::where('name', 'my-app')->sole();
+    $database = StandalonePostgresql::where('name', 'app-db')->sole();
+    $importedPreview = $application->previews()->sole();
+    $importedGithubApp = $application->source;
+    expect($importedPreview->domain_port_overrides)->toBe(['https://pr-7.app.example.com' => 8080])
+        ->and($importedPreview->max_restart_count)->toBe(5)
+        ->and(ScheduledDatabaseBackup::where('database_id', $database->id)->sole()->missing_backup_notification_days)->toBe(3)
+        ->and(ScheduledVolumeBackup::sole()->missing_backup_notification_days)->toBe(2)
+        ->and($importedGithubApp)->toBeInstanceOf(GithubApp::class)
+        ->and($importedGithubApp->organization_self_hosted_runners)->toBe('write')
+        ->and($importedGithubApp->actions)->toBe('read')
+        ->and($importedGithubApp->webhook_events)->toBe(['workflow_job', 'push'])
+        ->and($importedGithubApp->runner_group_id)->toBe(12)
+        ->and($application->uuid)->not->toBe($this->application->uuid)
+        ->and($application->environment->canvas_positions)->toBe([
+            $application->uuid => ['x' => 10, 'y' => -20],
+            $database->uuid => ['x' => 300, 'y' => 40],
+        ]);
+});
+
+test('transfer creates the referenced team shared variables in the target team', function () {
+    $this->application->environment_variables()->where('key', 'APP_SECRET')->sole()->update(['value' => 'Bearer {{team.API_TOKEN}}']);
+    EnvironmentVariable::withoutEvents(function () {
+        $env = new EnvironmentVariable;
+        $env->forceFill([
+            'key' => 'SERVICE_URL',
+            'value' => '{{ team.SERVICE_HOST }}/api',
+            'resourceable_type' => Service::class,
+            'resourceable_id' => $this->service->id,
+        ]);
+        $env->uuid = new_public_id();
+        $env->save();
+    });
+    foreach (['API_TOKEN' => 'team-secret', 'SERVICE_HOST' => 'https://svc.example.com', 'UNUSED' => 'not-referenced'] as $key => $value) {
+        SharedEnvironmentVariable::create(['key' => $key, 'value' => $value, 'type' => 'team', 'team_id' => $this->team->id, 'is_literal' => true]);
+    }
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect(collect($bundle['shared_environment_variables']['team'])->pluck('key')->sort()->values()->all())->toBe(['API_TOKEN', 'SERVICE_HOST']);
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $teamVariables = SharedEnvironmentVariable::where('type', 'team')->where('team_id', $targetTeam->id)->get()->keyBy('key');
+    expect($teamVariables->keys()->sort()->values()->all())->toBe(['API_TOKEN', 'SERVICE_HOST'])
+        ->and($teamVariables['API_TOKEN']->value)->toBe('team-secret')
+        ->and((bool) $teamVariables['API_TOKEN']->is_literal)->toBeTrue()
+        ->and($teamVariables['SERVICE_HOST']->value)->toBe('https://svc.example.com');
+});
+
+test('transfer keeps the value of a team shared variable that already exists in the target team and warns', function () {
+    $this->application->environment_variables()->where('key', 'APP_SECRET')->sole()->update(['value' => '{{team.API_TOKEN}}']);
+    $variable = SharedEnvironmentVariable::create(['key' => 'API_TOKEN', 'value' => 'source-value', 'type' => 'team', 'team_id' => $this->team->id]);
+
+    $bundle = $this->exporter->export($this->server);
+    $variable->update(['value' => 'target-value']);
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    expect(SharedEnvironmentVariable::where('type', 'team')->where('team_id', $this->team->id)->sole()->value)->toBe('target-value')
+        ->and(collect($result['warnings'])->filter(fn (string $warning) => str_contains($warning, 'API_TOKEN')))->toHaveCount(1);
+});
+
+test('import warns when the git source, private key or S3 storage of a resource cannot be found', function () {
+    $githubApp = new GithubApp;
+    $githubApp->forceFill([
+        'name' => 'Team GitHub App',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'team_id' => $this->team->id,
+    ]);
+    $githubApp->uuid = 'missing-github-app';
+    $githubApp->save();
+    $deployKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'deploy-key',
+        'private_key' => PrivateKey::generateNewKeyPair('ed25519')['private_key'],
+    ]);
+    $this->application->forceFill([
+        'source_type' => GithubApp::class,
+        'source_id' => $githubApp->id,
+        'private_key_id' => $deployKey->id,
+    ])->saveQuietly();
+    $storage = S3Storage::create([
+        'name' => 'Backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://93.184.216.34',
+        'team_id' => $this->team->id,
+    ]);
+    $this->backup->update(['s3_storage_id' => $storage->id, 'save_s3' => true]);
+
+    $bundle = $this->exporter->export($this->server);
+    // The target instance cannot resolve these references.
+    $bundle['github_apps'] = [];
+    $bundle['s3_storages'] = [];
+    $bundle['private_keys'] = collect($bundle['private_keys'])->reject(fn (array $key) => $key['uuid'] === $deployKey->uuid)->values()->all();
+
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: Team::factory()->create()->id);
+
+    expect($result['warnings'])->toContain('Application my-app: its GitHub App was not found on this instance; set the source again.')
+        ->and($result['warnings'])->toContain('Application my-app: its private key was not found on this instance; select the private key again.')
+        ->and($result['warnings'])->toContain('Backup of database app-db: S3 upload was turned off because its S3 storage was not found.');
+});
+
+test('export warns about DNS records of another team', function () {
+    $bundle = $this->exporter->export($this->server);
+    expect(implode(' ', $bundle['warnings']))->not->toContain('DNS record');
+
+    ManagedDnsRecord::factory()->create()->references()->create([
+        'resource_type' => $this->application->getMorphClass(),
+        'resource_id' => $this->application->id,
+    ]);
+
+    $bundle = $this->exporter->export($this->server->fresh());
+
+    expect(implode(' ', $bundle['warnings']))->toContain('because its DNS provider token belongs to another team. The target instance does not manage it.');
+});
+
+/**
+ * Removes the source copies of the resources of beforeEach, so the target can import them with their uuids.
+ */
+function removeTransferSourceResources(object $test): void
+{
+    $test->service->forceDelete();
+    $test->application->forceDelete();
+    $test->database->forceDelete();
+    $test->server->forceDelete();
+}
+
+function transferTestGithubApp(Team $team, string $uuid, string $name): GithubApp
+{
+    $githubApp = new GithubApp;
+    $githubApp->forceFill([
+        'name' => $name,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'organization' => 'acme',
+        'app_id' => 4242,
+        'installation_id' => 4343,
+        'team_id' => $team->id,
+        'is_system_wide' => false,
+        'private_key_id' => PrivateKey::factory()->create([
+            'team_id' => $team->id,
+            'name' => "{$name} key",
+            'private_key' => PrivateKey::generateNewKeyPair('ed25519')['private_key'],
+        ])->id,
+    ]);
+    $githubApp->uuid = $uuid;
+    $githubApp->save();
+
+    return $githubApp;
+}
+
+test('canvas links between transferred resources move with their environment and the other links are left out', function () {
+    $user = User::factory()->create();
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id, 'ip' => '10.55.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    $appOnOtherServer = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(),
+        'name' => 'stays-here',
+    ]);
+    $link = fn (Model $source, Model $target, ?string $label) => ResourceLink::create([
+        'environment_id' => $this->environment->id,
+        'source_type' => $source->getMorphClass(),
+        'source_id' => $source->id,
+        'target_type' => $target->getMorphClass(),
+        'target_id' => $target->id,
+        'label' => $label,
+        'created_by' => $user->id,
+    ]);
+    $appToDatabase = $link($this->application, $this->database, 'reads');
+    $link($this->service, $this->application, null);
+    $link($this->application, $appOnOtherServer, 'calls');
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['environments'][0]['resource_links'])->toHaveCount(2)
+        ->and($bundle['warnings'])->toContain('1 link between resources on the environment canvas is not transferred, because one of the linked resources stays on this instance.');
+
+    removeTransferSourceResources($this);
+    ResourceLink::query()->delete();
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $environment = Project::where('team_id', $targetTeam->id)->sole()->environments()->sole();
+    $application = Application::where('uuid', $this->application->uuid)->sole();
+    $database = StandalonePostgresql::where('uuid', $this->database->uuid)->sole();
+    $service = Service::where('uuid', $this->service->uuid)->sole();
+    $links = ResourceLink::where('environment_id', $environment->id)->orderBy('id')->get();
+
+    expect($links)->toHaveCount(2)
+        ->and($links[0]->only(['uuid', 'source_type', 'source_id', 'target_type', 'target_id', 'label', 'created_by']))->toBe([
+            'uuid' => $appToDatabase->uuid,
+            'source_type' => $application->getMorphClass(),
+            'source_id' => $application->id,
+            'target_type' => $database->getMorphClass(),
+            'target_id' => $database->id,
+            'label' => 'reads',
+            'created_by' => null,
+        ])
+        ->and($links[1]->only(['source_type', 'source_id', 'target_type', 'target_id', 'label']))->toBe([
+            'source_type' => $service->getMorphClass(),
+            'source_id' => $service->id,
+            'target_type' => $application->getMorphClass(),
+            'target_id' => $application->id,
+            'label' => null,
+        ]);
+});
+
+test('the project icon moves with the project into the icon storage of the target', function () {
+    Storage::fake('images');
+    $icon = "\xFF\xD8\xFF\xE0\x00\x10JFIF\x00transfer-icon";
+    Storage::disk('images')->put("project-icons/{$this->project->uuid}/icon.jpg", $icon);
+    $this->project->forceFill(['icon_path' => "project-icons/{$this->project->uuid}/icon.jpg", 'icon_storage_type' => 'local'])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['icon'])->toBe(['content_base64' => base64_encode($icon), 'extension' => 'jpg', 'mime' => 'image/jpeg']);
+
+    removeTransferSourceResources($this);
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $project = Project::where('team_id', $targetTeam->id)->sole();
+    expect($project->uuid)->not->toBe($this->project->uuid)
+        ->and($project->only(['icon_path', 'icon_storage_type', 'icon_s3_storage_id']))->toBe([
+            'icon_path' => "project-icons/{$project->uuid}/icon.jpg",
+            'icon_storage_type' => 'local',
+            'icon_s3_storage_id' => null,
+        ])
+        ->and(Storage::disk('images')->get($project->icon_path))->toBe($icon);
+});
+
+test('a project icon that cannot be read or is too large is not exported and the export warns', function (?string $stored, string $warning) {
+    Storage::fake('images');
+    if ($stored !== null) {
+        Storage::disk('images')->put('project-icons/transfer/icon.jpg', $stored);
+    }
+    $this->project->forceFill(['icon_path' => 'project-icons/transfer/icon.jpg', 'icon_storage_type' => 'local'])->saveQuietly();
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect($bundle['projects'][0]['icon'])->toBeNull()
+        ->and($bundle['warnings'])->toContain($warning);
+})->with([
+    'missing file' => [null, 'The icon of project Transfer Project cannot be read, so it is not transferred. Upload it again on the target instance.'],
+    'larger than 2 MB' => [str_repeat('x', ServerTransferExporter::MAX_PROJECT_ICON_BYTES + 1), 'The icon of project Transfer Project is larger than 2 MB, so it is not transferred. Upload it again on the target instance.'],
+]);
+
+test('import stores only a JPEG project icon and warns about other content', function () {
+    Storage::fake('images');
+    $bundle = $this->exporter->export($this->server);
+    $bundle['projects'][0]['icon'] = ['content_base64' => base64_encode('<svg onload="alert(1)"/>'), 'extension' => 'jpg', 'mime' => 'image/jpeg'];
+    removeTransferSourceResources($this);
+    $targetTeam = Team::factory()->create();
+
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    expect(Project::where('team_id', $targetTeam->id)->sole()->icon_path)->toBeNull()
+        ->and(Storage::disk('images')->allFiles())->toBe([])
+        ->and($result['warnings'])->toContain('The icon of project Transfer Project was not imported, because it is not a JPEG image. Upload it again in the project settings.');
+});
+
+test('only environments with a resource of the server are exported', function () {
+    SharedEnvironmentVariable::create(['key' => 'PROJECT_KEY', 'value' => 'project', 'type' => 'project', 'project_id' => $this->project->id, 'team_id' => $this->team->id]);
+    SharedEnvironmentVariable::create(['key' => 'PRODUCTION_KEY', 'value' => 'production', 'type' => 'environment', 'environment_id' => $this->environment->id, 'team_id' => $this->team->id]);
+    $staging = Environment::factory()->create(['project_id' => $this->project->id, 'name' => 'staging']);
+    SharedEnvironmentVariable::create(['key' => 'STAGING_KEY', 'value' => 'staging', 'type' => 'environment', 'environment_id' => $staging->id, 'team_id' => $this->team->id]);
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id, 'ip' => '10.55.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    Application::factory()->create([
+        'environment_id' => $staging->id,
+        'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(),
+        'name' => 'staging-app',
+    ]);
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect(collect($bundle['projects'][0]['environments'])->pluck('name')->all())->toBe([$this->environment->name])
+        ->and(collect($bundle['projects'][0]['shared_environment_variables'])->pluck('key')->all())->toBe(['PROJECT_KEY'])
+        ->and(collect($bundle['projects'][0]['environments'][0]['shared_environment_variables'])->pluck('key')->all())->toBe(['PRODUCTION_KEY']);
+
+    removeTransferSourceResources($this);
+    $targetTeam = Team::factory()->create();
+
+    $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $project = Project::where('team_id', $targetTeam->id)->sole();
+    expect($project->environments()->pluck('name')->all())->toBe([$this->environment->name])
+        ->and(Application::where('name', 'staging-app')->count())->toBe(1)
+        ->and(SharedEnvironmentVariable::where('key', 'STAGING_KEY')->count())->toBe(1);
+});
+
+test('the GitHub runner config moves disabled with its GitHub App and the bundle lists the manual steps', function () {
+    $githubApp = transferTestGithubApp($this->team, 'runner-only-app', 'Runner App');
+    $gitlabApp = new GitlabApp;
+    $gitlabApp->forceFill(['name' => 'Team GitLab', 'api_url' => 'https://gitlab.com/api/v4', 'html_url' => 'https://gitlab.com', 'team_id' => $this->team->id, 'is_system_wide' => false]);
+    $gitlabApp->save();
+    $this->application->forceFill(['source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id])->saveQuietly();
+    $config = GithubRunnerConfig::create([
+        'server_id' => $this->server->id,
+        'github_app_id' => $githubApp->id,
+        'labels' => ['coolify', 'gpu'],
+        'is_enabled' => true,
+        'is_dedicated' => true,
+        'allow_pull_requests' => true,
+        'max_runners' => 4,
+        'docker_mode' => 'dind',
+        'runner_image' => 'ghcr.io/acme/runner:1',
+        'cpu_limit' => '1.5',
+        'memory_limit' => '2g',
+        'capacity_wait_timeout' => 30,
+        'idle_timeout' => 5,
+        'job_timeout' => 120,
+    ]);
+
+    $bundle = $this->exporter->export($this->server);
+
+    expect(collect($bundle['github_apps'])->pluck('uuid')->all())->toBe(['runner-only-app'])
+        ->and(collect($bundle['private_keys'])->pluck('uuid'))->toContain($githubApp->privateKey->uuid)
+        ->and($bundle['github_runner_config']['github_app_uuid'])->toBe('runner-only-app')
+        ->and($bundle['post_transfer_checklist'])->toBe([
+            'On GitHub, open the settings of GitHub App Runner App. Set the Webhook URL to {target_url}/webhooks/source/github/events, the Setup URL to {target_url}/webhooks/source/github/install, and the Callback URL to {target_url}/login/github/app.',
+            'In GitLab, open Settings > Webhooks of every project that uses GitLab App Team GitLab, and set the webhook URL to {target_url}/webhooks/source/gitlab/events.',
+            'After the GitHub App sends webhooks to {target_url}, open this server there, check the runner requirements, and enable GitHub runners. Enabling them stops runners that another Coolify instance started on this server.',
+        ])
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('webhook URL')
+        ->and(implode(' ', $bundle['warnings']))->not->toContain('runner');
+
+    removeTransferSourceResources($this);
+    $githubApp->delete();
+    $gitlabApp->delete();
+    $targetTeam = Team::factory()->create();
+
+    $result = $this->importer->import($bundle, teamId: $targetTeam->id);
+
+    $importedApp = GithubApp::where('uuid', 'runner-only-app')->where('team_id', $targetTeam->id)->sole();
+    $imported = GithubRunnerConfig::where('server_id', Server::where('uuid', $result['server_uuid'])->sole()->id)->sole();
+    expect($imported->uuid)->toBe($config->uuid)
+        ->and($imported->github_app_id)->toBe($importedApp->id)
+        ->and($imported->is_enabled)->toBeFalse()
+        ->and($imported->only(['labels', 'is_dedicated', 'allow_pull_requests', 'max_runners', 'runner_image', 'cpu_limit', 'memory_limit', 'capacity_wait_timeout', 'idle_timeout', 'job_timeout']))->toBe([
+            'labels' => ['coolify', 'gpu'],
+            'is_dedicated' => true,
+            'allow_pull_requests' => true,
+            'max_runners' => 4,
+            'runner_image' => 'ghcr.io/acme/runner:1',
+            'cpu_limit' => '1.5',
+            'memory_limit' => '2g',
+            'capacity_wait_timeout' => 30,
+            'idle_timeout' => 5,
+            'job_timeout' => 120,
+        ])
+        ->and($imported->docker_mode->value)->toBe('dind')
+        ->and($result['checklist'])->toContain('On GitHub, open the settings of GitHub App Runner App. Set the Webhook URL to https://coolify-a.test/webhooks/source/github/events, the Setup URL to https://coolify-a.test/webhooks/source/github/install, and the Callback URL to https://coolify-a.test/login/github/app.')
+        ->and(implode(' ', $result['warnings']))->not->toContain('webhook URL');
+});
+
+test('the GitHub runner config re-links a system-wide GitHub App of the target by uuid', function () {
+    $systemWide = transferTestGithubApp($this->team, 'system-runner-app', 'System Runner App');
+    $systemWide->forceFill(['is_system_wide' => true])->save();
+    GithubRunnerConfig::create(['server_id' => $this->server->id, 'github_app_id' => $systemWide->id, 'labels' => ['coolify']]);
+
+    $bundle = $this->exporter->export($this->server);
+    expect($bundle['github_apps'])->toBe([]);
+    removeTransferSourceResources($this);
+
+    $result = $this->importer->import($bundle, teamId: Team::factory()->create()->id);
+
+    expect(GithubRunnerConfig::where('server_id', Server::where('uuid', $result['server_uuid'])->sole()->id)->sole()->github_app_id)->toBe($systemWide->id);
+});
+
+test('the GitHub runner config is not imported when its GitHub App is missing on the target', function () {
+    $githubApp = transferTestGithubApp($this->team, 'missing-runner-app', 'Runner App');
+    GithubRunnerConfig::create(['server_id' => $this->server->id, 'github_app_id' => $githubApp->id, 'labels' => ['coolify']]);
+
+    $bundle = $this->exporter->export($this->server);
+    $bundle['github_apps'] = [];
+    removeTransferSourceResources($this);
+    $githubApp->delete();
+
+    $result = $this->importer->import($bundle, teamId: Team::factory()->create()->id);
+
+    expect(GithubRunnerConfig::count())->toBe(0)
+        ->and($result['warnings'])->toContain('The GitHub runner settings of this server were not imported, because their GitHub App was not found on this instance. Set up GitHub runners on the server again.');
+});
+
+test('the checklist asks to move manual webhooks of git applications without a private App', function () {
+    $this->application->forceFill(['source_type' => null, 'source_id' => null])->saveQuietly();
+
+    $checklist = implode("\n", $this->exporter->export($this->server)['post_transfer_checklist']);
+
+    expect($checklist)->toContain('If a repository of these applications has a manual webhook to Coolify, change its URL to the target: my-app.')
+        ->toContain('{target_url}/webhooks/source/gitea/events/manual');
+});
+
+test('the checklist does not ask about manual webhooks for an application that deploys through a private GitHub App', function () {
+    $githubApp = GithubApp::create([
+        'name' => 'private-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com',
+        'team_id' => $this->team->id, 'is_system_wide' => false, 'is_public' => false,
+    ]);
+    $this->application->forceFill(['source_type' => GithubApp::class, 'source_id' => $githubApp->id])->saveQuietly();
+
+    $checklist = implode("\n", $this->exporter->export($this->server)['post_transfer_checklist']);
+
+    expect($checklist)->not->toContain('manual webhook');
+});
+
+test('a claimed import starts the finish list and returns the server URL', function () {
+    $bundle = $this->exporter->export($this->server);
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->firstOrFail();
+    expect($result['server_url'])->toBe('https://coolify-a.test/server/'.$server->uuid)
+        ->and(data_get($server->server_metadata, 'transfer.status'))->toBe('claimed')
+        ->and(collect(data_get($server->server_metadata, 'transfer.finish.items'))->pluck('key'))->toContain('server_connection:server');
+});
+
+test('an application with a system-wide GitHub App that the target lacks is listed for a git source check', function () {
+    $systemApp = GithubApp::create(['name' => 'Coolify GitHub', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true]);
+    $this->application->forceFill(['source_type' => GithubApp::class, 'source_id' => $systemApp->id])->saveQuietly();
+    $bundle = $this->exporter->export($this->server);
+    $this->service->forceDelete();
+    $this->application->forceDelete();
+    $this->database->forceDelete();
+    $this->server->forceDelete();
+    $systemApp->delete();
+
+    $result = $this->importer->import($bundle, teamId: $this->team->id);
+
+    $server = Server::where('uuid', $result['server_uuid'])->firstOrFail();
+    expect(data_get($bundle, 'projects.0.environments.0.applications.0.source.system_wide'))->toBeTrue()
+        ->and(data_get($server->server_metadata, 'transfer.git_source_applications'))->toBe([$this->application->uuid])
+        ->and(collect(data_get($server->server_metadata, 'transfer.finish.items'))->pluck('key'))->toContain("git_source:{$this->application->uuid}");
+});
diff --git a/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php b/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php
index 5599fc763b..1abdd22c38 100644
--- a/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferMigratorTest.php
@@ -1,23 +1,39 @@
 <?php
 
+use App\Jobs\MigrateServerToInstanceJob;
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
+use App\Models\User;
 use App\Services\ServerTransfer\ServerTransferClaimer;
+use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferMigrator;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Sleep;
 use Illuminate\Validation\ValidationException;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
+    Sleep::fake();
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
     $this->team = Team::factory()->create();
@@ -29,9 +45,10 @@ beforeEach(function () {
         'name' => 'migrate-me',
     ]);
     $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
-    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $project = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Shop']);
     $environment = $project->environments()->first()
         ?? Environment::factory()->create(['project_id' => $project->id]);
+    $this->environment = $environment;
     Application::factory()->create([
         'environment_id' => $environment->id,
         'destination_id' => $destination->id,
@@ -43,7 +60,7 @@ beforeEach(function () {
 
 test('migrate exports imports via http and completes locally', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'dry_run' => false,
             'server_uuid' => $this->server->uuid,
             'claimed' => true,
@@ -55,12 +72,12 @@ test('migrate exports imports via http and completes locally', function () {
 
     $result = app(ServerTransferMigrator::class)->migrate(
         server: $this->server,
-        targetUrl: 'http://8.8.8.8',
+        targetUrl: 'https://8.8.8.8',
         targetToken: 'target-token-xyz',
     );
 
     expect($result['server_uuid'])->toBe($this->server->uuid)
-        ->and($result['target_url'])->toBe('http://8.8.8.8')
+        ->and($result['target_url'])->toBe('https://8.8.8.8')
         ->and($result['import']['claimed'])->toBeTrue()
         ->and($result['message'])->toContain('migrated');
 
@@ -69,7 +86,7 @@ test('migrate exports imports via http and completes locally', function () {
         ->and((bool) $this->server->settings->force_disabled)->toBeTrue();
 
     Http::assertSent(function ($request) {
-        return $request->url() === 'http://8.8.8.8/api/v1/servers/import'
+        return $request->url() === 'https://8.8.8.8/api/v1/servers/import'
             && $request->hasHeader('Authorization', 'Bearer target-token-xyz')
             && ! array_key_exists('write_remote', $request->data())
             && data_get($request->data(), 'bundle.server.uuid') === $this->server->uuid;
@@ -82,7 +99,7 @@ test('migrate rejects a private target before sending the bundle', function () {
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://127.0.0.1:8001',
+        'https://127.0.0.1:8001',
         'token',
     ))->toThrow(ValidationException::class);
 
@@ -116,7 +133,7 @@ test('migrate still rejects other private targets in development', function () {
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://10.0.0.5:8001',
+        'https://10.0.0.5:8001',
         'token',
     ))->toThrow(ValidationException::class);
 
@@ -125,26 +142,26 @@ test('migrate still rejects other private targets in development', function () {
 
 test('migrate fails clearly when target is unreachable', function () {
     Http::fake([
-        'http://8.8.4.4/*' => Http::failedConnection(),
+        'https://8.8.4.4/*' => Http::failedConnection(),
     ]);
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.4.4',
+        'https://8.8.4.4',
         'token',
     ))->toThrow(RuntimeException::class, 'Could not reach target');
 });
 
 test('migrate fails when target returns error', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'message' => 'A server with IP/domain already exists',
         ], 422),
     ]);
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.8.8',
+        'https://8.8.8.8',
         'token',
     ))->toThrow(RuntimeException::class, 'Target import failed');
 
@@ -156,7 +173,7 @@ test('migrate fails when target returns error', function () {
 
 test('migrate surfaces recovery guidance when complete fails after successful remote import', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'dry_run' => false,
             'server_uuid' => $this->server->uuid,
             'claimed' => true,
@@ -172,14 +189,14 @@ test('migrate surfaces recovery guidance when complete fails after successful re
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.8.8',
+        'https://8.8.8.8',
         'token',
-    ))->toThrow(RuntimeException::class, 'Disable management of this server here');
+    ))->toThrow(RuntimeException::class, 'transfer/complete on this instance');
 });
 
 test('migrate keeps managing the server here when the target could not take management', function () {
     Http::fake([
-        'http://8.8.8.8/api/v1/servers/import' => Http::response([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
             'dry_run' => false,
             'server_uuid' => $this->server->uuid,
             'claimed' => false,
@@ -189,7 +206,7 @@ test('migrate keeps managing the server here when the target could not take mana
 
     expect(fn () => app(ServerTransferMigrator::class)->migrate(
         $this->server,
-        'http://8.8.8.8',
+        'https://8.8.8.8',
         'token',
     ))->toThrow(RuntimeException::class, 'could not take management');
 
@@ -197,3 +214,488 @@ test('migrate keeps managing the server here when the target could not take mana
     expect($this->server->isTransferredAway())->toBeFalse()
         ->and((bool) $this->server->settings->force_disabled)->toBeFalse();
 });
+
+test('migrate rejects a target without https outside development', function () {
+    Http::fake();
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate(
+        $this->server,
+        'http://8.8.8.8',
+        'token',
+    ))->toThrow(RuntimeException::class, 'must use https');
+
+    Http::assertNothingSent();
+});
+
+test('migrate tells the user to upgrade a target without server transfer', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response(['message' => 'Not found.'], 404),
+    ]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate(
+        $this->server,
+        'https://8.8.8.8',
+        'token',
+    ))->toThrow(RuntimeException::class, 'does not support server transfer');
+});
+
+test('migrate completes when the import request times out but the target claimed the server', function () {
+    $sentExportId = null;
+    Http::fake(function ($request) use (&$sentExportId) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            $sentExportId = data_get($request->data(), 'bundle.export_id');
+
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response([
+            'server_uuid' => $this->server->uuid,
+            'transfer' => ['status' => 'claimed', 'export_id' => $sentExportId],
+        ]);
+    });
+
+    $result = app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token');
+
+    expect($result['import']['claimed'])->toBeTrue()
+        ->and($this->server->fresh()->isTransferredAway())->toBeTrue();
+    Http::assertSent(fn ($request) => $request->url() === "https://8.8.8.8/api/v1/servers/{$this->server->uuid}/transfer");
+});
+
+test('migrate keeps the server here when the target never confirms a timed out import', function () {
+    Http::fake(function ($request) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response(['message' => 'Server not found.'], 404);
+    });
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'Target import failed (HTTP 504)');
+
+    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+});
+
+test('start records the running transfer and queues the job once', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+    $migrator = app(ServerTransferMigrator::class);
+
+    $migrator->start($this->server, 'https://8.8.8.8/', 'token');
+
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.status'))->toBe('running')
+        ->and(data_get($this->server->fresh()->server_metadata, 'migration.target_url'))->toBe('https://8.8.8.8');
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+
+    expect(fn () => $migrator->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'already running');
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+});
+
+test('the migrate job records a failed transfer', function () {
+    Http::fake(['*' => Http::response(['message' => 'Unauthenticated.'], 401)]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $migration = data_get($this->server->fresh()->server_metadata, 'migration');
+    expect($migration['status'])->toBe('failed')
+        ->and($migration['error'])->toContain('HTTP 401');
+});
+
+test('the migrate job records a finished transfer', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
+            'server_uuid' => $this->server->uuid,
+            'claimed' => true,
+            'warnings' => ['check webhooks'],
+        ], 201),
+    ]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('succeeded')
+        ->and(data_get($server->server_metadata, 'migration.warnings'))->toContain('check webhooks')
+        ->and($server->isTransferredAway())->toBeTrue();
+});
+
+test('start replaces a running state that a stopped worker left behind', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+    $this->server->forceFill(['server_metadata' => ['migration' => [
+        'status' => 'running',
+        'started_at' => now()->subHour()->toIso8601String(),
+    ]]])->save();
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+});
+
+test('start checks the target before it queues the transfer', function (int $status, string $message) {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'A server with IP/domain 10.0.0.1 already exists on this instance.'], $status)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'wrong-token'))
+        ->toThrow(RuntimeException::class, $message);
+
+    Queue::assertNothingPushed();
+    $migration = data_get($this->server->fresh()->server_metadata, 'migration');
+    expect($migration['status'])->toBe('failed')
+        ->and($migration['phase'])->toBe('checks')
+        ->and(collect($migration['log'])->last())->toMatchArray(['level' => 'error'])
+        ->and(collect($migration['log'])->where('level', 'error')->pluck('message')->implode("\n"))->toContain('FAILED: ')->toContain($message);
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'server_uuid='.$this->server->uuid)
+        && $request->hasHeader('Authorization', 'Bearer wrong-token'));
+})->with([
+    'invalid token' => [401, 'does not accept the API token'],
+    'token without write permission' => [403, 'write permission'],
+    'conflict on the target' => [422, 'already exists on this instance'],
+    'target without server transfer' => [404, 'does not support server transfer'],
+]);
+
+test('start fails at once when the target cannot be reached', function () {
+    Queue::fake();
+    Http::fake(fn () => throw new ConnectionException('Connection refused'));
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'This instance cannot reach the target instance');
+
+    Queue::assertNothingPushed();
+});
+
+test('migrate stops waiting for a timed out import when the target rejects the token', function () {
+    Http::fake(function ($request) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response(['message' => 'Unauthenticated.'], 401);
+    });
+
+    expect(fn () => app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, 'Target import failed (HTTP 504)');
+
+    Sleep::assertSleptTimes(1);
+    expect($this->server->fresh()->isTransferredAway())->toBeFalse();
+});
+
+test('start logs every check as OK and the queued transfer', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response([
+        'message' => 'ok',
+        'checks' => [
+            ['label' => 'no server with the same IP exists', 'ok' => true, 'message' => null],
+            ['label' => 'the target can reach the SSH port of the server (10.0.0.1:22)', 'ok' => true, 'message' => null],
+        ],
+    ])]);
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($log)->toContain('OK: the server is not the Coolify host.')
+        ->toContain('OK: this instance manages the server.')
+        ->toContain('OK: no deployment is queued or running on the server.')
+        ->toContain('OK: this instance can connect to the server over SSH.')
+        ->toContain('OK: the target instance at https://8.8.8.8 can be reached.')
+        ->toContain('OK: the target instance accepts the API token.')
+        ->toContain('OK: on the target: the target can reach the SSH port of the server (10.0.0.1:22).')
+        ->and($log->last())->toBe('All checks passed. The transfer is queued.');
+    Http::assertSent(fn ($request) => str_contains($request->url(), 'schema_version=') && str_contains($request->url(), 'port='));
+});
+
+test('start runs every check and logs which are OK and which failed', function () {
+    Queue::fake();
+    Process::fake(['*' => Process::result(errorOutput: 'Connection refused', exitCode: 255)]);
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response([
+        'message' => 'A server with IP/domain 10.0.0.1 already exists on this instance.',
+        'checks' => [
+            ['label' => 'the team can have one more server', 'ok' => true, 'message' => null],
+            ['label' => 'no server with the same IP exists', 'ok' => false, 'message' => 'A server with IP/domain 10.0.0.1 already exists on this instance.'],
+        ],
+    ], 422)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class, '2 of 10 checks failed');
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'));
+    expect($log->where('level', 'success')->pluck('message'))->toContain('OK: the target instance accepts the API token.')
+        ->toContain('OK: on the target: the team can have one more server.')
+        ->and($log->where('level', 'error')->pluck('message')->implode("\n"))
+        ->toContain('FAILED: this instance can connect to the server over SSH.')
+        ->toContain('FAILED: on the target: no server with the same IP exists. A server with IP/domain 10.0.0.1 already exists')
+        ->and($log->last()['message'])->toContain('2 check(s) failed');
+    Queue::assertNothingPushed();
+});
+
+test('start reports the target checks as not checked when the token is rejected', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'Unauthenticated.'], 401)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token'))
+        ->toThrow(RuntimeException::class);
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($log)->toContain('OK: the target instance supports server transfer.')
+        ->toContain('NOT CHECKED: the checks on the target instance. They did not run, because "the target instance accepts the API token" failed.');
+});
+
+test('the migrate job logs each step of a finished transfer', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response(['server_uuid' => $this->server->uuid, 'claimed' => true], 201),
+    ]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $log = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'));
+    expect($log->pluck('message')->first())->toBe('Exporting the server configuration and its resources.')
+        ->and($log->pluck('message')->implode("\n"))->toContain('Sending it to https://8.8.8.8')
+        ->toContain('manages it now')
+        ->and($log->last())->toMatchArray(['level' => 'success', 'message' => 'Transfer finished. The target instance manages the server now.']);
+});
+
+test('the migrate job logs each attempt to read the result of a timed out import', function () {
+    Http::fake(function ($request) {
+        if (str_ends_with($request->url(), '/api/v1/servers/import')) {
+            return Http::response('Gateway Timeout', 504);
+        }
+
+        return Http::response(['message' => 'Server not found.'], 404);
+    });
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $messages = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($messages->filter(fn ($message) => str_starts_with($message, 'Asking the target for the import result')))->toHaveCount(ServerTransferMigrator::STATUS_PROBE_ATTEMPTS)
+        ->and($messages->last())->toStartWith('Transfer failed: Target import failed (HTTP 504)');
+});
+
+test('the migrate job stores the post-transfer checklist with the target URL', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response(['server_uuid' => $this->server->uuid, 'claimed' => true], 201),
+    ]);
+    $exporter = app(ServerTransferExporter::class);
+    $fakeExporter = Mockery::mock(ServerTransferExporter::class);
+    $fakeExporter->shouldReceive('export')->once()->andReturnUsing(fn (Server $server, bool $includeSensitive = true) => [
+        ...$exporter->export($server, $includeSensitive),
+        'post_transfer_checklist' => [
+            'Set the webhook URL of GitHub App deploy-bot to {target_url}/webhooks/source/github/events.',
+            ['not a step'],
+            'Point the DNS record of shop.example.com to the server.',
+        ],
+    ]);
+    app()->instance(ServerTransferExporter::class, $fakeExporter);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    $migration = data_get($this->server->fresh()->server_metadata, 'migration');
+    expect($migration['status'])->toBe('succeeded')
+        ->and($migration['checklist'])->toBe([
+            'Set the webhook URL of GitHub App deploy-bot to https://8.8.8.8/webhooks/source/github/events.',
+            'Point the DNS record of shop.example.com to the server.',
+        ]);
+});
+
+test('the migrate job stores the checklist of the target, which has the public URL of the target', function () {
+    Http::fake([
+        'https://8.8.8.8/api/v1/servers/import' => Http::response([
+            'server_uuid' => $this->server->uuid,
+            'claimed' => true,
+            'checklist' => ['Set the webhook URL of GitHub App deploy-bot to https://coolify-b.example.com/webhooks/source/github/events.'],
+        ], 201),
+    ]);
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->handle(app(ServerTransferMigrator::class));
+
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.checklist'))
+        ->toBe(['Set the webhook URL of GitHub App deploy-bot to https://coolify-b.example.com/webhooks/source/github/events.']);
+});
+
+test('start notes projects that also have resources on other servers', function (int $checkStatus, bool $queued) {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []], $checkStatus)]);
+    $otherServer = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id, 'ip' => '10.88.0.11']);
+    $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->firstOrFail();
+    foreach (['web', 'worker'] as $name) {
+        Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $otherDestination->id,
+            'destination_type' => $otherDestination->getMorphClass(),
+            'name' => $name,
+        ]);
+    }
+    // A project with resources only on the other server is not affected by the transfer.
+    $otherProject = Project::factory()->create(['team_id' => $this->team->id, 'name' => 'Blog']);
+    Application::factory()->create([
+        'environment_id' => $otherProject->environments()->first()->id,
+        'destination_id' => $otherDestination->id,
+        'destination_type' => $otherDestination->getMorphClass(),
+    ]);
+
+    try {
+        app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+    } catch (RuntimeException) {
+    }
+
+    $notes = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))
+        ->filter(fn (array $entry) => str_starts_with($entry['message'], 'NOTE: '));
+    expect($notes->pluck('message')->all())->toBe([
+        "NOTE: project 'Shop' also has 2 resources on other servers. They stay on this instance; only the resources of this server are transferred.",
+    ])
+        ->and($notes->first()['level'])->toBe('info');
+    $queued ? Queue::assertPushed(MigrateServerToInstanceJob::class, 1) : Queue::assertNothingPushed();
+})->with([
+    'checks pass' => [200, true],
+    'a check fails' => [401, false],
+]);
+
+test('start adds no note when the projects have no resources on other servers', function () {
+    Queue::fake();
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => []])]);
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    $messages = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message');
+    expect($messages->filter(fn (string $message) => str_starts_with($message, 'NOTE: ')))->toBeEmpty();
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+});
+
+test('the migrate job timeout covers the import request and every status probe', function () {
+    $worstCase = ServerTransferMigrator::IMPORT_TIMEOUT_SECONDS
+        + ServerTransferMigrator::STATUS_PROBE_ATTEMPTS
+        * (ServerTransferMigrator::STATUS_PROBE_INTERVAL_SECONDS + ServerTransferMigrator::STATUS_REQUEST_TIMEOUT_SECONDS);
+    $job = new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token');
+
+    // The rest of the timeout is for the export and the database writes.
+    expect($job->timeout)->toBeGreaterThanOrEqual($worstCase + 300)
+        ->and(ServerTransferMigrator::STALE_MIGRATION_SECONDS)->toBeGreaterThan($job->timeout);
+});
+
+function stopMigrateJobAfterExport(Server $server): void
+{
+    $metadata = $server->fresh()->server_metadata ?? [];
+    $metadata['migration'] = ['status' => 'running', 'target_url' => 'https://8.8.8.8', 'export_id' => 'export-1', 'log' => []];
+    $server->forceFill(['server_metadata' => $metadata])->save();
+
+    (new MigrateServerToInstanceJob($server, 'https://8.8.8.8', 'token'))
+        ->failed(new RuntimeException('The job has timed out.'));
+}
+
+test('a stopped migrate job completes the transfer when the target manages the server', function () {
+    Http::fake(['*' => Http::response(['transfer' => ['status' => 'claimed', 'export_id' => 'export-1']])]);
+
+    stopMigrateJobAfterExport($this->server);
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('succeeded')
+        ->and($server->isTransferredAway())->toBeTrue();
+});
+
+test('a stopped migrate job records an unknown result when the target cannot be asked', function () {
+    Http::fake(fn () => throw new ConnectionException('Connection timed out'));
+
+    stopMigrateJobAfterExport($this->server);
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('unknown')
+        ->and(data_get($server->server_metadata, 'migration.error'))->toContain("/api/v1/servers/{$server->uuid}/transfer/complete")
+        ->and($server->isTransferredAway())->toBeFalse();
+});
+
+test('a stopped migrate job records a failure when the target does not have the export', function (array $body, int $status) {
+    Http::fake(['*' => Http::response($body, $status)]);
+
+    stopMigrateJobAfterExport($this->server);
+
+    $server = $this->server->fresh();
+    expect(data_get($server->server_metadata, 'migration.status'))->toBe('failed')
+        ->and($server->isTransferredAway())->toBeFalse();
+})->with([
+    'not found' => [['message' => 'Server not found.'], 404],
+    'other export' => [['transfer' => ['status' => 'claimed', 'export_id' => 'export-0']], 200],
+]);
+
+test('a migrate job stopped before the export records a failure without asking the target', function () {
+    Http::fake();
+
+    (new MigrateServerToInstanceJob($this->server, 'https://8.8.8.8', 'token'))
+        ->failed(new RuntimeException('The job has timed out.'));
+
+    expect(data_get($this->server->fresh()->server_metadata, 'migration.status'))->toBe('failed');
+    Http::assertNothingSent();
+});
+
+test('migrate saves the export ID before it sends the bundle', function () {
+    $savedExportId = null;
+    Http::fake(function ($request) use (&$savedExportId) {
+        $savedExportId = data_get($this->server->fresh()->server_metadata, 'migration.export_id');
+
+        return Http::response(['server_uuid' => $this->server->uuid, 'claimed' => true], 201);
+    });
+
+    $result = app(ServerTransferMigrator::class)->migrate($this->server, 'https://8.8.8.8', 'token');
+
+    expect($savedExportId)->toBe($result['export_id']);
+});
+
+test('transfer back asks the managing instance to transfer the archive here with a short-lived token of its team', function () {
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake(['https://8.8.8.8/api/v1/servers/*/migrate' => Http::response(['migration' => ['status' => 'running']], 202)]);
+
+    app(ServerTransferMigrator::class)->requestTransferBack($this->server->fresh(), $user, 'https://8.8.8.8', 'token-of-b', 'https://coolify-a.test');
+
+    $token = $user->tokens()->sole();
+    expect((int) $token->team_id)->toBe($this->team->id)
+        ->and($token->abilities)->toBe(['read', 'write'])
+        ->and($token->expires_at->isFuture())->toBeTrue()
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.transfer_back.from'))->toBe('https://8.8.8.8');
+    Http::assertSent(fn ($request) => $request->url() === "https://8.8.8.8/api/v1/servers/{$this->server->uuid}/migrate"
+        && $request->hasHeader('Authorization', 'Bearer token-of-b')
+        && $request['target_url'] === 'https://coolify-a.test'
+        && str_starts_with((string) $request['target_token'], $token->id.'|'));
+});
+
+test('a refused transfer back deletes the token and shows the reason of the other instance', function () {
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    app(ServerTransferClaimer::class)->markTransferred($this->server, targetInstanceUrl: 'https://8.8.8.8');
+    Http::fake(['*' => Http::response(['message' => '1 of 13 checks failed: no server with the same IP exists.'], 422)]);
+
+    expect(fn () => app(ServerTransferMigrator::class)->requestTransferBack($this->server->fresh(), $user, 'https://8.8.8.8', 'token-of-b', 'https://coolify-a.test'))
+        ->toThrow(RuntimeException::class, 'no server with the same IP exists');
+
+    expect($user->tokens()->count())->toBe(0)
+        ->and(data_get($this->server->fresh()->server_metadata, 'transfer.transfer_back'))->toBeNull();
+});
+
+test('start notes system-wide git sources that the target does not have', function (bool $noted) {
+    Queue::fake();
+    $systemApp = GithubApp::create([
+        'name' => 'Coolify GitHub', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com',
+        'team_id' => 0, 'is_system_wide' => true, 'is_public' => false,
+    ]);
+    Application::where('name', 'app-on-server')->update(['source_type' => GithubApp::class, 'source_id' => $systemApp->id]);
+    Http::fake(['*/api/v1/servers/import/check*' => Http::response(['message' => 'ok', 'checks' => [], 'missing_system_sources' => ['github' => $noted ? [$systemApp->uuid] : [], 'gitlab' => []]])]);
+
+    app(ServerTransferMigrator::class)->start($this->server, 'https://8.8.8.8', 'token');
+
+    $notes = collect(data_get($this->server->fresh()->server_metadata, 'migration.log'))->pluck('message')
+        ->filter(fn (string $message) => str_contains($message, 'system-wide'));
+    expect($notes->isNotEmpty())->toBe($noted);
+    if ($noted) {
+        expect($notes->first())->toBe("NOTE: the system-wide GitHub App 'Coolify GitHub' of this instance is not transferred, and the target has no matching one. These applications need a new git source on the target: app-on-server. The finish list on the target shows them.");
+    }
+    Http::assertSent(fn ($request) => str_contains(urldecode($request->url()), "system_github_apps[0]={$systemApp->uuid}"));
+    Queue::assertPushed(MigrateServerToInstanceJob::class, 1);
+})->with([
+    'the target has no matching App' => [true],
+    'the target has the App' => [false],
+]);
diff --git a/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php b/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php
index 479367ee70..66cbeee05f 100644
--- a/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferS3DestinationsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\ValidateAndInstallServerJob;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
@@ -16,11 +17,19 @@ use App\Models\Team;
 use App\Services\ServerTransfer\ServerTransferExporter;
 use App\Services\ServerTransfer\ServerTransferImporter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
 use Tests\TestCase;
 
 uses(TestCase::class, RefreshDatabase::class);
 
 beforeEach(function () {
+    // A claim writes the owner marker on the host over SSH.
+    Process::fake();
+    Storage::fake('ssh-keys');
+    // An import validates the claimed server over SSH; the sync test queue would run it.
+    Queue::fake([ValidateAndInstallServerJob::class]);
     Server::flushIdentityMap();
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true, 'fqdn' => 'https://coolify-a.test']);
 
diff --git a/tests/Unit/ServerTransfer/TransferFinishChecklistTest.php b/tests/Unit/ServerTransfer/TransferFinishChecklistTest.php
new file mode 100644
index 0000000000..61d912da4f
--- /dev/null
+++ b/tests/Unit/ServerTransfer/TransferFinishChecklistTest.php
@@ -0,0 +1,278 @@
+<?php
+
+use App\Events\TransferFinishChanged;
+use App\Jobs\CheckTransferFinishStepsJob;
+use App\Livewire\Server\TransferFinish;
+use App\Models\Application;
+use App\Models\DnsProviderZone;
+use App\Models\GithubApp;
+use App\Models\GithubRunnerConfig;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\ManagedDnsRecord;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    Process::fake();
+    Storage::fake('ssh-keys');
+    InstanceSettings::forceCreate(['id' => 0, 'fqdn' => 'https://coolify-b.test']);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => PrivateKey::factory()->create(['team_id' => $this->team->id])->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+
+    $rsaKey = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
+    openssl_pkey_export($rsaKey, $pem);
+    $this->githubApp = GithubApp::create([
+        'name' => 'deploy-bot', 'organization' => 'acme', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com',
+        'app_id' => 1234, 'installation_id' => 5678, 'webhook_secret' => 'gh-secret', 'is_system_wide' => false, 'is_public' => false,
+        'team_id' => $this->team->id,
+        'private_key_id' => PrivateKey::create(['name' => 'gh', 'private_key' => $pem, 'team_id' => $this->team->id])->id,
+    ]);
+    $this->checklist = app(TransferFinishChecklist::class);
+});
+
+function finishTestApplication(object $test, array $attributes = []): Application
+{
+    return Application::factory()->create([
+        'destination_id' => $test->destination->id,
+        'destination_type' => $test->destination->getMorphClass(),
+        ...$attributes,
+    ]);
+}
+
+function finishTestItem(Server $server, string $key): array
+{
+    return collect(data_get($server->fresh()->server_metadata, 'transfer.finish.items'))->firstWhere('key', $key);
+}
+
+test('start lists a step for every kind of setting the server uses', function () {
+    $githubApplication = finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id, 'fqdn' => 'https://shop.example.test']);
+    $gitlabApp = GitlabApp::create(['name' => 'gitlab', 'api_url' => 'https://gitlab.com/api/v4', 'html_url' => 'https://gitlab.com', 'team_id' => $this->team->id, 'is_system_wide' => false]);
+    finishTestApplication($this, ['source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id]);
+    $publicApplication = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'git_repository' => 'https://github.com/acme/public']);
+    $token = IntegrationToken::factory()->for($this->team)->create(['provider' => 'cloudflare']);
+    $record = ManagedDnsRecord::factory()->owned()->create(['dns_provider_zone_id' => DnsProviderZone::factory()->create(['integration_token_id' => $token->id])->id]);
+    $record->addReference($githubApplication);
+    $runnerConfig = GithubRunnerConfig::create(['server_id' => $this->server->id, 'github_app_id' => $this->githubApp->id, 'labels' => ['coolify']]);
+
+    $keys = array_column($this->checklist->start($this->server), 'key');
+
+    expect($keys)->toContain(
+        'server_connection:server',
+        'sentinel:server',
+        "github_app_webhook:{$this->githubApp->uuid}",
+        "github_app_urls:{$this->githubApp->uuid}",
+        "gitlab_webhook:{$gitlabApp->uuid}",
+        "manual_webhook:{$publicApplication->uuid}",
+        "dns_record:{$record->uuid}",
+        'domain:shop.example.test',
+        "github_runners:{$runnerConfig->uuid}",
+    )->and($keys)->not->toContain("manual_webhook:{$githubApplication->uuid}");
+});
+
+test('the GitHub App webhook step checks the URL at GitHub and sets it with one click', function () {
+    finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id]);
+    $this->checklist->start($this->server);
+    $key = "github_app_webhook:{$this->githubApp->uuid}";
+    $hookUrl = 'https://coolify-a.test/webhooks/source/github/events';
+    Http::fake([
+        'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
+        'https://api.github.com/app/hook/config' => function ($request) use (&$hookUrl) {
+            if ($request->method() === 'PATCH') {
+                $hookUrl = $request['url'];
+            }
+
+            return Http::response(['url' => $hookUrl, 'content_type' => 'json']);
+        },
+    ]);
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('action');
+
+    $item = $this->checklist->fix($this->server, $key);
+
+    expect($item['status'])->toBe('ok')
+        ->and(finishTestItem($this->server, $key)['status'])->toBe('ok');
+    Http::assertSent(fn ($request) => $request->method() === 'PATCH' && $request['url'] === 'https://coolify-b.test/webhooks/source/github/events');
+});
+
+test('a webhook step turns OK when this instance receives a webhook after the transfer', function () {
+    $application = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'git_repository' => 'https://github.com/acme/public']);
+    $this->checklist->start($this->server);
+    $key = "manual_webhook:{$application->uuid}";
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('action');
+
+    $this->travel(1)->minutes();
+    TransferFinishChecklist::recordWebhook('application', $application->uuid);
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('ok');
+});
+
+test('a verified GitHub App webhook is recorded for the finish list', function () {
+    $body = json_encode(['action' => 'created', 'installation' => ['id' => 5678]]);
+    $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'installation',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'gh-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    expect(Cache::get("transfer-finish:webhook:github_app:{$this->githubApp->uuid}"))->not->toBeNull();
+});
+
+test('I finished closes the list and keeps the open steps as skipped', function () {
+    $this->checklist->start($this->server);
+    $this->checklist->markDone($this->server, 'server_connection:server');
+
+    $this->checklist->finish($this->server->fresh(), $this->user);
+
+    $finish = $this->checklist->of($this->server->fresh());
+    expect($finish['finished_by'])->toBe($this->user->id)
+        ->and($finish['skipped'])->toBe(['sentinel:server'])
+        ->and($this->checklist->isOpen($this->server->fresh()))->toBeFalse();
+});
+
+test('the panel shows the open steps by group, collapses done steps, and finishes', function () {
+    $this->checklist->start($this->server);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])
+        ->assertSee('Finish the transfer')
+        ->assertSee('0 of 2 done.')
+        ->assertSee('Server')
+        ->assertSee('Restart Sentinel')
+        ->call('markStepDone', 'sentinel:server')
+        ->assertSee('1 of 2 done.')
+        ->assertSee('1 step is OK or done')
+        ->assertSee('Finish with open steps')
+        ->call('markStepDone', 'server_connection:server')
+        ->assertDontSee('Finish with open steps')
+        ->call('finishTransfer')
+        ->assertDontSee('Finish the transfer');
+
+    expect(finishTestItem($this->server, 'sentinel:server')['status'])->toBe('done');
+});
+
+test('the panel starts background checks when they are stale, and not again within 30 seconds', function () {
+    Queue::fake();
+    $this->checklist->start($this->server);
+    $component = Livewire::test(TransferFinish::class, ['server' => $this->server]);
+
+    $component->call('refreshSteps');
+    Queue::assertPushed(CheckTransferFinishStepsJob::class, 1);
+
+    $this->checklist->checkAll($this->server->fresh());
+    $component->call('refreshSteps');
+    Queue::assertPushed(CheckTransferFinishStepsJob::class, 1);
+});
+
+test('a failed check shows a short message and keeps the technical reason as details', function () {
+    finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id]);
+    $this->checklist->start($this->server);
+    Http::fake([
+        'https://api.github.com/zen' => Http::response('ok', 200, ['Date' => now()->toRfc7231String()]),
+        'https://api.github.com/app/hook/config' => Http::response(['message' => 'Bad credentials'], 401),
+    ]);
+
+    $item = $this->checklist->check($this->server, "github_app_webhook:{$this->githubApp->uuid}");
+
+    expect($item['message'])->toBe('GitHub cannot be asked with the App key. No webhook arrived since the transfer.')
+        ->and($item['error'])->toContain('Bad credentials')
+        ->and($item['hint'])->toBe('GitHub must send webhooks to this instance.')
+        ->and($item['details'][0]['value'])->toBe('https://coolify-b.test/webhooks/source/github/events');
+});
+
+test('team members cannot check or finish the transfer', function () {
+    $this->checklist->start($this->server);
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])->call('finishTransfer')->assertForbidden();
+    Livewire::test(TransferFinish::class, ['server' => $this->server])->call('markStepDone', 'sentinel:server')->assertForbidden();
+    Livewire::test(TransferFinish::class, ['server' => $this->server])->call('fixStep', 'sentinel:server')->assertForbidden();
+
+    expect($this->checklist->isOpen($this->server->fresh()))->toBeTrue();
+});
+
+test('a Docker image application has no manual webhook step', function () {
+    $application = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'build_pack' => 'dockerimage', 'git_repository' => 'coollabsio/coolify']);
+
+    expect(array_column($this->checklist->start($this->server), 'key'))->not->toContain("manual_webhook:{$application->uuid}");
+});
+
+test('an application that lost its system-wide git source gets a git source step with a link', function () {
+    $environment = Project::factory()->create(['team_id' => $this->team->id])->environments()->first();
+    $application = finishTestApplication($this, ['source_type' => null, 'source_id' => null, 'environment_id' => $environment->id]);
+    $this->server->forceFill(['server_metadata' => ['transfer' => ['status' => 'claimed', 'git_source_applications' => [$application->uuid]]]])->save();
+    $key = "git_source:{$application->uuid}";
+
+    $items = collect($this->checklist->start($this->server));
+    $item = $items->firstWhere('key', $key);
+    expect($items->pluck('key'))->not->toContain("manual_webhook:{$application->uuid}")
+        ->and($item['link'])->toStartWith('/project/')->toEndWith("/application/{$application->uuid}/source")
+        ->and($this->checklist->check($this->server, $key)['status'])->toBe('action');
+
+    $gitlabApp = GitlabApp::create(['name' => 'gitlab', 'api_url' => 'https://gitlab.com/api/v4', 'html_url' => 'https://gitlab.com', 'team_id' => $this->team->id, 'is_system_wide' => false]);
+    $application->forceFill(['source_type' => GitlabApp::class, 'source_id' => $gitlabApp->id])->save();
+
+    expect($this->checklist->check($this->server, $key)['status'])->toBe('ok');
+});
+
+test('restarting Sentinel waits for its data instead of failing the step at once', function () {
+    $this->checklist->start($this->server);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])
+        ->call('fixStep', 'sentinel:server')
+        ->assertDispatched('info')
+        ->assertNotDispatched('error');
+
+    expect(finishTestItem($this->server, 'sentinel:server')['status'])->toBe('pending');
+});
+
+test('a changed step is broadcast to the team, and the open panel shows it without a reload', function () {
+    Event::fake([TransferFinishChanged::class]);
+    $this->checklist->start($this->server);
+    $component = Livewire::test(TransferFinish::class, ['server' => $this->server])->assertSee('0 of 2 done.');
+
+    $this->checklist->markDone($this->server->fresh(), 'sentinel:server');
+
+    Event::assertDispatched(TransferFinishChanged::class, fn ($event) => $event->serverUuid === $this->server->uuid && $event->teamId === $this->team->id);
+    $component->call('handleTransferFinishChanged', ['serverUuid' => $this->server->uuid])->assertSee('1 of 2 done.');
+});
+
+test('the GitHub App steps link to the App settings at GitHub', function () {
+    finishTestApplication($this, ['source_type' => GithubApp::class, 'source_id' => $this->githubApp->id]);
+    $items = collect($this->checklist->start($this->server));
+
+    expect($this->checklist->linkOf($items->firstWhere('key', "github_app_webhook:{$this->githubApp->uuid}")))->toBe(['https://github.com/organizations/acme/settings/apps/deploy-bot', 'Open on GitHub'])
+        ->and($this->checklist->linkOf($items->firstWhere('key', "github_app_urls:{$this->githubApp->uuid}")))->toBe(['https://github.com/organizations/acme/settings/apps/deploy-bot', 'Open on GitHub']);
+
+    Livewire::test(TransferFinish::class, ['server' => $this->server])
+        ->assertSeeHtml('href="https://github.com/organizations/acme/settings/apps/deploy-bot" target="_blank"')
+        ->assertSee('Open on GitHub');
+});
diff --git a/tests/Unit/TrafficCityHelpersTest.php b/tests/Unit/TrafficCityHelpersTest.php
new file mode 100644
index 0000000000..9d1c7437dc
--- /dev/null
+++ b/tests/Unit/TrafficCityHelpersTest.php
@@ -0,0 +1,137 @@
+<?php
+
+describe('trafficCityRows', function () {
+    it('builds labels, keeps coordinates, and sorts by requests', function () {
+        $rows = trafficCityRows([
+            ['value' => 'SG||Singapore', 'requests' => 3, 'bytesOut' => 30, 'lat' => 1.29, 'lon' => 103.85],
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+        ]);
+
+        expect($rows)->toBe([
+            ['key' => 'DE|BE|Berlin', 'country' => 'DE', 'label' => 'Berlin, BE, DE', 'name' => 'Berlin', 'detail' => 'BE, Germany', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+            ['key' => 'SG||Singapore', 'country' => 'SG', 'label' => 'Singapore, SG', 'name' => 'Singapore', 'detail' => 'Singapore', 'requests' => 3, 'bytesOut' => 30, 'lat' => 1.29, 'lon' => 103.85],
+        ]);
+    });
+
+    it('omits a subdivision that is not a letter code', function (string $value, string $label, string $detail) {
+        $rows = trafficCityRows([
+            ['value' => $value, 'requests' => 1, 'bytesOut' => 1],
+        ]);
+
+        expect($rows[0]['label'])->toBe($label)
+            ->and($rows[0]['detail'])->toBe($detail);
+    })->with([
+        'a name' => ['DE|Land Berlin|Berlin', 'Berlin, DE', 'Germany'],
+        'a number' => ['AT|3|Neunkirchen', 'Neunkirchen, AT', 'Austria'],
+        'one letter' => ['SE|O|Lidköping', 'Lidköping, SE', 'Sweden'],
+    ]);
+
+    it('labels an unknown city with its country and gives it no coordinates', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+            ['value' => 'DE||', 'requests' => 2, 'bytesOut' => 20, 'lat' => 51.0, 'lon' => 9.0],
+        ]);
+
+        expect($rows[1])->toBe([
+            'key' => 'DE||', 'country' => 'DE', 'label' => 'Unknown, DE', 'name' => 'Unknown', 'detail' => 'Germany', 'requests' => 2, 'bytesOut' => 20, 'lat' => null, 'lon' => null,
+        ]);
+    });
+
+    it('merges the remainder and malformed values into one Other row', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900],
+            ['value' => '__other__', 'requests' => 40, 'bytesOut' => 40],
+            ['value' => 'Berlin', 'requests' => 1, 'bytesOut' => 10],
+            ['value' => 'DE|Berlin', 'requests' => 1, 'bytesOut' => 10],
+            ['value' => '', 'requests' => 1, 'bytesOut' => 10],
+        ]);
+
+        // "Other" has the most requests here and still stays last.
+        expect($rows)->toHaveCount(2)
+            ->and($rows[1])->toBe([
+                'key' => '__other__', 'country' => '', 'label' => 'Other', 'name' => 'Other', 'detail' => '', 'requests' => 43, 'bytesOut' => 70, 'lat' => null, 'lon' => null,
+            ]);
+    });
+
+    it('keeps a city name that contains quotes or HTML unchanged', function () {
+        $rows = trafficCityRows([
+            ['value' => "US|MO|O'Fallon <b>", 'requests' => 1, 'bytesOut' => 1],
+        ]);
+
+        expect($rows[0]['name'])->toBe("O'Fallon <b>")
+            ->and($rows[0]['label'])->toBe("O'Fallon <b>, MO, US");
+    });
+
+    it('accepts a lower-case country code', function () {
+        $rows = trafficCityRows([
+            ['value' => 'de|BE|Berlin', 'requests' => 1, 'bytesOut' => 1],
+        ]);
+
+        expect($rows[0]['country'])->toBe('DE')
+            ->and($rows[0]['label'])->toBe('Berlin, BE, DE');
+    });
+
+    it('skips rows with no requests', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900],
+            ['value' => 'FR|IDF|Paris', 'requests' => 0, 'bytesOut' => 0],
+        ]);
+
+        expect($rows)->toHaveCount(1);
+    });
+
+    it('returns nothing when no row has a real city', function (array $input) {
+        expect(trafficCityRows($input))->toBe([]);
+    })->with([
+        'old sentinel' => [[]],
+        'country-only database' => [[
+            ['value' => 'DE||', 'requests' => 5, 'bytesOut' => 50],
+            ['value' => 'US||', 'requests' => 3, 'bytesOut' => 30],
+        ]],
+        'only the remainder' => [[
+            ['value' => '__other__', 'requests' => 5, 'bytesOut' => 50],
+        ]],
+    ]);
+});
+
+describe('trafficGeoMarkers', function () {
+    it('returns country markers and city markers as two sets', function () {
+        $markers = trafficGeoMarkers(
+            [
+                ['value' => 'DE', 'requests' => 12],
+                ['value' => 'us', 'requests' => 7],
+                ['value' => '', 'requests' => 3],
+                ['value' => 'FR', 'requests' => 0],
+            ],
+            [
+                ['value' => 'DE|BE|Berlin', 'requests' => 9, 'lat' => 52.52, 'lon' => 13.405],
+                ['value' => 'DE||', 'requests' => 3],
+                ['value' => 'FR|IDF|Paris', 'requests' => 0, 'lat' => 48.85, 'lon' => 2.35],
+            ],
+        );
+
+        expect($markers)->toBe([
+            'countries' => [
+                ['code' => 'DE', 'requests' => 12],
+                ['code' => 'US', 'requests' => 7],
+            ],
+            'cities' => [
+                ['lat' => 52.52, 'lon' => 13.405, 'requests' => 9],
+            ],
+        ]);
+    });
+
+    it('has no city markers when Sentinel sends no city data', function () {
+        expect(trafficGeoMarkers([['value' => 'DE', 'requests' => 12]], [])['cities'])->toBe([]);
+    });
+
+    it('accepts the rows that trafficCityRows returns', function () {
+        $rows = trafficCityRows([
+            ['value' => 'DE|BE|Berlin', 'requests' => 9, 'bytesOut' => 900, 'lat' => 52.52, 'lon' => 13.405],
+        ]);
+
+        expect(trafficGeoMarkers([], $rows)['cities'])->toBe([
+            ['lat' => 52.52, 'lon' => 13.405, 'requests' => 9],
+        ]);
+    });
+});
diff --git a/tests/Unit/UpgradeScriptContainerStartTest.php b/tests/Unit/UpgradeScriptContainerStartTest.php
new file mode 100644
index 0000000000..efc16ad510
--- /dev/null
+++ b/tests/Unit/UpgradeScriptContainerStartTest.php
@@ -0,0 +1,63 @@
+<?php
+
+/**
+ * Runs the detached container restart block of the upgrade script with a fake docker.
+ *
+ * @return array{exitCode: int, status: string}
+ */
+function runUpgradeScriptContainerStart(string $script, int $composeExitCode, bool $coolifyRunning): array
+{
+    $dir = sys_get_temp_dir().'/upgrade-start-'.bin2hex(random_bytes(4));
+    mkdir($dir);
+    touch("{$dir}/status");
+    $source = file_get_contents(getcwd().'/'.$script);
+    preg_match('/^nohup bash -c "\n(.*?)^" >>"\$LOGFILE" 2>&1 &$/ms', $source, $match);
+    $running = $coolifyRunning ? 'true' : 'false';
+
+    $harness = <<<BASH
+        LOGFILE="{$dir}/upgrade.log"
+        STATUS_FILE="{$dir}/status"
+        DOCKER_CONFIG_MOUNT=''
+        REGISTRY_URL='docker.io'
+        LATEST_HELPER_VERSION='1.0.17'
+        LATEST_IMAGE='4.4.7'
+        docker() {
+            case "\$1" in
+                run) return {$composeExitCode} ;;
+                inspect) echo {$running} ;;
+            esac
+        }
+        sleep() { :; }
+        export -f docker sleep
+        bash -c "
+        {$match[1]}"
+        BASH;
+
+    exec('bash -c '.escapeshellarg($harness).' >/dev/null 2>&1', result_code: $exitCode);
+    $status = is_file("{$dir}/status") ? file_get_contents("{$dir}/status") : '';
+    exec('rm -rf '.escapeshellarg($dir));
+
+    return ['exitCode' => $exitCode, 'status' => $status];
+}
+
+it('reports an error when the new Coolify containers do not start', function (string $script) {
+    $result = runUpgradeScriptContainerStart($script, composeExitCode: 1, coolifyRunning: false);
+
+    expect($result['exitCode'])->toBe(1)
+        ->and($result['status'])->toStartWith('error|')
+        ->toContain('upgrade log');
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
+
+it('completes the upgrade when the coolify container runs but is not healthy within the wait timeout', function (string $script) {
+    $result = runUpgradeScriptContainerStart($script, composeExitCode: 1, coolifyRunning: true);
+
+    expect($result['exitCode'])->toBe(0)
+        ->and($result['status'])->toBe('');
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
+
+it('completes the upgrade when docker compose up succeeds', function (string $script) {
+    $result = runUpgradeScriptContainerStart($script, composeExitCode: 0, coolifyRunning: true);
+
+    expect($result['exitCode'])->toBe(0)
+        ->and($result['status'])->toBe('');
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
diff --git a/tests/Unit/UpgradeScriptCoolifyNetworkTest.php b/tests/Unit/UpgradeScriptCoolifyNetworkTest.php
new file mode 100644
index 0000000000..ab3d497730
--- /dev/null
+++ b/tests/Unit/UpgradeScriptCoolifyNetworkTest.php
@@ -0,0 +1,93 @@
+<?php
+
+/**
+ * Runs ensure_coolify_network() from the upgrade script with a fake docker. Docker Engine 27.x reports an IPv6
+ * gateway with its prefix length (fd00:1::1/64), which the Docker CLI and Compose in the helper image cannot parse.
+ *
+ * @return array{exitCode: int, calls: list<string>, status: string}
+ */
+function runUpgradeScriptEnsureCoolifyNetwork(string $script, ?string $existingGateways, string $createdIpv6Gateway): array
+{
+    $dir = sys_get_temp_dir().'/upgrade-network-'.bin2hex(random_bytes(4));
+    mkdir($dir);
+    touch("{$dir}/calls");
+    touch("{$dir}/status");
+    if ($existingGateways !== null) {
+        file_put_contents("{$dir}/gateways", $existingGateways);
+    }
+    $source = file_get_contents(getcwd().'/'.$script);
+    $functions = collect(['log', 'write_status', 'network_gateway_with_prefix', 'ensure_coolify_network'])
+        ->map(function (string $name) use ($source): string {
+            preg_match('/^'.$name.'\(\) \{.*?^\}\n/ms', $source, $match);
+
+            return $match[0] ?? '';
+        })
+        ->implode('');
+
+    $harness = <<<BASH
+        LOGFILE="{$dir}/upgrade.log"
+        STATUS_FILE="{$dir}/status"
+        docker() {
+            echo "\$*" >> "{$dir}/calls"
+            case "\$1 \$2" in
+                "network inspect")
+                    [ -f "{$dir}/gateways" ] || { echo "Error: network coolify not found" >&2; return 1; }
+                    cat "{$dir}/gateways"
+                    ;;
+                "network create")
+                    case "\$*" in
+                        *--ipv6*) echo "172.19.0.1 {$createdIpv6Gateway} " > "{$dir}/gateways" ;;
+                        *) echo "172.19.0.1 " > "{$dir}/gateways" ;;
+                    esac
+                    ;;
+                "network rm") rm -f "{$dir}/gateways" ;;
+                version*) echo 27.5.1 ;;
+            esac
+        }
+        {$functions}
+        ensure_coolify_network
+        BASH;
+
+    exec('bash -c '.escapeshellarg($harness).' >/dev/null 2>&1', result_code: $exitCode);
+    $calls = array_values(array_filter(explode("\n", file_get_contents("{$dir}/calls")), fn (string $call): bool => $call !== '' && ! str_starts_with($call, 'network inspect') && ! str_starts_with($call, 'version')));
+    $status = file_get_contents("{$dir}/status");
+    exec('rm -rf '.escapeshellarg($dir));
+
+    return ['exitCode' => $exitCode, 'calls' => $calls, 'status' => $status];
+}
+
+it('stops the upgrade before any container changes when the coolify network has a gateway with a prefix length', function (string $script) {
+    $result = runUpgradeScriptEnsureCoolifyNetwork($script, existingGateways: '172.19.0.1 fd00:1::1/64 ', createdIpv6Gateway: 'unused');
+
+    expect($result['exitCode'])->toBe(1)
+        ->and($result['calls'])->toBe([])
+        ->and($result['status'])->toStartWith('error|')
+        ->toContain('fd00:1::1/64')
+        ->toContain('systemctl restart docker');
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
+
+it('keeps a readable coolify network', function (string $script) {
+    $result = runUpgradeScriptEnsureCoolifyNetwork($script, existingGateways: '172.19.0.1 fd00:1::1 ', createdIpv6Gateway: 'unused');
+
+    expect($result)->toBe(['exitCode' => 0, 'calls' => [], 'status' => '']);
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
+
+it('creates the coolify network with IPv6', function (string $script) {
+    $result = runUpgradeScriptEnsureCoolifyNetwork($script, existingGateways: null, createdIpv6Gateway: 'fd00:1::1');
+
+    expect($result)->toBe(['exitCode' => 0, 'calls' => ['network create --attachable --ipv6 coolify'], 'status' => '']);
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
+
+it('recreates a new coolify network without IPv6 when Docker reports its gateway with a prefix length', function (string $script) {
+    $result = runUpgradeScriptEnsureCoolifyNetwork($script, existingGateways: null, createdIpv6Gateway: 'fd00:1::1/64');
+
+    expect($result)->toBe([
+        'exitCode' => 0,
+        'calls' => [
+            'network create --attachable --ipv6 coolify',
+            'network rm coolify',
+            'network create --attachable coolify',
+        ],
+        'status' => '',
+    ]);
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
diff --git a/tests/Unit/UpgradeScriptPullRetryTest.php b/tests/Unit/UpgradeScriptPullRetryTest.php
new file mode 100644
index 0000000000..d30514a965
--- /dev/null
+++ b/tests/Unit/UpgradeScriptPullRetryTest.php
@@ -0,0 +1,42 @@
+<?php
+
+/**
+ * Runs pull_image() from the upgrade script with a fake docker that fails the first $failures pulls.
+ *
+ * @return array{exitCode: int, pulls: int}
+ */
+function runUpgradeScriptPullImage(string $script, int $failures): array
+{
+    $dir = sys_get_temp_dir().'/upgrade-pull-'.bin2hex(random_bytes(4));
+    mkdir($dir);
+    $source = file_get_contents(getcwd().'/'.$script);
+    preg_match('/^log\(\) \{.*?^\}\n/ms', $source, $log);
+    preg_match('/^pull_image\(\) \{.*?^\}\n/ms', $source, $pullImage);
+
+    $harness = <<<BASH
+        LOGFILE="{$dir}/upgrade.log"
+        docker() {
+            local count=\$(cat "{$dir}/pulls" 2>/dev/null || echo 0)
+            echo \$((count + 1)) > "{$dir}/pulls"
+            [ "\$count" -ge {$failures} ]
+        }
+        sleep() { :; }
+        {$log[0]}
+        {$pullImage[0]}
+        pull_image ghcr.io/coollabsio/coolify-helper:1.0.14
+        BASH;
+
+    exec('bash -c '.escapeshellarg($harness).' >/dev/null 2>&1', result_code: $exitCode);
+    $pulls = (int) @file_get_contents("{$dir}/pulls");
+    exec('rm -rf '.escapeshellarg($dir));
+
+    return ['exitCode' => $exitCode, 'pulls' => $pulls];
+}
+
+it('retries a rate limited image pull until it succeeds', function (string $script) {
+    expect(runUpgradeScriptPullImage($script, failures: 2))->toBe(['exitCode' => 0, 'pulls' => 3]);
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
+
+it('fails the image pull after five attempts', function (string $script) {
+    expect(runUpgradeScriptPullImage($script, failures: 10))->toBe(['exitCode' => 1, 'pulls' => 5]);
+})->with(['scripts/upgrade.sh', 'other/nightly/upgrade.sh']);
diff --git a/tests/Unit/ValidGitRepositoryUrlTest.php b/tests/Unit/ValidGitRepositoryUrlTest.php
index f76a349c79..6ffa7e4a01 100644
--- a/tests/Unit/ValidGitRepositoryUrlTest.php
+++ b/tests/Unit/ValidGitRepositoryUrlTest.php
@@ -110,6 +110,10 @@ it('validates SSH URLs when allowed', function () {
         'custom-user@git.example.com:organization/repository.git',
         'custom-user@git.example.com:2222/organization/repository.git',
         'enterprise-user@enterprise.ghe.com:organization/repository.git',
+        'ssh://git@gitea.example.local:2222/myuser/my-repository.git',
+        'ssh://git@github.com/user/repo.git',
+        'ssh://git@192.168.1.10:22/~user/repo.git',
+        'ssh://git@[2001:db8::10]:2222/group/project.git',
     ];
 
     foreach ($validUrls as $url) {
@@ -133,6 +137,7 @@ it('rejects SSH URLs when not allowed', function () {
         'git@github.com:user/repo.git',
         'git@gitlab.com:user/repo.git',
         'custom-user@git.example.com:organization/repository.git',
+        'ssh://git@gitea.example.com:2222/organization/repository.git',
     ];
 
     foreach ($invalidUrls as $url) {
@@ -371,6 +376,11 @@ it('rejects invalid URL formats', function () {
         'ftp://github.com/user/repo',
         'file:///path/to/repo',
         'ssh://github.com/user/repo',
+        'ssh://git@github.com',
+        'ssh://git@github.com:2222',
+        'ssh://git@github.com:port/user/repo.git',
+        'ssh://git@github.com:2222:user/repo.git',
+        'ssh://git@[not-an-ip]:2222/user/repo.git',
         'https://',
         'http://',
         'git@',
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index 7d65f22ae8..be745506ab 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -5,6 +5,7 @@ use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Process;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -135,6 +136,42 @@ it('saves application name description and ports from the general form', functio
         ->screenshot(filename: 'application-general-reloaded');
 });
 
+it('shows the unsaved bar for a Compose location edit and saves it with the name', function () {
+    Process::fake(fn ($process) => match (true) {
+        str_contains($process->command, 'git --version') => Process::result('git version 2.43.0'),
+        str_contains($process->command, 'head -c') => Process::result("services:\n  web:\n    image: nginx\n"),
+        default => Process::result(''),
+    });
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_location' => '/docker-compose.yaml',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx\n",
+    ]);
+    loginAndSkipBoarding();
+
+    $page = visit(applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ));
+
+    // The Compose location input is bound through @entangle, not wire:model.
+    $page->assertSee('Docker compose location')
+        ->type('input[placeholder="/docker-compose.yaml"]', '/compose.prod.yaml')
+        ->assertScript(<<<'JS'
+            () => [...document.querySelectorAll('.is-dirty')].some((bar) => bar.textContent.includes('Save changes'))
+            JS)
+        ->type('name', 'Renamed Compose App')
+        ->click('button:visible:has-text("Save changes")')
+        ->wait(2)
+        ->screenshot(filename: 'application-compose-location-saved');
+
+    expect($this->application->refresh()->only(['name', 'docker_compose_location']))->toBe([
+        'name' => 'Renamed Compose App',
+        'docker_compose_location' => '/compose.prod.yaml',
+    ]);
+});
+
 it('saves custom docker run options from the UI', function () {
     loginAndSkipBoarding();
 
diff --git a/tests/v4/Browser/BackupSortTest.php b/tests/v4/Browser/BackupSortTest.php
new file mode 100644
index 0000000000..096515f56a
--- /dev/null
+++ b/tests/v4/Browser/BackupSortTest.php
@@ -0,0 +1,96 @@
+<?php
+
+use App\Models\LocalPersistentVolume;
+use App\Models\ScheduledVolumeBackup;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+});
+
+/**
+ * Creates volume backups for bravo, alpha, and charlie, in that order from oldest to newest.
+ */
+function createSortableVolumeBackups(Model $resource): void
+{
+    foreach (['bravo', 'alpha', 'charlie'] as $index => $name) {
+        $volume = LocalPersistentVolume::create([
+            'uuid' => (string) new Cuid2,
+            'name' => $name.'-data',
+            'mount_path' => '/data/'.$name,
+            'resource_id' => $resource->id,
+            'resource_type' => $resource->getMorphClass(),
+        ]);
+
+        $backup = ScheduledVolumeBackup::create([
+            'backupable_type' => $volume->getMorphClass(),
+            'backupable_id' => $volume->id,
+            'team_id' => 0,
+            'frequency' => '0 0 * * *',
+            'enabled' => true,
+        ]);
+
+        ScheduledVolumeBackup::whereKey($backup->id)->update(['created_at' => now()->subDays(10 - $index)]);
+    }
+}
+
+/**
+ * Returns the backup target names in the order the browser shows them, top to bottom.
+ */
+function visibleBackupOrderScript(): string
+{
+    return <<<'JS'
+        () => [...document.querySelectorAll('.data-table-row')]
+            .filter((row) => row.offsetParent !== null)
+            .sort((left, right) => left.getBoundingClientRect().top - right.getBoundingClientRect().top)
+            .map((row) => row.querySelector('span').textContent.trim())
+            .join(',')
+        JS;
+}
+
+function assertBackupSortOrders(mixed $page, string $screenshot): void
+{
+    $page->assertSee('alpha-data')
+        ->assertScript(visibleBackupOrderScript(), 'alpha-data,bravo-data,charlie-data')
+        ->click('Sort')
+        ->click('Target Z–A')
+        ->assertScript(visibleBackupOrderScript(), 'charlie-data,bravo-data,alpha-data')
+        ->click('Sort')
+        ->click('Oldest first')
+        ->assertScript(visibleBackupOrderScript(), 'bravo-data,alpha-data,charlie-data')
+        ->click('Sort')
+        ->click('Newest first')
+        ->assertScript(visibleBackupOrderScript(), 'charlie-data,alpha-data,bravo-data')
+        ->screenshot(filename: $screenshot);
+}
+
+it('reorders application storage backups when the sort option changes', function () {
+    $application = createBrowserApplication($this->stack, [
+        'uuid' => 'app-browser-backup-sort',
+        'name' => 'Backup Sort App',
+    ]);
+    createSortableVolumeBackups($application);
+
+    loginAndSkipBoarding();
+
+    $page = visit(applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $application).'/backups');
+
+    assertBackupSortOrders($page, 'application-backup-sort');
+});
+
+it('reorders service storage backups when the sort option changes', function () {
+    ['service' => $service, 'serviceApplication' => $serviceApplication] = createBrowserService($this->stack, [
+        'uuid' => 'svc-browser-backup-sort',
+    ]);
+    createSortableVolumeBackups($serviceApplication);
+
+    loginAndSkipBoarding();
+
+    $page = visit(serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $service).'/storage-backups');
+
+    assertBackupSortOrders($page, 'service-backup-sort');
+});
diff --git a/tests/v4/Browser/DeployCanvasTest.php b/tests/v4/Browser/DeployCanvasTest.php
index 3ec512493e..a471f4f386 100644
--- a/tests/v4/Browser/DeployCanvasTest.php
+++ b/tests/v4/Browser/DeployCanvasTest.php
@@ -114,7 +114,7 @@ it('zooms around the fingers with a two-finger pinch', function () {
 
     // Two touch pointers 100px apart move to 200px apart: the zoom doubles from 100% to the 200% maximum.
     $zoom = $page->script(<<<'JS'
-        (() => {
+        (async () => {
             const viewport = document.querySelector('.cv-viewport');
             const r = viewport.getBoundingClientRect();
             const y = r.top + r.height / 2;
@@ -127,6 +127,8 @@ it('zooms around the fingers with a two-finger pinch', function () {
             fire('pointermove', 2, cx + 100);
             fire('pointerup', 1, cx - 100);
             fire('pointerup', 2, cx + 100);
+            // The label is reactive: wait for Svelte to write it.
+            await new Promise(resolve => requestAnimationFrame(resolve));
             return document.querySelector('button[title="Reset zoom to 100%"]').textContent;
         })()
     JS);
diff --git a/tests/v4/Browser/FileBrowserTest.php b/tests/v4/Browser/FileBrowserTest.php
new file mode 100644
index 0000000000..39c2d9add4
--- /dev/null
+++ b/tests/v4/Browser/FileBrowserTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+    $this->postgres = createBrowserPostgresql($this->stack, [
+        'uuid' => 'db-browser-files',
+        'name' => 'Files Postgres',
+        'status' => 'exited',
+    ]);
+});
+
+it('shows the Files tab and a stopped state for a stopped container', function () {
+    loginAndSkipBoarding();
+
+    $url = databaseConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->postgres
+    ).'/files';
+
+    $page = visit($url);
+
+    $page->assertSee('Container is not running')
+        ->assertSee('Start the container to browse its files')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'file-browser-stopped');
+});
+
+it('opens a directory whose name contains an apostrophe', function () {
+    config(['constants.ssh.mux_enabled' => false]);
+    Storage::fake('ssh-keys');
+    $this->postgres->update(['status' => 'running']);
+    Process::fake(function ($process) {
+        $output = '';
+        if (str_contains($process->command, 'docker inspect')) {
+            $output = '/data';
+        } elseif (str_contains($process->command, 'stat -c') && ! str_contains($process->command, 'folder')) {
+            $output = "dir\t0\t1\t755\troot\troot\tit's a folder";
+        }
+
+        return Process::result(output: $output);
+    });
+    loginAndSkipBoarding();
+    $url = databaseConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->postgres
+    ).'/files';
+    visit($url)
+        ->assertSee("it's a folder")
+        ->click("it's a folder")
+        ->assertSee('This folder is empty')
+        ->assertSee("it's a folder")
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'file-browser-apostrophe');
+});
diff --git a/tests/v4/Browser/FleetMetricsTableSortTest.php b/tests/v4/Browser/FleetMetricsTableSortTest.php
new file mode 100644
index 0000000000..3d3c30bf3c
--- /dev/null
+++ b/tests/v4/Browser/FleetMetricsTableSortTest.php
@@ -0,0 +1,141 @@
+<?php
+
+use App\Models\Server;
+use App\Services\SentinelMetricsClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Concurrency;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+class FakeBrowserFleetMetricsClient extends SentinelMetricsClient
+{
+    public function summary(): ?array
+    {
+        $usage = [
+            'alpha' => ['cpu' => 10.0, 'memUsed' => 80],
+            // bravo runs an older Sentinel that does not send the load.
+            'bravo' => ['cpu' => 90.0, 'memUsed' => 20, 'load1' => null],
+        ][$this->server->name] ?? null;
+
+        // charlie does not answer.
+        if ($usage === null) {
+            return null;
+        }
+
+        return array_merge([
+            'online' => true, 'memTotal' => 100,
+            'diskUsed' => 10, 'diskTotal' => 100, 'diskPercent' => 10.0,
+            'load1' => 0.4, 'netRx' => 5.0, 'netTx' => 1.0,
+        ], $usage);
+    }
+
+    public function containersCurrent(): array
+    {
+        return match ($this->server->name) {
+            'alpha' => [['id' => 'zeta', 'cpu' => 70.0, 'memUsed' => 10, 'memPercent' => 1.0, 'diskBytes' => 1, 'net' => 0.0]],
+            'bravo' => [['id' => 'beta', 'cpu' => 5.0, 'memUsed' => 20, 'memPercent' => 2.0, 'diskBytes' => 2, 'net' => 0.0]],
+            default => [],
+        };
+    }
+
+    public function history(string $metric, string $range): array
+    {
+        return [];
+    }
+
+    public function networkHistory(string $range): array
+    {
+        return ['rx' => [], 'tx' => []];
+    }
+}
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack(['serverName' => 'alpha']);
+    Concurrency::setDefaultInstance('sync');
+    // The dashboard chart reads metrics over SSH for each server with metrics on.
+    Process::fake();
+
+    $servers = [$this->stack['server']];
+    foreach (['bravo', 'charlie'] as $name) {
+        $servers[] = Server::factory()->create([
+            'name' => $name, 'team_id' => 0, 'private_key_id' => $this->stack['privateKey']->id,
+        ]);
+    }
+    foreach ($servers as $server) {
+        // Saved quietly, so the settings hook does not start Sentinel.
+        $server->settings->forceFill(['is_metrics_enabled' => true, 'is_reachable' => true, 'is_usable' => true])->saveQuietly();
+    }
+
+    app()->bind(SentinelMetricsClient::class, fn ($app, array $parameters) => new FakeBrowserFleetMetricsClient($parameters['server']));
+});
+
+/** The visible row names of one metrics table, in DOM order (the order focus and screen readers follow). */
+function visibleFleetMetricsRowNames(mixed $page, string $section): array
+{
+    return $page->script(<<<JS
+        [...document.querySelectorAll('#{$section} [data-row]')]
+            .filter((row) => getComputedStyle(row).display !== 'none')
+            .map((row) => JSON.parse(row.dataset.row).name)
+    JS);
+}
+
+it('sorts the servers and containers tables when a column header is selected', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/metrics');
+
+    // Default: CPU, largest first. The offline server is last.
+    $page->assertSee('charlie');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    $page->click('#metrics-servers-section button[title="Sort by server"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+
+    // A second click reverses the direction. The offline server stays last.
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    // A server without a value stays after the servers with one, in both directions.
+    $page->click('#metrics-servers-section button[title="Sort by load"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+    $page->click('#metrics-servers-section button[title="Sort by load"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['alpha', 'bravo', 'charlie']);
+
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    $page->click('#metrics-servers-section button[title="Sort by memory"]');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    // A data refresh keeps the sort.
+    $page->click('button:visible:has-text("7 days")')
+        ->assertQueryStringHas('range', '7d');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-servers-section'))->toBe(['bravo', 'alpha', 'charlie']);
+
+    expect(visibleFleetMetricsRowNames($page, 'metrics-containers-section'))->toBe(['zeta', 'beta']);
+    // The notification banner at the bottom of the page covers this header, so a pointer click cannot reach it.
+    $page->script('document.querySelector(\'#metrics-containers-section button[title="Sort by container"]\').click()');
+    expect(visibleFleetMetricsRowNames($page, 'metrics-containers-section'))->toBe(['beta', 'zeta']);
+
+    $page->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'fleet-metrics-tables-sorted');
+});
+
+it('enables metrics from the empty state', function () {
+    Queue::fake();
+    Server::query()->each(fn (Server $server) => $server->settings->forceFill(['is_metrics_enabled' => false])->saveQuietly());
+
+    loginAndSkipBoarding();
+
+    $page = visit('/metrics');
+
+    $page->assertSee('No server metrics yet')
+        ->click('button:visible:has-text("Enable metrics on 3 servers")')
+        ->assertSee('Hottest containers')
+        ->assertDontSee('No server metrics yet')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'fleet-metrics-enabled-from-empty-state');
+});
diff --git a/tests/v4/Browser/ScheduledTaskDeleteTest.php b/tests/v4/Browser/ScheduledTaskDeleteTest.php
new file mode 100644
index 0000000000..062798b068
--- /dev/null
+++ b/tests/v4/Browser/ScheduledTaskDeleteTest.php
@@ -0,0 +1,79 @@
+<?php
+
+use App\Models\ScheduledTask;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+    $service = createBrowserService($this->stack, ['uuid' => 'svc-browser-task', 'name' => 'Task Service'])['service'];
+    $this->task = ScheduledTask::factory()->create([
+        'team_id' => 0,
+        'service_id' => $service->id,
+        'name' => 'nightly-cleanup',
+        'command' => 'echo cleanup',
+        'frequency' => 'daily',
+    ]);
+    $this->base = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $service);
+});
+
+/**
+ * Records the HTTP status of every Livewire request the page sends.
+ */
+function recordScheduledTaskLivewireStatuses(mixed $page): void
+{
+    $page->script(<<<'JS'
+        (() => {
+            window.livewireStatuses = [];
+            const fetch = window.fetch;
+            window.fetch = async (...args) => {
+                const response = await fetch(...args);
+                if (String(args[0]).includes('/livewire')) {
+                    window.livewireStatuses.push(response.status);
+                }
+                return response;
+            };
+        })()
+    JS);
+}
+
+it('deletes a service scheduled task from its modal and stays on the task list', function () {
+    loginAndSkipBoarding();
+
+    $page = visit("{$this->base}/scheduled-tasks?task_uuid={$this->task->uuid}")
+        ->assertSee('Task configuration');
+    recordScheduledTaskLivewireStatuses($page);
+
+    $page->click('button:visible:has-text("Danger Zone")')
+        ->click('button:visible:has-text("Delete task")')
+        ->fill('input[x-model="userConfirmationText"]', 'nightly-cleanup')
+        ->click('button:visible:has-text("Permanently delete")')
+        ->wait(3);
+
+    expect($this->task->fresh())->toBeNull()
+        ->and($page->script('window.livewireStatuses'))->not->toContain(404);
+
+    $page->assertPathIs(parse_url("{$this->base}/scheduled-tasks", PHP_URL_PATH))
+        ->assertDontSee('Task configuration')
+        ->screenshot(filename: 'scheduled-task-deleted');
+});
+
+it('keeps polling executions without a 404 after the task is deleted', function () {
+    loginAndSkipBoarding();
+
+    $page = visit("{$this->base}/scheduled-tasks?task_uuid={$this->task->uuid}")
+        ->assertSee('Task configuration');
+    recordScheduledTaskLivewireStatuses($page);
+
+    // The executions list polls every 5 seconds, so a poll can run after the delete and before the modal closes.
+    $this->task->delete();
+    $page->script(<<<'JS'
+        Livewire.all().find((component) => component.name === 'project.shared.scheduled-task.executions')
+            .$wire.refreshExecutions()
+    JS);
+    $page->wait(1);
+
+    expect($page->script('window.livewireStatuses'))->toBe([200]);
+    $page->screenshot(filename: 'scheduled-task-poll-after-delete');
+});
diff --git a/tests/v4/Browser/SidebarScrollTest.php b/tests/v4/Browser/SidebarScrollTest.php
new file mode 100644
index 0000000000..b33925f630
--- /dev/null
+++ b/tests/v4/Browser/SidebarScrollTest.php
@@ -0,0 +1,66 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+    $this->application = createBrowserApplication($this->stack, [
+        'uuid' => 'app-sidebar-scroll',
+        'name' => 'Sidebar Scroll App',
+    ]);
+});
+
+/**
+ * @return array{bottom: float, viewport: int, overflows: bool, scrolled: bool}
+ */
+function measureSidebarScroll(mixed $page, string $scrollerSelector, string $frameSelector): array
+{
+    return $page->script(sprintf(<<<'JS'
+        () => {
+            const scroller = document.querySelector(%s);
+            const frame = document.querySelector(%s);
+            scroller.scrollTop = scroller.scrollHeight;
+
+            return {
+                bottom: frame.getBoundingClientRect().bottom,
+                viewport: window.innerHeight,
+                overflows: scroller.scrollHeight > scroller.clientHeight,
+                scrolled: scroller.scrollTop > 0,
+            };
+        }
+    JS, json_encode($scrollerSelector), json_encode($frameSelector)));
+}
+
+it('scrolls the main sidebar inside a short viewport', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/')->resize(1440, 420)->assertSee('Dashboard');
+
+    $sidebar = measureSidebarScroll($page, 'div.lg\\:fixed nav > ul[role="list"]', 'div.lg\\:fixed nav');
+
+    $page->screenshot(filename: 'main-sidebar-scroll');
+
+    expect($sidebar['bottom'])->toBeLessThanOrEqual($sidebar['viewport'])
+        ->and($sidebar['overflows'])->toBeTrue()
+        ->and($sidebar['scrolled'])->toBeTrue();
+});
+
+it('scrolls the resource settings sidebar inside a short viewport', function () {
+    loginAndSkipBoarding();
+
+    $page = visit(applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ))->resize(1440, 420)->assertSee('Sidebar Scroll App');
+
+    $sidebar = measureSidebarScroll($page, '.application-settings-navigation', '.application-settings-navigation');
+
+    $page->screenshot(filename: 'settings-sidebar-scroll');
+
+    expect($sidebar['bottom'])->toBeLessThanOrEqual($sidebar['viewport'])
+        ->and($sidebar['overflows'])->toBeTrue()
+        ->and($sidebar['scrolled'])->toBeTrue();
+});
diff --git a/tests/v4/Browser/TableDropdownCloseTest.php b/tests/v4/Browser/TableDropdownCloseTest.php
new file mode 100644
index 0000000000..35a10122ba
--- /dev/null
+++ b/tests/v4/Browser/TableDropdownCloseTest.php
@@ -0,0 +1,50 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('closes the table dropdown without calling window.close when an option is clicked', function () {
+    $stack = seedBrowserResourceStack();
+
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard')
+        ->navigate(route('project.resource.create', [
+            'project_uuid' => $stack['project']->uuid,
+            'environment_uuid' => $stack['environment']->uuid,
+        ]))
+        ->assertSee('Filter');
+
+    $page->script(<<<'JS'
+        () => {
+            window.__windowCloseCalls = 0;
+            window.close = () => window.__windowCloseCalls++;
+            [...document.querySelectorAll('button')].find(button => button.textContent.trim() === 'Filter').click();
+        }
+    JS);
+    $page->wait(0.5);
+
+    $page->script(<<<'JS'
+        () => [...document.querySelectorAll('[role="option"]')]
+            .find(option => option.textContent.trim() === 'Applications')
+            .click()
+    JS);
+    $page->wait(0.5);
+
+    $state = $page->script(<<<'JS'
+        () => {
+            const trigger = [...document.querySelectorAll('button')].find(button => button.textContent.trim() === 'Filter');
+
+            return {
+                windowCloseCalls: window.__windowCloseCalls,
+                open: Alpine.$data(trigger.closest('[x-data]')).open,
+            };
+        }
+    JS);
+
+    expect($state)->toBe(['windowCloseCalls' => 0, 'open' => false]);
+    $page->screenshot(filename: 'table-dropdown-close');
+});
diff --git a/tests/v4/Browser/TrafficGeoCitiesTest.php b/tests/v4/Browser/TrafficGeoCitiesTest.php
new file mode 100644
index 0000000000..882c3e131f
--- /dev/null
+++ b/tests/v4/Browser/TrafficGeoCitiesTest.php
@@ -0,0 +1,67 @@
+<?php
+
+use App\Services\SentinelTrafficClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+class FakeBrowserCityTrafficClient extends SentinelTrafficClient
+{
+    protected function raw(string $url): string
+    {
+        $responses = [
+            '/traffic/apps' => [],
+            '/traffic/overview' => [
+                'requests' => 1000, 'bytes_in' => 5000, 'bytes_out' => 25000,
+                'status' => ['s2xx' => 900, 's3xx' => 50, 's4xx' => 40, 's5xx' => 10],
+                'latency' => ['p50' => 12.5, 'p95' => 45.2, 'p99' => 90.1],
+                'unique_visitors' => 320,
+            ],
+            '/traffic/breakdown/country' => [
+                ['value' => 'DE', 'requests' => 600, 'bytes_out' => 15000],
+                ['value' => 'FR', 'requests' => 400, 'bytes_out' => 10000],
+            ],
+            '/traffic/breakdown/city' => [
+                ['value' => 'DE|BE|Berlin', 'requests' => 450, 'bytes_out' => 11000, 'lat' => 52.52, 'lon' => 13.405],
+                ['value' => 'FR|IDF|Paris', 'requests' => 400, 'bytes_out' => 10000, 'lat' => 48.85, 'lon' => 2.35],
+                ['value' => 'DE||', 'requests' => 150, 'bytes_out' => 4000],
+            ],
+        ];
+
+        foreach ($responses as $needle => $response) {
+            if (str_contains($url, $needle)) {
+                return json_encode($response);
+            }
+        }
+
+        return '{}';
+    }
+}
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+
+    $server = $this->stack['server'];
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    app()->bind(SentinelTrafficClient::class, fn () => new FakeBrowserCityTrafficClient($server));
+});
+
+it('switches the Locations card between countries and cities and remembers the selection', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/analytics');
+
+    $page->assertSee('Locations')
+        ->assertSee('Germany')
+        ->assertDontSee('BE, Germany')
+        ->click('button:visible:has-text("Cities")')
+        ->assertSee('BE, Germany')
+        ->assertSee('IDF, France')
+        ->assertDontSee('United States')
+        ->refresh()
+        ->assertSee('BE, Germany')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'analytics-locations-cities');
+});
diff --git a/tests/v4/Browser/TrafficTableSortTest.php b/tests/v4/Browser/TrafficTableSortTest.php
new file mode 100644
index 0000000000..3236e45f9b
--- /dev/null
+++ b/tests/v4/Browser/TrafficTableSortTest.php
@@ -0,0 +1,104 @@
+<?php
+
+use App\Services\SentinelTrafficClient;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+class FakeBrowserSortTrafficClient extends SentinelTrafficClient
+{
+    protected function raw(string $url): string
+    {
+        // Twelve paths: /p01 has the fewest requests and /p12 the most, so the
+        // first page (10 rows) by requests hides /p01 and /p02.
+        $paths = [];
+        foreach (range(1, 12) as $i) {
+            $paths[] = [
+                'path' => sprintf('/p%02d', $i), 'app' => 'app-1', 'requests' => $i * 10, 'bytes_out' => 1000,
+                's4xx' => 0, 's5xx' => 0, 'p50' => 10, 'p95' => 30,
+            ];
+        }
+
+        $responses = [
+            '/traffic/apps' => [],
+            '/traffic/overview' => [
+                'requests' => 780, 'bytes_in' => 5000, 'bytes_out' => 12000,
+                'status' => ['s2xx' => 780, 's3xx' => 0, 's4xx' => 0, 's5xx' => 0],
+                'latency' => ['p50' => 12.5, 'p95' => 45.2, 'p99' => 90.1],
+                'unique_visitors' => 320,
+            ],
+            '/traffic/paths' => $paths,
+        ];
+
+        foreach ($responses as $needle => $response) {
+            if (str_contains($url, $needle)) {
+                return json_encode($response);
+            }
+        }
+
+        return '{}';
+    }
+}
+
+beforeEach(function () {
+    $this->stack = seedBrowserResourceStack();
+
+    $server = $this->stack['server'];
+    $server->settings->is_traffic_analytics_enabled = true;
+    $server->settings->save();
+
+    app()->bind(SentinelTrafficClient::class, fn () => new FakeBrowserSortTrafficClient($server));
+});
+
+/**
+ * The first visible path rows in DOM order, which is the keyboard and
+ * screen-reader order. Returns null when the screen order is different.
+ */
+function visiblePathNames(mixed $page): ?array
+{
+    return $page->script(<<<'JS'
+        (() => {
+            const rows = [...document.querySelectorAll('#analytics-paths-section [data-row]')]
+                .filter((row) => getComputedStyle(row).display !== 'none');
+            const ys = rows.map((row) => row.getBoundingClientRect().y);
+            if (ys.some((y, i) => i > 0 && y <= ys[i - 1])) {
+                return null;
+            }
+
+            return rows.slice(0, 3).map((row) => JSON.parse(row.dataset.row).name.trim());
+        })()
+    JS);
+}
+
+it('sorts the top paths table when a column header is selected', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/analytics');
+
+    // Default: requests, largest first. The two smallest are on page 2.
+    $page->assertSee('/p12')
+        ->assertDontSee('/p01');
+    expect(visiblePathNames($page))->toBe(['/p12', '/p11', '/p10']);
+
+    // Path A to Z: the two last names are on page 2.
+    $page->click('#analytics-paths-section button[title="Sort by path"]')
+        ->assertSee('/p01')
+        ->assertDontSee('/p12');
+    expect(visiblePathNames($page))->toBe(['/p01', '/p02', '/p03']);
+
+    // A data refresh keeps the sort.
+    $page->click('button:visible:has-text("7 days")')
+        ->assertQueryStringHas('range', '7d')
+        ->assertSee('/p01');
+    expect(visiblePathNames($page))->toBe(['/p01', '/p02', '/p03']);
+
+    // A second click reverses the direction, and the pager follows the sort.
+    $page->click('#analytics-paths-section button[title="Sort by path"]')
+        ->assertSee('/p12')
+        ->assertDontSee('/p01')
+        ->click('#analytics-paths-section button:has-text("Next")')
+        ->assertSee('/p01')
+        ->assertDontSee('/p12')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'analytics-paths-sorted');
+});
diff --git a/tests/v4/Browser/TransferFinishChecklistTest.php b/tests/v4/Browser/TransferFinishChecklistTest.php
new file mode 100644
index 0000000000..2994c7b781
--- /dev/null
+++ b/tests/v4/Browser/TransferFinishChecklistTest.php
@@ -0,0 +1,50 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Team;
+use App\Services\ServerTransfer\TransferFinishChecklist;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    $this->stack = seedBrowserResourceStack();
+    $this->server = Server::create(['name' => 'transferred-web', 'ip' => '10.0.0.5', 'team_id' => 0, 'private_key_id' => 1]);
+    $this->server->forceFill(['uuid' => 'transferred-1'])->save();
+    createBrowserApplication([...$this->stack, 'destination' => $this->server->standaloneDockers()->first()], [
+        'name' => 'shop',
+        'build_pack' => 'nixpacks',
+        'git_repository' => 'https://github.com/acme/shop',
+    ]);
+    app(TransferFinishChecklist::class)->start($this->server);
+    app(TransferFinishChecklist::class)->markDone($this->server, 'server_connection:server');
+});
+
+it('shows the finish list on the server page and finishes it after a confirmation', function () {
+    Team::query()->update(['show_boarding' => false]);
+    Cache::flush();
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard');
+
+    $page->navigate('/server/transferred-1')
+        ->assertSee('Finish the transfer')
+        ->assertSee('Manual webhook of shop')
+        ->assertSee('1 step is OK or done')
+        ->screenshot(filename: 'transfer-finish-list');
+
+    $page->click('li:has-text("Manual webhook of shop") button:has-text("Details")')
+        ->wait(0.5)
+        ->assertSee('/webhooks/source/github/events/manual')
+        ->screenshot(filename: 'transfer-finish-details');
+
+    $page->click('button:visible:has-text("Finish with open steps")')
+        ->wait(1)
+        ->assertSee('Finish with open steps?')
+        ->assertSee('Skipped: Manual webhook of shop')
+        ->screenshot(filename: 'transfer-finish-confirm');
+});
diff --git a/tests/v4/Browser/UpgradeBadgeLayoutTest.php b/tests/v4/Browser/UpgradeBadgeLayoutTest.php
new file mode 100644
index 0000000000..361e4a097b
--- /dev/null
+++ b/tests/v4/Browser/UpgradeBadgeLayoutTest.php
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+it('keeps the update badge inside the sidebar brand area', function (string $version) {
+    config()->set('constants.coolify.version', $version);
+    seedBrowserResourceStack(['instanceSettings' => ['new_version_available' => true]]);
+    Cache::put('coolify:versions:all', ['coolify' => ['v4' => ['version' => '9.9.9']]], 3600);
+
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Dashboard')
+        ->assertVisible('header button[aria-label="Update available"]');
+
+    $layout = $page->script(<<<'JS'
+        () => {
+            const badge = document.querySelector('header button[aria-label="Update available"]');
+            const brand = badge.closest('header > div');
+
+            return {
+                badgeRight: badge.getBoundingClientRect().right,
+                brandRight: brand.getBoundingClientRect().right,
+                brandOverflows: brand.scrollWidth > brand.clientWidth,
+            };
+        }
+    JS);
+
+    $page->screenshot(filename: 'upgrade-badge-layout');
+
+    expect($layout['brandOverflows'])->toBeFalse()
+        ->and($layout['badgeRight'])->toBeLessThanOrEqual($layout['brandRight']);
+})->with(['4.3.19', '4.0.0-beta.470']);
diff --git a/versions.json b/versions.json
index 4165d6831e..7dc784d8e6 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.4.6"
+            "version": "4.5"
         },
         "nightly": {
-            "version": "4.5-rc.1"
+            "version": "4.6-rc.1"
         },
         "helper": {
             "version": "1.0.18"