Merge remote-tracking branch 'origin/main' into feat/services

.ai/lessons.md

@@ -0,0 +1,7 @@
+# Lessons
+
+## Alpine x-transition + tw-animate-css exit animations flash at the end
+- Symptom: a modal/overlay fades out, then flashes fully visible for 1-2 frames before it disappears.
+- Cause: `animate-out` keyframes default to `animation-fill-mode: none`. The element snaps back to its natural state when the keyframe ends. Alpine hides the element (display: none) only after its own timer (read from `transition-duration`), which starts ~2 rAF later than the animation. The gap shows the element at full opacity.
+- Rule: every `x-transition:leave` that uses tw-animate-css `animate-out` MUST also include `fill-mode-forwards`.
+- Rule: when a user reports UI flicker, check ALL layers of the animation stack (state reset timing, spinner flash, keyframe fill mode, focus restore) before you report the fix as complete. My first fix covered state reset and spinner only; the fill-mode snap was the visible one.

.env.development.example

@@ -3,12 +3,12 @@ APP_ENV=local
 APP_NAME=Coolify
 APP_ID=development
 APP_KEY=
-COOLIFY_FLUX_LARAVEL_API_TOKEN=development-flux-token
 APP_URL=http://localhost
 APP_PORT=8000
 APP_DEBUG=true
 SSH_MUX_ENABLED=true
 COOLIFY_CONTAINER_ROLE=all
+DEV_SENTINEL_URL=
 
 # PostgreSQL Database Configuration
 DB_DATABASE=coolify

.env.dusk.ci

@@ -2,7 +2,6 @@ APP_ENV=production
 APP_NAME="Coolify Staging"
 APP_ID=development
 APP_KEY=
-COOLIFY_FLUX_LARAVEL_API_TOKEN=test-flux-token
 APP_URL=http://localhost
 APP_PORT=8000
 SSH_MUX_ENABLED=true

.env.testing

@@ -1,6 +1,5 @@
 APP_ENV=testing
 APP_KEY=base64:8VEfVNVkXQ9mH2L33WBWNMF4eQ0BWD5CTzB8mIxcl+k=
-COOLIFY_FLUX_LARAVEL_API_TOKEN=test-flux-token
 APP_DEBUG=true
 
 DB_CONNECTION=testing

.github/ISSUE_TEMPLATE/01_BUG_REPORT.yml

@@ -8,6 +8,8 @@ body:
       value: |
         > [!IMPORTANT]
         > **Please ensure you are using the latest version of Coolify before submitting an issue, as the bug may have already been fixed in a recent update.** (Of course, if you're experiencing an issue on the latest version that wasn't present in a previous version, please let us know.)
+        >
+        > If you plan to submit a fix, branch from `main` and target `main` with your pull request.
 
   - type: textarea
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -7,12 +7,12 @@ contact_links:
 
   - name: 💡 Feature Request
     url: https://github.com/coollabsio/coolify/discussions/categories/feature-requests
-    about: Suggest a new feature for Coolify.
+    about: Suggest a new feature for Coolify. Feature code should branch from `next` and target `next`.
 
   - name: ⚙️ Service Request
     url: https://github.com/coollabsio/coolify/discussions/categories/service-requests
-    about: Request a new service integration for Coolify.
+    about: Request a new service integration for Coolify. Service code should branch from `next` and target `next`.
 
   - name: 🔧 Improvements
     url: https://github.com/coollabsio/coolify/discussions/categories/improvements
-    about: Suggest improvements to existing features for Coolify.
+    about: Suggest improvements to existing features. Small fixes should target `main`; larger changes should target `next`.

.github/pull_request_template.md

@@ -46,6 +46,6 @@
 
 > [!IMPORTANT]
 >
-> - [ ] I have read and understood the [contributor guidelines](https://github.com/coollabsio/coolify/blob/v4.x/CONTRIBUTING.md). If I have failed to follow any guideline, I understand that this PR may be closed without review.
+> - [ ] I have read and understood the [contributor guidelines](https://github.com/coollabsio/coolify/blob/HEAD/CONTRIBUTING.md). If I have failed to follow any guideline, I understand that this PR may be closed without review.
 > - [ ] I have searched [existing issues](https://github.com/coollabsio/coolify/issues) and [pull requests](https://github.com/coollabsio/coolify/pulls) (including closed ones) to ensure this isn't a duplicate.
 > - [ ] I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.

.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lock threads after 30 days of inactivity
-        uses: dessant/lock-threads@v5
+        uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: '30'

.github/workflows/chore-manage-pr-branch.yaml

@@ -0,0 +1,182 @@
+name: Manage PR Branch
+
+# Runs *after* the "PR Quality" workflow finishes. This is required because
+# PR Quality may close a PR that fails its checks, so we must wait for it to
+# complete before deciding whether to retarget the PR's base branch.
+on:
+  workflow_run:
+    workflows: ["PR Quality"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: manage-pr-branch-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  manage-branch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Retarget PR base branch based on category
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+
+            // Branch routing based on the "Category" section of the PR body.
+            // Bug fixes and one-click service changes ship in patch releases -> main.
+            // Everything else (features, improvements) -> next.
+            const MAIN_BRANCH = 'main';
+            const NEXT_BRANCH = 'next';
+
+            // Maintainers/collaborators are trusted to pick their own base branch.
+            const EXEMPT_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+
+            // Resolve the open PR from the triggering run.
+            //
+            // PR Quality runs on `pull_request_target`, so `run.head_sha` is the
+            // *base* branch tip, not the PR head — a commit-based lookup finds
+            // nothing. Instead match on the source branch (`head_branch`) and its
+            // owner (`head_repository.owner.login`), which uniquely identify the PR
+            // via the `owner:branch` head filter. This also works for forked PRs,
+            // where `workflow_run.pull_requests` is empty.
+            const headOwner = run.head_repository?.owner?.login;
+            const headBranch = run.head_branch;
+
+            let prRef;
+            if (headOwner && headBranch) {
+              const { data: openPrs } = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                head: `${headOwner}:${headBranch}`,
+                per_page: 100,
+              });
+              prRef = openPrs[0];
+            }
+
+            // Fallback: same-repo PRs may also be resolvable by commit association.
+            if (!prRef) {
+              const { data: associated } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: run.head_sha,
+              });
+              prRef = associated.find(pr => pr.state === 'open');
+            }
+
+            if (!prRef) {
+              core.info('No open PR associated with this run (possibly closed by PR Quality). Skipping.');
+              return;
+            }
+
+            // Fetch the full PR to get an up-to-date body, base ref, and state.
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prRef.number,
+            });
+
+            if (pr.state !== 'open') {
+              core.info(`PR #${pr.number} is not open. Skipping.`);
+              return;
+            }
+
+            // Skip PRs opened by owners/members/collaborators — they choose their own base.
+            if (EXEMPT_ASSOCIATIONS.has(pr.author_association)) {
+              core.info(`PR #${pr.number} author association is ${pr.author_association}. Skipping.`);
+              return;
+            }
+
+            // Skip if a maintainer has already changed the base branch manually.
+            const timeline = await github.paginate(github.rest.issues.listEventsForTimeline, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              per_page: 100,
+            });
+
+            const baseChanges = timeline.filter(e => e.event === 'base_ref_changed');
+            for (const change of baseChanges) {
+              const actor = change.actor?.login;
+              if (!actor) {
+                continue;
+              }
+              try {
+                const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username: actor,
+                });
+                // admin/maintain/write => trusted maintainer.
+                if (['admin', 'maintain', 'write'].includes(perm.permission)) {
+                  core.info(`Base branch was changed manually by ${actor} (${perm.permission}). Skipping.`);
+                  return;
+                }
+              } catch (error) {
+                core.info(`Could not resolve permission for ${actor}: ${error.message}`);
+              }
+            }
+
+            // Parse the checked category checkboxes from the PR body.
+            const body = pr.body ?? '';
+            const checked = [];
+            const checkboxRegex = /^\s*-\s*\[([ xX])\]\s*(.+?)\s*$/gm;
+            let match;
+            while ((match = checkboxRegex.exec(body)) !== null) {
+              if (match[1].toLowerCase() === 'x') {
+                checked.push(match[2].toLowerCase());
+              }
+            }
+
+            const includesAny = (labels) => labels.some(label => checked.some(c => c.includes(label)));
+
+            const mainCategories = ['bug fix', 'adding new one click service', 'fixing or updating existing one click service'];
+            const nextCategories = ['improvement', 'new feature'];
+
+            const wantsMain = includesAny(mainCategories);
+            const wantsNext = includesAny(nextCategories);
+
+            if (!wantsMain && !wantsNext) {
+              core.info('No category selected in the PR body. Skipping.');
+              return;
+            }
+
+            // If categories from both groups are checked, prefer next: features and
+            // improvements can only be released from the development branch.
+            const targetBranch = wantsNext ? NEXT_BRANCH : MAIN_BRANCH;
+
+            if (pr.base.ref === targetBranch) {
+              core.info(`PR #${pr.number} already targets ${targetBranch}. Nothing to do.`);
+              return;
+            }
+
+            const previousBranch = pr.base.ref;
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              base: targetBranch,
+            });
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              body: [
+                `Based on the selected category, this PR's base branch was automatically changed from \`${previousBranch}\` to \`${targetBranch}\`.`,
+                '',
+                targetBranch === MAIN_BRANCH
+                  ? 'Bug fixes and one-click service changes target `main`.'
+                  : 'New features and improvements target `next`.',
+                '',
+                'If you believe this is incorrect, please let a maintainer know.',
+              ].join('\n'),
+            });
+
+            core.info(`Retargeted PR #${pr.number}: ${previousBranch} -> ${targetBranch}.`);

.github/workflows/coolify-helper.yml

@@ -2,7 +2,7 @@ name: Coolify Helper Image
 
 on:
   push:
-    branches: [ "v4.x", "main" ]
+    branches: [ "main" ]
     paths:
       - .github/workflows/coolify-helper.yml
       - docker/coolify-helper/Dockerfile
@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-helper"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include:
@@ -113,4 +158,3 @@ jobs:
         if: always()
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL  }}
-

.github/workflows/coolify-realtime.yml

@@ -2,7 +2,7 @@ name: Coolify Realtime
 
 on:
   push:
-    branches: [ "v4.x", "main" ]
+    branches: [ "main" ]
     paths:
       - .github/workflows/coolify-realtime.yml
       - docker/coolify-realtime/**
@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-realtime"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include:

.github/workflows/coolify-release.yml

@@ -1,12 +1,19 @@
-name: Release Coolify
+name: Release Coolify Stable
+run-name: ${{ inputs.tag }}
 
 on:
-  release:
-    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing draft release tag (for example, v4.3.1)
+        required: true
+        type: string
 
-permissions:
-  contents: read
-  packages: write
+permissions: {}
+
+concurrency:
+  group: coolify-fix-release
+  cancel-in-progress: false
 
 env:
   GITHUB_REGISTRY: ghcr.io
@@ -14,14 +21,116 @@ env:
   IMAGE_NAME: coollabsio/coolify
 
 jobs:
-  promote-image:
+  validate:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    outputs:
+      release_id: ${{ steps.draft.outputs.release_id }}
+      version: ${{ steps.version.outputs.version }}
     steps:
+      - name: Reject releases outside the production branch
+        if: ${{ github.ref_name != 'main' }}
+        run: |
+          echo "Stable releases must run from main, not ${{ github.ref_name }}."
+          exit 1
+
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ github.event.release.tag_name }}
+
+      - name: Validate version
+        id: version
+        env:
+          TAG_NAME: ${{ inputs.tag }}
+        run: |
+          if [[ ! "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Unsupported fix release tag: ${TAG_NAME}"
+            exit 1
+          fi
+
+          VERSION="${TAG_NAME#v}"
+          CONFIG_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
+
+          if [[ "${CONFIG_VERSION}" != "${VERSION}" ]]; then
+            echo "Release tag ${VERSION} does not match config version ${CONFIG_VERSION}."
+            exit 1
+          fi
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate and pin draft release
+        id: draft
+        uses: actions/github-script@v8
+        env:
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              per_page: 100,
+            });
+            const release = releases.find((candidate) => candidate.tag_name === process.env.TAG_NAME);
+
+            if (!release) {
+              core.setFailed(`Create a draft release for ${process.env.TAG_NAME} before running this workflow.`);
+              return;
+            }
+            if (!release.draft) {
+              core.setFailed(`Release ${process.env.TAG_NAME} must still be a draft.`);
+              return;
+            }
+            if (release.prerelease) {
+              core.setFailed(`Fix release ${process.env.TAG_NAME} cannot be marked as a prerelease.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} must contain reviewed release notes.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} already exists.`);
+              return;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: release.id,
+              tag_name: process.env.TAG_NAME,
+              target_commitish: context.sha,
+            });
+            core.setOutput('release_id', release.id);
+
+  build:
+    needs: validate
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            platform: linux/aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 
@@ -39,69 +148,112 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Resolve release image
-        id: release
-        env:
-          TAG_NAME: ${{ github.event.release.tag_name }}
-        run: |
-          if [[ ! "${TAG_NAME}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
-            echo "Unsupported release tag: ${TAG_NAME}"
-            exit 1
-          fi
-
-          VERSION="${TAG_NAME#v}"
-          RELEASE_SHA=$(git rev-list -n 1 "${TAG_NAME}")
-          CONFIG_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
-
-          if [[ "${CONFIG_VERSION}" != "${VERSION}" ]]; then
-            echo "Release tag ${VERSION} does not match config version ${CONFIG_VERSION}."
-            exit 1
-          fi
-
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "sha=${RELEASE_SHA}" >> "$GITHUB_OUTPUT"
-
-      - name: Promote version on ${{ env.GITHUB_REGISTRY }}
-        env:
-          REGISTRY: ${{ env.GITHUB_REGISTRY }}
-          VERSION: ${{ steps.release.outputs.version }}
-          RELEASE_SHA: ${{ steps.release.outputs.sha }}
-        run: |
-          IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          SOURCE_TAG="sha-${RELEASE_SHA}"
-          docker buildx imagetools create "${IMAGE}:${SOURCE_TAG}" --tag "${IMAGE}:${VERSION}"
-
-      - name: Promote version on ${{ env.DOCKER_REGISTRY }}
-        env:
-          REGISTRY: ${{ env.DOCKER_REGISTRY }}
-          VERSION: ${{ steps.release.outputs.version }}
-          RELEASE_SHA: ${{ steps.release.outputs.sha }}
-        run: |
-          IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          SOURCE_TAG="sha-${RELEASE_SHA}"
-          docker buildx imagetools create "${IMAGE}:${SOURCE_TAG}" --tag "${IMAGE}:${VERSION}"
-
-      - name: Promote latest on ${{ env.GITHUB_REGISTRY }}
-        if: ${{ ! github.event.release.prerelease }}
-        env:
-          REGISTRY: ${{ env.GITHUB_REGISTRY }}
-          RELEASE_SHA: ${{ steps.release.outputs.sha }}
-        run: |
-          IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          SOURCE_TAG="sha-${RELEASE_SHA}"
-          docker buildx imagetools create "${IMAGE}:${SOURCE_TAG}" --tag "${IMAGE}:latest"
-
-      - name: Promote latest on ${{ env.DOCKER_REGISTRY }}
-        if: ${{ ! github.event.release.prerelease }}
-        env:
-          REGISTRY: ${{ env.DOCKER_REGISTRY }}
-          RELEASE_SHA: ${{ steps.release.outputs.sha }}
-        run: |
-          IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          SOURCE_TAG="sha-${RELEASE_SHA}"
-          docker buildx imagetools create "${IMAGE}:${SOURCE_TAG}" --tag "${IMAGE}:latest"
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
+      - name: Build and push release image (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
         with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL }}
+          context: .
+          file: docker/production/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            COOLIFY_VERSION=${{ needs.validate.outputs.version }}
+          tags: |
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}
+
+  publish:
+    needs: [validate, build]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Publish version and latest on ${{ env.GITHUB_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.GITHUB_REGISTRY }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="release-${VERSION}-${GITHUB_SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:latest"
+
+      - name: Publish version and latest on ${{ env.DOCKER_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.DOCKER_REGISTRY }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="release-${VERSION}-${GITHUB_SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:latest"
+
+      - name: Publish reviewed draft release
+        uses: actions/github-script@v8
+        env:
+          RELEASE_ID: ${{ needs.validate.outputs.release_id }}
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releaseId = Number(process.env.RELEASE_ID);
+            const { data: release } = await github.rest.repos.getRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: releaseId,
+            });
+
+            if (release.tag_name !== process.env.TAG_NAME || !release.draft || release.prerelease) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} changed while the images were building.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} no longer contains release notes.`);
+              return;
+            }
+            if (release.target_commitish !== context.sha) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} no longer targets ${context.sha}.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} was created while the images were building.`);
+              return;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: Number(process.env.RELEASE_ID),
+              tag_name: process.env.TAG_NAME,
+              target_commitish: context.sha,
+              draft: false,
+            });

.github/workflows/coolify-sha-build.yml

@@ -2,7 +2,7 @@ name: Build Coolify (SHA)
 
 on:
   push:
-    branches: ["v4.x", "main"]
+    branches: ["main"]
 
 permissions:
   contents: read
@@ -15,6 +15,8 @@ env:
 
 jobs:
   build-push:
+    outputs:
+      short_sha: ${{ steps.version.outputs.short_sha }}
     strategy:
       matrix:
         include:
@@ -30,6 +32,13 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Resolve internal version
+        id: version
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
+          echo "version=${BASE_VERSION}-dev.${GITHUB_SHA::9}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
         with:
@@ -51,9 +60,11 @@ jobs:
           file: docker/production/Dockerfile
           platforms: ${{ matrix.platform }}
           push: true
+          build-args: |
+            COOLIFY_VERSION=${{ steps.version.outputs.version }}
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}-${{ matrix.arch }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}-${{ matrix.arch }}
 
   merge-manifest:
     runs-on: ubuntu-24.04
@@ -78,33 +89,21 @@ jobs:
       - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
         env:
           REGISTRY: ${{ env.GITHUB_REGISTRY }}
-          BRANCH: ${{ github.ref_name }}
-          SHA: ${{ github.sha }}
+          SHA: ${{ needs.build-push.outputs.short_sha }}
         run: |
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          TAG_ARGS=(--tag "${IMAGE}:sha-${SHA}")
-          # Moving tag for the latest production-line SHA image (v4.x only).
-          if [ "${BRANCH}" = "v4.x" ]; then
-            TAG_ARGS+=(--tag "${IMAGE}:edge")
-          fi
           docker buildx imagetools create \
             "${IMAGE}:sha-${SHA}-amd64" \
             "${IMAGE}:sha-${SHA}-aarch64" \
-            "${TAG_ARGS[@]}"
+            --tag "${IMAGE}:sha-${SHA}"
 
       - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
         env:
           REGISTRY: ${{ env.DOCKER_REGISTRY }}
-          BRANCH: ${{ github.ref_name }}
-          SHA: ${{ github.sha }}
+          SHA: ${{ needs.build-push.outputs.short_sha }}
         run: |
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          TAG_ARGS=(--tag "${IMAGE}:sha-${SHA}")
-          # Moving tag for the latest production-line SHA image (v4.x only).
-          if [ "${BRANCH}" = "v4.x" ]; then
-            TAG_ARGS+=(--tag "${IMAGE}:edge")
-          fi
           docker buildx imagetools create \
             "${IMAGE}:sha-${SHA}-amd64" \
             "${IMAGE}:sha-${SHA}-aarch64" \
-            "${TAG_ARGS[@]}"
+            --tag "${IMAGE}:sha-${SHA}"

.github/workflows/coolify-staging-build.yml

@@ -3,7 +3,6 @@ name: Staging Build
 on:
   push:
     branches-ignore:
-      - v4.x
       - main
       - v3.x
       - '**v5.x**'

.github/workflows/generate-changelog.yml

@@ -2,7 +2,7 @@ name: Generate Changelog
 
 on:
   push:
-    branches: [ v4.x, main ]
+    branches: [ main ]
     paths-ignore:
       - .github/workflows/coolify-helper.yml
       - .github/workflows/coolify-helper-next.yml

.github/workflows/pr-quality.yaml

@@ -19,13 +19,10 @@ jobs:
           max-failures: 4
 
           # PR Branch Checks
-          allowed-target-branches: "next"
+          allowed-target-branches: ""
           blocked-target-branches: ""
           allowed-source-branches: ""
-          blocked-source-branches: |
-            main
-            master
-            v4.x
+          blocked-source-branches: ""
 
           # PR Quality Checks
           max-negative-reactions: 0

AGENTS.md

@@ -16,8 +16,8 @@ Docker Compose-based dev setup with services: coolify (app), postgres, redis, so
 
 ```bash
 # Start dev environment (uses docker-compose.dev.yml)
-spin up                          # or: docker compose -f docker-compose.dev.yml up -d
-spin down                        # stop services
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+docker compose -f docker-compose.yml -f docker-compose.dev.yml down                        # stop services
 
 # Two local Coolify instances (isolated stacks; server transfer / multi-control-plane)
 ./scripts/dev-instances up                   # a:8000 + b:8001 (uses npm run build for CSS/JS)
@@ -30,6 +30,25 @@ spin down                        # stop services
 
 The app runs at `localhost:8000` by default. Instance **b** is on `8001` (db `5433`, redis `6380`, …); see `./scripts/dev-instances`.
 
+## Testing the Self-Hosted Upgrade Process
+
+Use the following workflow to test a self-hosted upgrade:
+
+1. Install the source version with the upgrade script:
+
+   ```bash
+   bash upgrade.sh sha-6492d081362c009519481ac70e50873e39ba1861
+   ```
+
+2. Set the current Coolify version and rebuild the cached configuration:
+
+   ```bash
+   docker exec -e COOLIFY_VERSION=4.3.0 coolify php artisan config:cache
+   ```
+
+3. In the Coolify UI, click **Check for Updates**.
+4. Confirm that an upgrade is available, then click **Upgrade** and verify that the upgrade completes successfully.
+
 ## Common Commands
 
 ```bash
@@ -122,6 +141,23 @@ function loginAsRoot(): mixed
 - **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
 - **Proxy** — Traefik reverse proxy managed per server.
 
+### Instance sentinels (`id = 0`)
+
+Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentinel meaning “this is the Coolify instance itself”, not a normal autoincrement id. Do not migrate, resequence, or “fix” these to a positive id.
+
+| Record | Model / lookup | Meaning |
+|---|---|---|
+| Root team | `Team::find(0)`, `team_id === 0` | Instance / root team. Cloud billing and many skip-checks exempt `team_id === 0`. |
+| Localhost server | `Server::find(0)` / `findOrFail(0)` | The machine running Coolify. Upgrades, instance backups, and docker inspect target this server. |
+| Instance settings | `InstanceSettings` with `id = 0` | Singleton settings row. Tests must seed `InstanceSettings::create(['id' => 0])` (or `forceCreate`). |
+| Instance Postgres | `StandalonePostgresql` `id = 0`, name `coolify-db` | Coolify’s own database. UI treats `database_id === 0` as the instance DB (e.g. hide delete on backup screens). |
+| Local docker dest | `StandaloneDocker` `id = 0` | Destination on the localhost server (`destination_id = 0`). |
+| Root user / default GitHub App | seeders | First-install defaults. |
+
+**Do not assign `id = 0` to new or non-instance rows.** In particular, `ScheduledDatabaseBackup` and `ScheduledTask` are ordinary schedules. Legacy installs may still have a `coolify-db` backup at `id = 0`; resolve that backup via the `coolify-db` relation / uuid, not `ScheduledDatabaseBackup::find(0)`.
+
+`0` is a PHP/Eloquent landmine (`empty(0)` is true; keyset pagination `where('id', '>', $cursor)` starting at `0` skips the row). Queries that page by id must include `id = 0` on the first page (no lower bound, or cursor `< 0`). Prefer `chunkById()` over a hand-rolled `id > 0` cursor.
+
 ### Frontend
 - Livewire 3 components with Alpine.js for client-side interactivity
 - Blade templates in `resources/views/livewire/`
@@ -146,9 +182,9 @@ function loginAsRoot(): mixed
 
 ## Git Workflow
 
-- Main branch: `v4.x`
+- Production branch: `main`
 - Development branch: `next`
-- PRs should target `v4.x`
+- Fix PRs should target the current production branch; feature PRs should target `next`
 
 <laravel-boost-guidelines>
 === foundation rules ===

CONTRIBUTING.md

@@ -32,9 +32,7 @@ Coolify is currently at v4. While v4 is stable, it has some limitations, includi
 - A more complex user experience
 - Other smaller issues that need refinement
 
-These limitations will be addressed in Coolify v5, which is in the planning stage. Because of this, major features, architectural changes, or significant UI changes will not be accepted for v4 at this stage.
-
-We welcome contributions that help stabilize v4 for a bug free experience.
+These limitations will be addressed over time. Fixes and small improvements are accepted on the production line. New features and larger changes require prior discussion and must go through the development line.
 
 
 ## What Makes a Strong Contribution
@@ -188,8 +186,19 @@ If maintainers cannot reproduce working behavior, the PR will be closed without
 - GitHub will auto-populate the PR template
 - The contributor agreement in PR description must remain intact
 - Pull requests without the contributor agreement will be closed
-- All pull requests must target the `next` branch
-- PRs targeting other branches will be closed without review
+
+Choose the branch based on the type of change:
+
+| Change | Start from | Pull request target |
+| --- | --- | --- |
+| Fixes and small improvements | `main` | `main` |
+| Security fixes | `main` | `main` |
+| New features and larger changes | `next` | `next` |
+
+- For a fix, branch from `main` and target `main`.
+- For a feature, branch from `next` and target `next`.
+- If a fix is discovered while developing a feature, submit it separately to `main`. Maintainers will merge `main` into `next` so the fix is included there too.
+- Pull requests targeting the wrong branch may be closed or asked to retarget.
 
 
 ## FAQ

DESIGN.md

@@ -154,6 +154,21 @@ topbar instead of repeating its name or status summary in layer 2. Mobile
 resource navigation may repeat this context because the desktop global topbar
 is hidden there.
 
+Desktop resource lifecycle actions dock in `#resource-action-hud-slot` and
+use `<x-resource-heading-overflow>`. Show primary actions (Deploy, Redeploy,
+Restart, Stop) as sibling header buttons. Collapse that group into an Actions
+dropdown only when the remaining top-bar width cannot fit them (breadcrumb
+keeps a 200px floor). Infrequent operations live in a separate Advanced
+dropdown with the grid icon: force restart / force deploy / force cleanup
+on services, and Traefik dashboard / refresh proxy status on servers. Place
+Advanced immediately after Links, or first in the action cluster when there
+is no Links control. Application Deploy is a dropdown with Deploy and
+Deploy (without cache). A running service Restart control is a dropdown with
+Restart current version and Pull latest and restart. Mobile
+headings keep a full-width Actions dropdown because the desktop HUD is hidden
+below `xl`. Do not hide primary actions behind a menu on a wide desktop. Links
+stay a separate dropdown because the URL list is unbounded.
+
 Only add layer-2 tabs when they represent real sibling routes inside one
 context. Never repeat main-sidebar destinations such as Dashboard, Projects,
 Terminal, Servers, Sources, Destinations, or Storage as a second tab row. A
@@ -162,6 +177,14 @@ primary action in the page header instead. When tabs are useful, their left edge
 uses the same compact `pl-2` alignment as application navigation rather than
 the content container's wide horizontal padding.
 
+A layer-2 tab must be active on the page that renders it. A bar whose only tab
+points at a different route reads as broken navigation, so project and
+environment pages (`project.show`, `project.edit`, `project.environment.edit`,
+`project.clone-me`) carry a plain page header with a 24px title and a 13px
+muted summary instead of a bar. The environment identity and the way back to
+its resources already live in `x-top-breadcrumb`; do not restate them in a
+sub-header.
+
 The dashboard is a compact overview, not a metrics wall. Use two full-width
 sections that follow the projects-page grid pattern: projects first, then
 servers. Keep one `New` action in the page header and let its modal choose the
@@ -399,6 +422,34 @@ do not create an unnecessarily wide menu.
 Toolbar filter and sort buttons keep static labels (`Filter`, `Sort`). The
 selected option is indicated inside the menu, not repeated on the trigger.
 
+#### Livewire dropdown state synchronization
+
+Instant-save listboxes must not flash back to an older value while Livewire is
+saving or morphing the DOM. Treat the Alpine selection as the current visual
+state until its request finishes:
+
+- await the Livewire change handler and prevent overlapping selections while
+  it is running;
+- when a client-managed listbox can be rerendered by an unrelated or stale
+  Livewire response, use the listbox's `preserveValue` option so the morph does
+  not replace its newer Alpine value;
+- scope `preserveValue` to controls whose value is owned by that interaction;
+  do not use it when external server events must replace the displayed value;
+- after saving through a related model, refresh the parent component's loaded
+  relationship before rendering the response. A database write alone does not
+  update an already-loaded Eloquent collection;
+- use stable `wire:key` values for rows containing listboxes. Do not include the
+  selected value in the key, because recreating the Alpine component causes a
+  visible reset;
+- remember that a portalled options panel is teleported outside its visual
+  wrapper. Guard selection in the Alpine handler itself rather than relying
+  only on `pointer-events` or a disabled wrapper.
+
+The failure mode to avoid is: selection B is shown optimistically, selection A
+is chosen next, the response for B morphs the listbox back to B, then the later
+response finally shows A. The control should remain on the newest accepted
+selection throughout the save sequence.
+
 #### Multi-select filter dropdowns
 
 Toolbar filters that can combine criteria use one multi-select listbox rather
@@ -591,6 +642,16 @@ Application and server browser terminals use the same browser-oriented console
 shell, theme picker, compact header controls, and outline `browser-terminal`
 Reicon. Hide a container switcher when only one container exists.
 
+The themed console shell belongs to an open session. Before a target is
+selected, the global Terminal page stays a normal top-level destination: a
+full-width layer card titled `Start a terminal session`, its filter input in
+the card header actions, and grouped `Servers` / `Containers` rows reusing the
+command-palette row classes. Do not render an empty full-height console canvas
+just to host the target picker, and do not offer the console theme selector
+before a session owns that canvas. Rows show the target name, a muted server
+column that only appears when the team has more than one server, and the shared
+chevron. Group headers stick to the top of the scrolling list and carry a count.
+
 ### Logs
 
 Runtime and deployment logs should feel like a clean terminal surface:

DEVELOPMENT.md

@@ -34,8 +34,6 @@ Follow the steps below for your operating system:
      - Download and install [Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/?ref=coolify)
      - Ensure WSL2 backend is enabled in Docker Desktop settings
 
-2. Install Spin:
-   - Follow the instructions to install Spin on Windows from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-windows#download-and-install-spin-into-wsl2?ref=coolify)
 
 </details>
 
@@ -48,8 +46,6 @@ Follow the steps below for your operating system:
    - Docker Desktop:
      - Download and install [Docker Desktop for Mac](https://docs.docker.com/desktop/install/mac-install/?ref=coolify)
 
-2. Install Spin:
-   - Follow the instructions to install Spin on MacOS from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-macos/#download-and-install-spin?ref=coolify)
 
 </details>
 
@@ -62,22 +58,20 @@ Follow the steps below for your operating system:
    - Docker Desktop:
      - If you want a GUI, you can use [Docker Desktop for Linux](https://docs.docker.com/desktop/install/linux-install/?ref=coolify)
 
-2. Install Spin:
-   - Follow the instructions to install Spin on Linux from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-linux#configure-docker-permissions?ref=coolify)
 
 </details>
 
 
 ## 2. Verify Installation (Optional)
-After installing Docker (or Orbstack) and Spin, verify the installation:
+After installing Docker (or Orbstack), verify the installation:
 
 1. Open a terminal or command prompt
 2. Run the following commands:
    ```bash
    docker --version
-   spin --version
+   docker compose version
    ```
-   You should see version information for both Docker and Spin.
+   You should see version information for Docker and Docker Compose.
 
 
 ## 3. Fork and Setup Local Repository
@@ -105,7 +99,7 @@ After installing Docker (or Orbstack) and Spin, verify the installation:
 1. In the Code Editor, locate the `.env.development.example` file in the root directory of your local Coolify repository.
 2. Duplicate the `.env.development.example` file and rename the copy to `.env`.
 3. Open the new `.env` file and review its contents. Adjust any environment variables as needed for your development setup.
-4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `spin up`.
+4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `docker compose -f docker-compose.yml -f docker-compose.dev.yml up`.
 5. Save the changes to your `.env` file.
 
 
@@ -113,7 +107,7 @@ After installing Docker (or Orbstack) and Spin, verify the installation:
 1. Open a terminal in the local Coolify directory.
 2. Run the following command in the terminal (leave that terminal open):
    ```bash
-   spin up
+   docker compose -f docker-compose.yml -f docker-compose.dev.yml up
    ```
 
 > [!NOTE]
@@ -121,11 +115,11 @@ After installing Docker (or Orbstack) and Spin, verify the installation:
 
 3. If you encounter permission errors, especially on macOS, use:
    ```bash
-   sudo spin up
+   sudo docker compose -f docker-compose.yml -f docker-compose.dev.yml up
    ```
 
 > [!NOTE]
-> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `spin up` again.
+> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `docker compose -f docker-compose.yml -f docker-compose.dev.yml up` again.
 
 
 ## 6. Start Development
@@ -196,7 +190,7 @@ If you encounter issues or break your database or something else, follow these s
 
 5. Start Coolify again:
    ```bash
-   spin up
+   docker compose -f docker-compose.yml -f docker-compose.dev.yml up
    ```
 
 6. Run database migrations and seeders:

RELEASE.md

@@ -1,184 +1,74 @@
 # Coolify Release Guide
 
-This guide outlines the release process for Coolify, intended for developers and those interested in understanding how Coolify releases are managed and deployed.
+## Branches
 
-## Table of Contents
-- [Branch Strategy](#branch-strategy)
-- [Release Process](#release-process)
-- [Version Types](#version-types)
-  - [Stable](#stable)
-  - [Nightly](#nightly)
-  - [Beta](#beta)
-- [Version Availability](#version-availability)
-  - [Self-Hosted](#self-hosted)
-  - [Cloud](#cloud)
-- [Manually Update to Specific Versions](#manually-update-to-specific-versions)
+| Branch | Purpose |
+| --- | --- |
+| `main` | Latest production source |
+| `next` | Feature integration and RC releases |
+| `feature/*` | New features based on and merged into `next` |
+| `hotfix/X.Y.Z` | Production fixes based on `main` |
 
-## Branch Strategy
+Release workflows never edit or commit versions. Set the intended version in `config/constants.php` before running a release workflow.
 
-Coolify uses two long-lived branches so production fixes can ship without waiting on unfinished feature work.
+## Where changes go
 
-| Branch | Role | Docker image tags | How it ships |
-| --- | --- | --- | --- |
-| **`v4.x`** | Production / releasable line | `sha-<commit>` and moving `edge` via **Build Coolify (SHA)** | GitHub release promotes the SHA image to a semantic version (and `latest` for stable releases) |
-| **`next`** | Development line for features and larger changes | Branch tag (for example `next`) via **Staging Build** | Becomes production only after merge into `v4.x` |
+- Fixes, security updates, and small improvements target `main`.
+- New features and larger changes target `next`.
+- Merge `main` into `next` regularly so every production fix is included in the next release.
+- Do not merge `next` into `main` until an RC is approved for a stable release.
 
-### Where to merge
+## Feature and RC flow
 
-- **Fixes and release-ready patches** → open PRs against **`v4.x`**. This is the fast path for patch releases.
-- **Features, refactors, and experimental work** → open PRs against **`next`** (or a feature branch that targets `next`).
-- **Shipping features to production** → merge `next` into `v4.x` when the feature set is ready for a stable (or beta) release. Prefer a deliberate merge, not ad-hoc cherry-picks of large feature stacks.
-
-### Keeping the branches in sync
-
-- After each fix lands on `v4.x` (and after each production release), **merge `v4.x` back into `next`** so fixes are not lost and `next` does not reintroduce already-shipped bugs.
-- When `next` has unfinished work and you need a hotfix, **open a small PR to `v4.x`** or **cherry-pick the fix commit** onto `v4.x`. Do not merge half-finished feature work from `next` just to ship a fix.
-- Treat **database migrations and irreversible data changes** carefully when the branches diverge. Prefer minimal, forward-compatible migrations on the fix path.
-
-### Mental model
-
-```
-next  ── features, refactors, experiments ──► (when ready) merge into v4.x
-  ▲
-  │  regularly merge fixes back
-  │
-v4.x ── fixes / release prep ──► Build Coolify (SHA) ──► Release Coolify ──► CDN
+```text
+feature/* → next → RC
 ```
 
-Only commits on **`v4.x`** produce production SHA images and can be tagged for a GitHub release.
+1. Merge feature branches into `next`.
+2. Set the intended RC version on `next`, such as `4.4-rc.1`.
+3. Regular builds publish `sha-<commit>`, `4.4-rc.1.<short-sha>`, and the moving `next` tag.
+4. Create a reviewed draft GitHub Release named `v4.4-rc.1` and mark it as a prerelease.
+5. Run the RC workflow from `next`. It publishes `4.4-rc.1`, updates `next`, and publishes the draft.
+6. Advance `next` to the next intended RC version.
 
-## Release Process
+## Stable release flow
 
-1. **Prepare the Release**
-   - Land the work on **`v4.x`**: merge a fix PR into `v4.x`, or merge ready work from `next` into `v4.x` for a feature release.
-   - Set the release version in `config/constants.php` and `versions.json` on the commit you will tag. Both values must match the planned Git tag without the `v` prefix (for example, `4.2.0` for tag `v4.2.0`).
-   - Verify the changelog and required tests before merging.
-   - After the release (or after the fix merges), merge `v4.x` back into `next` if those branches have diverged.
-
-2. **Build the Release Commit**
-   - Merge the release commit into `v4.x` through a pull request.
-   - The `Build Coolify (SHA)` workflow builds AMD64 and ARM64 images and publishes them to Docker Hub and GHCR using immutable architecture tags.
-   - After both builds complete, the workflow creates the multi-architecture `sha-<commit-sha>` manifest in both registries.
-   - For pushes to **`v4.x`**, the same multi-architecture manifest is also tagged as `edge`, so `coollabsio/coolify:edge` always points at the latest production-line SHA image. Builds from `main` publish only the immutable `sha-<commit-sha>` tags.
-   - This workflow does not update a semantic version tag or `latest`.
-
-3. **Wait for the SHA Image**
-   - Confirm the complete `Build Coolify (SHA)` workflow, including its `merge-manifest` job, succeeded.
-   - Do not publish the release before the multi-architecture SHA image exists in both registries.
-
-4. **Create and Publish the GitHub Release**
-   - Create a GitHub release with a semantic version tag such as `v4.2.0`, targeting the exact commit that produced the SHA image.
-   - Mark beta or other test releases as prereleases. Publish production versions as stable releases.
-   - Publishing the release starts the `Release Coolify` workflow. It verifies that the Git tag matches `config/constants.php`, then promotes the existing SHA image without rebuilding it.
-   - The workflow assigns the semantic version tag in Docker Hub and GHCR. Stable releases also update `latest`; prereleases do not.
-
-5. **Verify the Promotion**
-   - Confirm the `Release Coolify` workflow succeeded.
-   - Verify the semantic version image has the same manifest digest as `sha-<commit-sha>` in Docker Hub and GHCR.
-   - For stable releases, also verify `latest` points to the promoted release manifest.
-
-6. **Update the CDN**
-   - To make a new version available to self-hosted instances, update the version information on the CDN manually.
-   - Confirm the new version is available at [https://cdn.coollabs.io/coolify/versions.json](https://cdn.coollabs.io/coolify/versions.json).
-
-> [!NOTE]
-> The CDN update may not occur immediately after the GitHub release. It can take hours or even days due to additional testing, stability checks, or potential hotfixes. **The update becomes available only after the CDN is updated. After the CDN is updated, a discord announcement will be made in the Production Release channel.**
-
-## Version Types
-
-<details>
-  <summary><strong>Stable</strong></summary>
-
-- **Stable**
-  - The production version suitable for stable, production environments (recommended).
-  - **Update Frequency:** Every 2 to 4 weeks, with more frequent possible fixes.
-  - **Release Size:** Larger but less frequent releases. Multiple nightly versions are consolidated into a single stable release.
-  - **Versioning Scheme:** Follows semantic versioning (e.g., `v4.0.0`, `4.1.0`, etc.).
-  - **Installation Command:**
-    ```bash
-    curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
-    ```
-
-</details>
-
-<details>
-  <summary><strong>Nightly</strong></summary>
-
-- **Nightly**
-  - The latest development version, suitable for testing the latest changes and experimenting with new features.
-  - **Update Frequency:** Daily or bi-weekly updates.
-  - **Release Size:** Smaller, more frequent releases.
-  - **Versioning Scheme:** Follows semantic versioning (e.g., `4.1.0-nightly.1`, `4.1.0-nightly.2`, etc.).
-  - **Installation Command:**
-    ```bash
-    curl -fsSL https://cdn.coollabs.io/coolify-nightly/install.sh | bash -s next
-    ```
-
-</details>
-
-<details>
-  <summary><strong>Beta</strong></summary>
-
-- **Beta**
-  - Test releases for the upcoming stable version.
-  - **Purpose:** Allows users to test and provide feedback on new features and changes before they become stable.
-  - **Update Frequency:** Available if we think beta testing is necessary.
-  - **Release Size:** Same size as stable release as it will become the next stable release after some time.
-  - **Versioning Scheme:** Follows semantic versioning (e.g., `4.1.0-beta.1`, `4.1.0-beta.2`, etc.).
-  - **Installation Command:**
-  ```bash
-    curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
-  ```
-
-</details>
-
-> [!WARNING]
-> Do not use nightly/beta builds in production as there is no guarantee of stability.
-
-## Version Availability
-
-When a new version is released and a new GitHub release is created, it doesn't immediately become available for your instance. Here's how version availability works for different instance types.
-
-### Self-Hosted
-
-- **Update Frequency:** More frequent updates, especially on the nightly release channel.
-- **Update Availability:** New versions are available once the CDN has been updated.
-- **Update Methods:**
-  1. **Manual Update in Instance Settings:**
-     - Go to `Settings > Update Check Frequency` and click the `Check Manually` button.
-     - If an update is available, an upgrade button will appear on the sidebar.
-  2. **Automatic Update:**
-     - If enabled, the instance will update automatically at the time set in the settings.
-  3. **Re-run Installation Script:**
-     - Run the installation script again to upgrade to the latest version available on the CDN:
-     ```bash
-     curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
-     ```
-
-> [!IMPORTANT]
-> If a new release is available on GitHub but your instance hasn't updated yet or no upgrade button is shown in the UI, the CDN might not have been updated yet. This intentional delay ensures stability and allows for hotfixes before official release.
-
-### Cloud
-
-- **Update Frequency:** Less frequent as it's a managed service.
-- **Update Availability:** New versions are available once Andras has updated the cloud version manually.
-- **Update Method:**
-  - Updates are managed by Andras, who ensures each cloud version is thoroughly tested and stable before releasing it.
-
-> [!IMPORTANT]
-> The cloud version of Coolify may be several versions behind the latest GitHub releases even if the CDN is updated. This is intentional to ensure stability and reliability for cloud users and Andras will manually update the cloud version when the update is ready.
-
-## Manually Update/ Downgrade to Specific Versions
-
-> [!CAUTION]  
-> Updating to unreleased versions is not recommended and can cause issues.
-
-> [!IMPORTANT]
-> Downgrading is supported but not recommended and can cause issues because of database migrations and other changes.
-
-To update your Coolify instance to a specific version, use the following command:
-
-```bash
-curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s <version>
+```text
+next → main → stable release
 ```
-Replace `<version>` with the version you want to update to (for example `4.0.0-beta.332`).
+
+1. Temporarily stop merging features into `next`.
+2. Change the version on `next` from the approved RC to the stable version, such as `4.4.0`.
+3. Merge `next` into `main`.
+4. Create a reviewed draft GitHub Release named `v4.4.0`.
+5. Run the stable release workflow from `main`.
+6. The workflow rebuilds the exact stable version, publishes `4.4.0` and `latest`, then publishes the draft.
+7. Update the CDN only after the release is approved.
+8. Advance `next` to the next development version.
+
+## Hotfix flow
+
+```text
+main → hotfix/X.Y.Z → main → next
+```
+
+1. Create `hotfix/X.Y.Z` from `main` when a patch needs an integration branch. A single fix may use a normal branch from `main` instead.
+2. Set the intended patch version.
+3. Implement and test the fix. SHA images report `X.Y.Z-dev.<short-sha>`.
+4. Merge the fix into `main`.
+5. Create a reviewed draft GitHub Release named `vX.Y.Z`.
+6. Run the stable release workflow from `main`.
+7. Merge `main` into `next`, resolve the version in favor of the next intended RC, and delete the hotfix branch if one was used.
+8. Update the CDN only after the release is approved.
+
+## Image tags
+
+| Tag | Meaning |
+| --- | --- |
+| `latest` | Latest stable release |
+| `next` | Latest successful `next` build |
+| `X.Y.Z` | Exact stable release |
+| `X.Y-rc.N` | Exact RC release |
+| `sha-<commit>` | Exact commit build |
+
+Git tags use the `v` prefix, such as `v4.4.0`. Docker image tags do not.

UI_REDESIGN.md

@@ -1,687 +0,0 @@
-# Coolify UI redesign
-
-This branch restyles Coolify without changing its Livewire + Blade + Alpine +
-Tailwind v4 architecture. The visual system now covers the global shell,
-project and environment pages, application navigation, settings surfaces,
-tables, modals, toasts, terminals, and metrics.
-
-Use this file as the source of truth when updating another page. The older
-Graphite-only notes are no longer accurate.
-
-Onboarding validation and live server validation checkpoints share
-`<x-checkpoint-item>` (idle / pending / running / success / error) inside a
-compact divided list, not legacy green check SVGs or fixed-width status rows.
-
-> **Maintainer rules**
->
-> - Keep the work frontend-focused unless existing data must be exposed to the
->   view.
-> - Preserve routes, Livewire bindings, permissions, confirmations, and working
->   interactions while changing layout and presentation.
-> - Do not write or run tests for this redesign branch.
-> - Validate Blade with `docker exec coolify php artisan view:cache`, then clear
->   it with `docker exec coolify php artisan view:clear`.
-> - Build frontend assets in the Vitee container with
->   `docker exec coolify-vite npm run build`.
-> - Use existing components before adding another styling abstraction.
-> - Use `<x-forms.listbox>` for dropdown controls. Never add a native
->   `<select>` to a redesigned view, including compact table-row controls.
-
----
-
-## 1. Visual direction
-
-The interface is compact and product-focused:
-
-- near-neutral layered surfaces instead of large bordered boxes;
-- 13–14px UI typography and 32px controls;
-- hairline rings instead of heavy borders;
-- full-width data tables for dense collections;
-- outline Reicon glyphs through `<x-reicon>`;
-- the Coolify purple brand accent in light mode;
-- the readable Coolify yellow accent in dark mode;
-- solid active-item fills (neutral black/white opacity), not accent gradients;
-  active state is the left accent rail plus a flat selected surface;
-- sentence-case labels and headings;
-- never use the em dash (`—`) in UI copy. Prefer a period, colon, comma, or
-  ASCII hyphen (`-`) for empty cells and separators.
-
-Avoid oversized titles, generic dashboard cards, strong shadows, thick
-dividers, native browser selects, and isolated colored buttons that do not
-match the current action styles.
-
----
-
-## 2. Development and cascade notes
-
-PHP runs in the `coolify` container. The development app is normally available
-at `http://localhost:8000`, with Vite on port `5173`.
-
-`resources/css/app.css` still contains unlayered global element rules for
-headings, labels, and tables. Tailwind utilities are layered, so the
-unlayered rules can win unexpectedly.
-
-The settings and dense-surface CSS therefore lives as plain unlayered CSS near
-the end of `resources/css/app.css`, beginning at:
-
-```css
-/* Coollabs layer-card settings surfaces */
-```
-
-Important consequences:
-
-- scope restyled forms with `.application-settings-form` or
-  `.application-settings-workspace`;
-- add shared surface overrides to the unlayered block instead of stacking
-  `!important` utilities;
-- listbox panels require ancestors with `overflow: visible`;
-- anchored cards use `scroll-margin-top: 7rem` to clear both fixed navigation
-  layers;
-- modal shells reuse the layer-card classes but keep content-width sizing on
-  desktop;
-- Alpine code inside quoted Blade attributes must not introduce conflicting
-  quote characters.
-
----
-
-## 3. Tokens and color behavior
-
-The surface ladder is defined in `resources/css/app.css`.
-
-| Token | Light | Dark | Use |
-|---|---|---|---|
-| `--coollabs-canvas` | near white | 10% neutral | page canvas |
-| `--coollabs-elevated` | 98% neutral | 15% neutral | shells and card headers |
-| `--coollabs-base` | white | 17% neutral | nested card bodies |
-| `--coollabs-recessed` | 96% neutral | 20% neutral | inputs and listboxes |
-| `--coollabs-fill` | 92.2% neutral | 26.9% neutral | dividers and passive fills |
-| `--coollabs-line` | translucent dark | 32% neutral | control borders |
-| `--coollabs-hairline` | 93.5% neutral | 26.9% neutral | shell rings |
-| `--coollabs-subtle` | 55.6% neutral | 70.8% neutral | labels and muted titles |
-
-Accent behavior is intentionally theme-aware:
-
-- **Light mode:** Coolify purple (`coollabs`) for active controls, focus,
-  primary actions, and navigation accents.
-- **Dark mode:** Coolify yellow (`warning`) for the same states because the
-  original purple did not provide sufficient text and ring contrast.
-
-Do not hard-code blue focus rings or leave yellow accent utilities active in
-light mode. Primary action patterns should normally follow:
-
-```html
-bg-coollabs/10 text-coollabs ring-coollabs/25
-dark:bg-warning/15 dark:text-warning dark:ring-warning/25
-```
-
-The filled top-level action/tab treatment uses the same palette at a restrained
-opacity rather than a fully saturated fill.
-
----
-
-## 4. Page shells and navigation
-
-### Global shell
-
-- Main sidebar groups are compact, use outline Reicons, and keep a 32px row
-  height.
-- Active sidebar rows are rounded pills (`rounded-md`) with an accent rail on
-  the left plus a solid neutral selected fill (`bg-black/5` light,
-  `bg-white/6` dark). Hover rows use the same radius. Do not use accent-tinted
-  gradients on nav rows; yellow washes look muddy on dark UI.
-- Nested items use a thin guide line with a visible active segment, not a thick
-  box border.
-- The update badge sits on the version row and uses a tiny fully rounded
-  primary-action pill.
-
-### Layer-2 navigation
-
-Application and server pages use the same fixed second navigation layer
-directly below the global topbar. Do not keep a large in-flow resource heading
-or legacy `.navbar-main` tabs on one resource type while using the compact
-layer-2 bar on another. Active tabs are a light brand fill:
-
-- purple tint in light mode;
-- yellow tint in dark mode;
-- no fully saturated tab background.
-
-Keep route-derived active state in Blade/Livewire. Do not rely only on Alpine
-state because it can disappear after polling or a Livewire morph.
-
-The global topbar owns the current resource identity and its compact status
-badges. Layer 2 owns route tabs, resource links, and contextual action buttons
-only. If a resource is missing from `x-top-breadcrumb`, extend the global
-topbar instead of repeating its name or status summary in layer 2. Mobile
-resource navigation may repeat this context because the desktop global topbar
-is hidden there.
-
-Only add layer-2 tabs when they represent real sibling routes inside one
-context. Never repeat main-sidebar destinations such as Dashboard, Projects,
-Terminal, Servers, Sources, Destinations, or Storage as a second tab row. A
-single collection page does not need a tab just to fill the bar; keep its
-primary action in the page header instead. When tabs are useful, their left edge
-uses the same compact `pl-2` alignment as application navigation rather than
-the content container's wide horizontal padding.
-
-The dashboard is a compact overview, not a metrics wall. Use two full-width
-sections that follow the projects-page grid pattern: projects first, then
-servers. Keep one `New` action in the page header and let its modal choose the
-resource type. Place active deployments above the resource grids as a compact,
-live-updating table rather than a metric card. Communicate server health with
-the shared status badge.
-
-### Top-level dashboard destinations
-
-Every page opened directly from the main sidebar uses the same compact content
-shell:
-
-- 24px page title and a 13px muted summary;
-- the primary action at the top right using the restrained brand fill;
-- no legacy `coolbox`, `.navbar-main`, or oversized subtitle block;
-- four-column compact cards for small browsable collections;
-- a dense table instead of cards when the collection is expected to grow;
-- `x-empty` anatomy for empty states;
-- `x-status-badge` for state and `x-reicon` for all interface icons.
-
-Collection cards are `min-h-28` or `min-h-32`, use a 32px icon tile, and keep
-secondary metadata at 11px. They must not grow into dashboard-sized summary
-cards. Sources, destinations, S3 storage, private keys, and shared-variable
-scopes use this pattern.
-
-Top-level settings families such as Team, Notifications, Keys & Tokens, and
-instance Settings use a compact header followed by a small route-derived tab
-strip. The active tab uses the same purple-light/yellow-dark tint as resource
-tabs. Do not nest `<button>` elements inside tab links.
-
-### Route-family completion gate
-
-A redesign is not complete when only its index or most visible route has been
-updated. Treat every route family as one deliverable:
-
-- index, create, detail, settings, logs, metrics, backup, execution, and danger
-  routes must share the same navigation hierarchy and surface language;
-- main-sidebar collection routes use the global shell without duplicating those
-  destinations in a layer-2 tab row;
-- resource detail families use resource identity and status in the global
-  topbar, route tabs and actions in layer 2, and the grouped settings sidebar
-  only for the third level;
-- create and edit routes stay inside the same layer-2 family instead of
-  falling back to an isolated legacy page;
-- reusable partials, empty states, confirmation flows, and row editors must be
-  migrated with the page that exposes them;
-- audit the whole family for native selects, legacy heading blocks, old Save
-  buttons, old status chips, and `coolbox`/`navbar-main`/`sub-menu-wrapper`
-  before marking the family complete.
-
-Do not report a family as redesigned while a sibling route still uses the old
-tabs, a large in-flow title, a browser select, or a different modal anatomy.
-
-The New Resource page keeps its filter controls in the top layer card, then
-renders Applications, Databases, and Services as separate layer-card sections.
-Do not leave category headings and resource grids floating as uncontained
-content below the filter card.
-
-### Settings workspace
-
-Application and server configuration pages use the same 210px grouped,
-icon-led sidebar and a full-width content column. The workspace is capped at
-1180px, the sidebar becomes sticky at `xl`, and the sidebar label and first
-content card start on the same visual line. Do not use the legacy
-`sub-menu-wrapper`, native mobile page selects, or an in-flow row of top-level
-tabs. Only show nested section anchors when a page has at least four useful
-sections.
-
-The shared workspace grid is:
-
-```blade
-<div
-    class="application-settings-workspace mt-8 grid min-w-0 gap-8
-        xl:mt-0 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-10">
-    <aside class="application-settings-navigation min-w-0 xl:sticky xl:top-26 xl:self-start">
-        ...
-    </aside>
-    <div class="min-w-0 xl:mt-3">
-        ...
-    </div>
-</div>
-```
-
-Instance Settings constrains both `x-settings.navbar` and the workspace to the
-same `max-w-[1180px]` shell.
-
-**Page titles (global):** family H1s (`x-dashboard.navbar` with
-`titleOnDesktop="false"`, the default) hide at **lg+**, the same breakpoint as
-the desktop shell (main sidebar + fixed layer-2 tabs). Below `lg` the mobile
-topbar is used and the page title stays visible. Collection indexes (Servers,
-Projects, …) always keep their H1; stack title above actions on narrow widths
-so they never overlap. Resource in-flow names only render below `md` (when the
-fixed resource tab bar is hidden). Fixed layer-2 spacers must be `lg:h-12` to
-match the bar height. Do not put the H1 beside the settings sidebar.
-
-Standard content stack:
-
-```blade
-<div class="application-settings-workspace flex flex-col gap-6">
-    <x-application.settings-section ... />
-    <x-application.settings-section ... />
-</div>
-```
-
-The current cross-page section gap is `gap-6`. Do not introduce extra top
-padding on an individual page unless its toolbar is intentionally separated
-from the first card.
-
-Use a flex or grid stack with `gap-6`; do not use `space-y-*` between layer
-cards. The layer-card root intentionally resets its own margin, so margin-based
-spacing utilities can silently collapse.
-
----
-
-## 5. Layer cards
-
-Use `resources/views/components/application/settings-section.blade.php`.
-Older manual shells may use `.application-settings-section-header` and
-`.application-settings-section-body`; both must retain the same padded,
-action-aligned anatomy as the component. Prefer migrating new work to the
-component instead of creating another manual variant.
-
-```blade
-<x-application.settings-section
-    id="public-access-section"
-    title="Public access"
-    helper="How this section affects the resource.">
-    <x-slot:actions>
-        <x-forms.button>Action</x-forms.button>
-    </x-slot:actions>
-
-    ...
-</x-application.settings-section>
-```
-
-Anatomy:
-
-- 8px shell radius;
-- elevated header strip;
-- no divider below the header;
-- nested base-color body with its own fill ring;
-- 16px body padding;
-- optional `flush` mode for full-bleed tables;
-- card-level actions belong in the header slot.
-
-Header actions use an 8px top/right inset while the title keeps its 16px left
-inset. Do not leave a larger empty strip between the final action and the
-card's top-right corner.
-
-Do not split one collection into a summary card followed by a table or log
-card. Keep its status/action in the header, its view switcher or toolbar at the
-top of a flush body, and its data in that same layer card. Repeated file
-editors are the opposite case: each file gets its own titled layer card so its
-content and actions remain clearly associated.
-
-### Nested radii
-
-Concentric boxes must follow:
-
-```text
-outer radius = inner radius + visible inset
-```
-
-Examples:
-
-- a 6px tab or listbox option inside 4px padding uses a 10px outer well;
-- an 8px button inside the unsaved pill's 8px padding uses a 16px outer pill.
-
-Do not give visibly inset parent and child boxes the same radius. Flush or
-edge-to-edge children are exempt because there is no visible inset to add.
-
-Use an empty state when the section has no usable controls:
-
-```blade
-<x-empty size="sm" title="Nothing here" description="Explain what enables it.">
-    <x-slot:icon>
-        <x-reicon name="layers" class="size-8" />
-    </x-slot:icon>
-</x-empty>
-```
-
----
-
-## 6. Controls
-
-All normal controls are 32px high with an 8px radius.
-
-### Field grids
-
-The grid must match the controls visible in the current state:
-
-- two visible peer controls use two columns, not a three-column grid with an
-  empty track;
-- three visible peer controls may use three columns when their content stays
-  readable;
-- conditional fields remain in the same grid when they are part of that field
-  group, so a URL or text input does not become wider than its peer column;
-- collapse to one column at smaller breakpoints.
-
-Do not pick a column count from the maximum possible state if the normal state
-shows fewer controls.
-
-### Inputs
-
-Use `x-forms.input` and `x-forms.textarea`. Fields need visible vertical spacing
-between the label and control. Password visibility uses the outline Reicon
-`eye`/`eye-off` treatment from the shared input component.
-
-### Dropdowns
-
-Do not use native `<select>` on any redesigned route, including mobile
-fallbacks. Use:
-
-```blade
-<x-forms.listbox id="property" label="Setting" :options="[
-    ['value' => true, 'label' => 'Enabled'],
-    ['value' => false, 'label' => 'Disabled'],
-]" onChange="instantSave" />
-```
-
-Boolean checkboxes should normally become descriptive two-option listboxes.
-Use `.live` behavior only when the selection needs an immediate server
-rerender.
-
-Keep checkboxes for compact permission matrices and multi-select lists. Those
-controls must use the shared `x-forms.checkbox` anatomy: an 18px rounded custom
-box, purple checked fill in light mode, yellow checked fill in dark mode, and a
-high-contrast check mark. Never expose the browser or Tailwind Forms default
-checkbox on a redesigned page.
-
-The popup panel uses a 10px radius around 6px options with a 4px inset. Keep
-the option content left-aligned and size the panel to its content or trigger;
-do not create an unnecessarily wide menu.
-
-Toolbar filter and sort buttons keep static labels (`Filter`, `Sort`). The
-selected option is indicated inside the menu, not repeated on the trigger.
-
-#### Multi-select filter dropdowns
-
-Toolbar filters that can combine criteria use one multi-select listbox rather
-than separate dropdowns or a single selected value. Follow the deployment
-history filter in
-`resources/views/livewire/project/application/deployment/index.blade.php`:
-
-- set `aria-multiselectable="true"` on the listbox;
-- group related options under compact uppercase labels;
-- keep the dropdown open while options are toggled;
-- use the shared 16px custom checkbox treatment: purple checked fill in light
-  mode, yellow checked fill in dark mode, and a high-contrast check mark;
-- show the number of active selections in a small count pill on the static
-  `Filter` trigger;
-- combine selections within one group with OR logic and combine different
-  groups with AND logic;
-- constrain only the options area with `max-h-80 overflow-y-auto`;
-- place a persistent `Reset filters` action in a separate footer below the
-  scrollable options, divided by a top border;
-- disable the reset action when no filter is active, and close the dropdown
-  after resetting.
-
-Do not represent the empty state as a selectable `All` option. The footer reset
-action is the single way to return the multi-select to its unfiltered state.
-
-### Standard table controls
-
-Dense tables use the shared `x-table.*` components so search, filters, sorting,
-and backend loading states remain visually and behaviorally consistent:
-
-- `<x-table.toolbar>` owns the responsive search-left/actions-right layout;
-- `<x-table.search>` owns the search icon, optional loading indicator, clear
-  action, sizing, and input anatomy;
-- `<x-table.filter>` owns the static Filter trigger, active-count pill,
-  multi-select panel, scrollable options area, and Reset filters footer;
-- `<x-table.sort>` owns the static Sort trigger and single-select panel;
-- `<x-table.loading>` overlays only the changing table data for backend search,
-  filter, sort, and pagination requests.
-
-Tables continue to own their filter options, sort choices, headers, rows,
-queries, permissions, and empty states. Backend-filtered or paginated tables
-must use `x-table.loading`; frontend-only Alpine tables reuse the same toolbar
-and control anatomy but do not show an artificial loading state.
-
-### Buttons
-
-- neutral actions use the shared `.button`;
-- primary actions use the theme-aware purple/yellow tint;
-- destructive actions use the existing error treatment;
-- use outline Reicons where a matching glyph exists;
-- avoid raw browser-default buttons and old dark-mode purple fills.
-
-### Unsaved changes
-
-`resources/views/components/unsaved-bar.blade.php` is a compact floating
-bottom-center pill. It contains:
-
-- “You have changes that haven't been saved yet.”
-- a subtle Reset action;
-- a theme-aware Save changes button matching the tab accent.
-
-On small viewports the pill is inset (`inset-x-3`) and stacks: full label on
-the first line, Reset / Save on the second (right-aligned). From `sm` up it
-returns to the centered single-row nowrap pill.
-
-Do not restore the old full-width footer.
-
-Deferred fields in one Livewire component use one floating unsaved bar and one
-submit action. Do not add a separate “Save configuration” button to every
-card. Selectors that are safe to persist independently should use the existing
-instant-save pattern.
-
----
-
-## 7. Dense tables
-
-Collections with many rows should use the Cloudflare-inspired table pattern:
-
-- toolbar above the table;
-- search on the left;
-- filters, sort, view toggles, and Add on the right;
-- 40px header row and roughly 48px data rows;
-- subtle row hover;
-- plain text or the shared status badge rather than large colored chips;
-- compact action at the far right;
-- no separate layer card for each item.
-
-Do not add a summary card above a table when it only repeats the row count,
-current page, or refresh interval. Keep counts and pagination in the footer.
-Background polling stays silent unless its state is actionable; do not add a
-“Live updates” badge just to explain that a table refreshes. Filters only
-render meaningful values; use the shared listbox instead of a number input or
-browser-native control.
-
-The footer is always inside the table shell:
-
-- `Showing X–Y of Z` on the left;
-- first, previous, current page, next, and last controls on the right.
-
-Hide the entire pagination footer when there is only one page (`totalPages > 1`).
-A lone “1–2 of 2” bar with disabled controls adds noise and is unnecessary.
-
-Use `x-status-badge` for resource and execution state. It is a small neutral
-pill with a semantic dot, not a full colored rectangle.
-
-Relevant classes:
-
-- `.data-table`
-- `.data-table-header`
-- `.data-table-row`
-- `.table-badge`
-
-Create a page-specific grid class when columns differ. Add responsive rules
-that hide secondary columns before allowing horizontal overflow.
-
----
-
-## 8. Modals, confirmations, and toasts
-
-### Modals
-
-`x-modal-input` and confirmation dialogs reuse the layer-card shell:
-
-- compact elevated header;
-- nested base-color body;
-- content-width desktop sizing;
-- shared 32px controls;
-- no redundant description below a self-explanatory title;
-- custom listboxes instead of native browser selects;
-- right-aligned footer actions below a divider;
-- compact action buttons, never a submit button stretched by a column layout.
-
-Edit modals should use the same field layout and option set as their matching
-create modal.
-
-### Command palette
-
-The global search command palette (`livewire:global-search`) is a compact
-top-anchored overlay:
-
-- elevated shell with hairline ring and modal shadow (not a heavy floating card);
-- recessed-neutral header strip with outline search glyph and 14px input;
-- compact OS-aware mod+K (`⌘K` on macOS, `Ctrl+K` on Windows/Linux) / `/` / `ESC` kbd chips matching the sidebar search trigger;
-- nested base-color results body with group labels in sentence case;
-- dense result rows as inset 6px-radius pills (listbox anatomy), not full-bleed
-  bars with global focus rings;
-- hover uses neutral fill; keyboard focus uses a soft accent wash plus a 2px
-  left rail — never the global `ring-2` / ring-offset treatment;
-- create rows use a neutral plus tile that only picks up the accent when the
-  row is focused;
-- type pills and quickcommand chips stay recessed; they tint with the accent
-  only on the focused row;
-- neutral thin scrollbar inside the results body (not brand-colored);
-- create-resource modals opened from the palette reuse the standard
-  `application-settings-section` layer-card shell.
-
-Preserve keyboard navigation (arrow keys, Enter via focused links, Escape to
-clear then close), `/` and mod+K (⌘K / Ctrl+K by OS) open shortcuts, and the multi-step
-server → destination → project → environment create flow.
-
-### Toasts
-
-`resources/views/components/toast.blade.php` provides the global
-`window.toast(message, options)` API and Livewire event handling.
-
-Current toast behavior:
-
-- compact layered card, maximum width 26rem;
-- Reicon status tile for success, info, warning, danger, or default;
-- title plus optional description;
-- dismiss and copy-details actions;
-- up to four stacked notifications;
-- four-second dismissal, paused while hovered;
-- support for all six screen positions and sanitized custom HTML.
-
-Do not bring back the old oversized dark rectangle.
-
----
-
-## 9. Terminals, logs, and metrics
-
-### Terminals
-
-Application and server browser terminals use the same browser-oriented console
-shell, theme picker, compact header controls, and outline `browser-terminal`
-Reicon. Hide a container switcher when only one container exists.
-
-### Logs
-
-Runtime and deployment logs should feel like a clean terminal surface:
-
-- keep a single log stream inside one layer card instead of adding an
-  introductory card above it;
-- one compact toolbar;
-- a recessed monospace log viewport;
-- search and line-count controls aligned with icon actions;
-- clear live/follow state;
-- fullscreen support without changing the control language;
-- custom listbox-style menus instead of browser dropdowns.
-
-### Metrics
-
-Metrics pages use separate layer cards for range selection, CPU, and memory.
-Charts follow the application metrics implementation:
-
-- 240px area chart;
-- smooth 2px stroke and restrained gradient fill;
-- dashed neutral grid;
-- no ApexCharts toolbar;
-- tooltip positioned at the hovered point;
-- UTC on both axes and tooltip;
-- 20% headroom above observed values;
-- downsample long time ranges before rendering.
-
-Only add a metric if Sentinel exposes historical data for it. Current Sentinel
-history endpoints store CPU and memory. Root filesystem usage is included in
-the periodic push payload for threshold notifications, but it is not stored as
-a historical Sentinel metric and has no history endpoint, so it cannot power a
-disk-usage graph yet.
-
----
-
-## 10. Current reference surfaces
-
-Use these as implementation references:
-
-| Surface | Reference |
-|---|---|
-| Dashboard overview | `resources/views/livewire/dashboard.blade.php` |
-| Top-level collection cards | `resources/views/livewire/project/index.blade.php`, `resources/views/source/all.blade.php` |
-| Top-level family tabs | `resources/views/components/team/navbar.blade.php`, `resources/views/components/notification/navbar.blade.php` |
-| General settings and form anatomy | `resources/views/livewire/project/application/general.blade.php` |
-| Advanced settings | `resources/views/livewire/project/application/advanced.blade.php` |
-| Fixed layer-2 resource navigation | `resources/views/livewire/project/application/heading.blade.php`, `resources/views/livewire/server/navbar.blade.php` |
-| Grouped settings sidebar | `resources/views/livewire/project/application/configuration.blade.php`, `resources/views/components/server/sidebar.blade.php` |
-| Dense environment table and footer | `resources/views/livewire/project/shared/environment-variable/all.blade.php` |
-| Standard table toolbar controls | `resources/views/components/table/*` |
-| Application metrics charts | `resources/views/livewire/project/shared/metrics.blade.php` |
-| Browser terminal workspace | `resources/views/livewire/terminal/index.blade.php` |
-| Layer card | `resources/views/components/application/settings-section.blade.php` |
-| Custom dropdown | `resources/views/components/forms/listbox.blade.php` |
-| Empty state | `resources/views/components/empty.blade.php` |
-| Status pill | `resources/views/components/status-badge.blade.php` |
-| Floating save pill | `resources/views/components/unsaved-bar.blade.php` |
-| Global toast | `resources/views/components/toast.blade.php` |
-| Command palette / global search | `resources/views/livewire/global-search.blade.php` |
-| Outline icons | `resources/views/components/reicon.blade.php` |
-| Shared styling | `resources/css/app.css`, `resources/css/utilities.css` |
-| HTTP error pages | `resources/views/components/error-page.blade.php`, `resources/views/errors/*` |
-
-Already restyled application configuration surfaces include General, Advanced,
-Environment Variables, Persistent Storage, Servers, Scheduled Tasks, Webhooks,
-Preview Deployments, Healthcheck, Rollback, Resource Limits, Resource
-Operations, Metrics, Tags, and Danger Zone.
-
-HTTP error pages (400, 401, 402, 403, 404, 419, 429, 500, 503) use the shared
-`<x-error-page>` component on the public auth-style canvas: theme-aware status
-code, compact title and muted description, neutral `.button` actions, and an
-`auth-text-link`-style Contact support link. Keep copy sentence-case and avoid
-oversized 200px status numbers.
-
----
-
-## 11. Restyling checklist
-
-1. Inventory every route and reusable partial in the family before editing.
-2. Read the current Blade and Livewire class before changing presentation.
-3. Preserve every existing action, authorization check, loading state, and
-   confirmation.
-4. Add the correct dual navigation and scoped workspace/form class.
-5. Convert meaningful groups to layer cards and use `gap-6`.
-6. Make the responsive column count match the controls visible in every state.
-7. Replace native selects and checkbox-style configuration with listboxes.
-8. Use one save model per component: instant-save or one floating dirty bar.
-9. Check nested radii using `outer = inner + inset`.
-10. Keep modal descriptions purposeful and footer actions compact/right-aligned.
-11. Use tables for dense collections and cards for forms or summaries.
-12. Use `x-status-badge`, `x-empty`, and `x-reicon`.
-13. Confirm light and dark accent behavior.
-14. Check fixed-nav anchor offsets and responsive stacking.
-15. Sweep every sibling route for legacy controls and shells.
-16. Run `git diff --check`.
-17. Compile Blade views in the `coolify` container.
-18. Build assets in `coolify-vite`.
-19. Hard-refresh and inspect the family routes in both themes.

app/Actions/Application/StopApplication.php

@@ -28,7 +28,7 @@ class StopApplication
                 if ($server->isSwarm()) {
                     instant_remote_process(["docker stack rm {$application->uuid}"], $server);
 
-                    return;
+                    continue;
                 }
 
                 $containers = $previewDeployments
@@ -40,7 +40,7 @@ class StopApplication
 
                 foreach ($containersToStop as $containerName) {
                     instant_remote_process(command: [
-                        "docker stop --time=$timeout $containerName",
+                        dockerStopCommand($timeout, $containerName, $server),
                         "docker rm -f $containerName",
                     ], server: $server, throwError: false);
                 }
@@ -57,17 +57,15 @@ class StopApplication
             }
         }
 
+        $status = ['status' => 'exited'];
         if ($resetRestartCount) {
-            $application->update([
+            $status = array_merge($status, [
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
             ]);
-        } else {
-            $application->update([
-                'status' => 'exited',
-            ]);
         }
+        $application->update($status);
 
         ServiceStatusChanged::dispatch($application->environment->project->team->id);
     }

app/Actions/Application/StopApplicationOneServer.php

@@ -28,7 +28,7 @@ class StopApplicationOneServer
                     if ($containerName) {
                         instant_remote_process(
                             [
-                                "docker stop --time=$timeout $containerName",
+                                dockerStopCommand($timeout, $containerName, $server),
                                 "docker rm -f $containerName",
                             ],
                             $server

app/Actions/Database/StartClickhouse.php

@@ -104,7 +104,7 @@ class StartClickhouse
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StartDragonfly.php

@@ -191,7 +191,7 @@ class StartDragonfly
         if ($this->database->enable_ssl) {
             $this->commands[] = "chown -R 999:999 $this->configuration_dir/ssl/server.key $this->configuration_dir/ssl/server.crt";
         }
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StartKeydb.php

@@ -209,7 +209,7 @@ class StartKeydb
         if (! is_null($this->database->keydb_conf) && ! empty($this->database->keydb_conf)) {
             $this->commands[] = "chown 999:999 $this->configuration_dir/keydb.conf";
         }
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StartMariadb.php

@@ -208,13 +208,13 @@ class StartMariadb
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
+        if ($this->database->enable_ssl) {
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt";
+        }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
-        if ($this->database->enable_ssl) {
-            $this->commands[] = executeInDocker($this->database->uuid, 'chown mysql:mysql /etc/mysql/certs/server.crt /etc/mysql/certs/server.key');
-        }
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
     }

app/Actions/Database/StartMongodb.php

@@ -257,12 +257,12 @@ class StartMongodb
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
-        $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         if ($this->database->enable_ssl) {
-            $this->commands[] = executeInDocker($this->database->uuid, 'chown mongodb:mongodb /etc/mongo/certs/server.pem');
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem";
         }
+        $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');

app/Actions/Database/StartMysql.php

@@ -209,14 +209,12 @@ class StartMysql
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
-        $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
-
         if ($this->database->enable_ssl) {
-            $mysqlUser = escapeshellarg($this->database->mysql_user);
-            $this->commands[] = executeInDocker($this->database->uuid, "chown {$mysqlUser}:{$mysqlUser} /etc/mysql/certs/server.crt /etc/mysql/certs/server.key");
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt";
         }
+        $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
         $this->commands[] = "echo 'Database started.'";
 

app/Actions/Database/StartPostgresql.php

@@ -219,13 +219,12 @@ class StartPostgresql
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
-        $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         if ($this->database->enable_ssl) {
-            $postgresUser = escapeshellarg($this->database->postgres_user);
-            $this->commands[] = executeInDocker($this->database->uuid, "chown {$postgresUser}:{$postgresUser} /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt");
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt";
         }
+        $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
         return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');

app/Actions/Database/StartRedis.php

@@ -204,7 +204,7 @@ class StartRedis
         if (! is_null($this->database->redis_conf) && ! empty($this->database->redis_conf)) {
             $this->commands[] = "chown 999:999 $this->configuration_dir/redis.conf";
         }
-        $this->commands[] = "docker stop -t 10 $container_name 2>/dev/null || true";
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

app/Actions/Database/StopDatabase.php

@@ -30,6 +30,7 @@ class StopDatabase
 
             // Reset restart tracking when database is manually stopped
             $database->update([
+                'status' => 'exited',
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
@@ -56,7 +57,7 @@ class StopDatabase
     {
         $server = $database->destination->server;
         instant_remote_process(command: [
-            "docker stop -t $timeout $containerName",
+            dockerStopCommand($timeout, $containerName, $server),
             "docker rm -f $containerName",
         ], server: $server, throwError: false);
     }

app/Actions/Proxy/StopProxy.php

@@ -24,7 +24,7 @@ class StopProxy
             }
 
             instant_remote_process(command: [
-                "docker stop -t=$timeout $containerName 2>/dev/null || true",
+                dockerStopCommand($timeout, $containerName, $server).' 2>/dev/null || true',
                 "docker rm -f $containerName 2>/dev/null || true",
                 '# Wait for container to be fully removed',
                 'for i in {1..10}; do',

app/Actions/Service/StopService.php

@@ -49,6 +49,9 @@ class StopService
                 $this->stopContainersInParallel($containersToStop, $server);
             }
 
+            $applications->each->update(['status' => 'exited']);
+            $dbs->each->update(['status' => 'exited']);
+
             if ($deleteConnectedNetworks) {
                 $service->deleteConnectedNetworks();
             }
@@ -67,7 +70,7 @@ class StopService
         $timeout = count($containersToStop) > 5 ? 10 : 30;
         $commands = [];
         $containerList = implode(' ', $containersToStop);
-        $commands[] = "docker stop -t $timeout $containerList";
+        $commands[] = dockerStopCommand($timeout, $containerList, $server);
         $commands[] = "docker rm -f $containerList";
         instant_remote_process(
             command: $commands,

app/Actions/Service/StopServiceApplication.php

@@ -2,6 +2,7 @@
 
 namespace App\Actions\Service;
 
+use App\Events\ServiceStatusChanged;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use Lorisleiva\Actions\Concerns\AsAction;
@@ -21,5 +22,8 @@ class StopServiceApplication
         instant_remote_process([
             "docker stop {$containerName}",
         ], $server);
+
+        $serviceApplication->update(['status' => 'exited']);
+        ServiceStatusChanged::dispatch($service->environment->project->team->id);
     }
 }

app/Actions/User/DeleteUserResources.php

@@ -70,7 +70,7 @@ class DeleteUserResources
 
         return [
             'applications' => $applications->unique('id'),
-            'databases' => $databases->unique('id'),
+            'databases' => $databases->unique(fn ($database) => $database::class.':'.$database->id),
             'services' => $services->unique('id'),
         ];
     }

app/Console/Kernel.php

@@ -15,10 +15,7 @@ use App\Jobs\RegenerateSslCertJob;
 use App\Jobs\ScheduledJobManager;
 use App\Jobs\ServerManagerJob;
 use App\Jobs\UpdateCoolifyJob;
-use App\Jobs\V5ReconcileServersJob;
-use App\Jobs\V5RotateAgentTokensJob;
 use App\Models\InstanceSettings;
-use App\Support\V5\V5Feature;
 use Illuminate\Console\Scheduling\Schedule;
 use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
 
@@ -52,11 +49,6 @@ class Kernel extends ConsoleKernel
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
-        if (V5Feature::enabled()) {
-            $this->scheduleInstance->job(new V5ReconcileServersJob)->everyFiveMinutes()->withoutOverlapping()->onOneServer();
-            $this->scheduleInstance->job(new V5RotateAgentTokensJob)->everyFifteenMinutes()->withoutOverlapping()->onOneServer();
-        }
-
         if (isDev()) {
             // Instance Jobs
             $this->scheduleInstance->command('horizon:snapshot')->everyMinute();

app/Http/Controllers/Api/ApplicationsController.php

@@ -2884,6 +2884,10 @@ class ApplicationsController extends Controller
             ], 422);
         }
 
+        $requestHasHttpBasicAuth = $request->has('is_http_basic_auth_enabled')
+            || $request->has('http_basic_auth_username')
+            || $request->has('http_basic_auth_password');
+
         if ($request->has('is_http_basic_auth_enabled') && $request->is_http_basic_auth_enabled === true) {
             if (blank($application->http_basic_auth_username) || blank($application->http_basic_auth_password)) {
                 $validationErrors = [];
@@ -2901,10 +2905,6 @@ class ApplicationsController extends Controller
                 }
             }
         }
-        if ($request->has('is_http_basic_auth_enabled') && $application->is_container_label_readonly_enabled === false) {
-            $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
-            $application->save();
-        }
 
         // For dockercompose applications, domains (fqdn) field should not be used
         // Only docker_compose_domains should be used to set domains for individual services
@@ -3119,7 +3119,7 @@ class ApplicationsController extends Controller
             // Must run after fqdn is filled: flags are kept only for domains the app still has.
             $application->setNoindexDomains($request->input('noindex_domains') ?? []);
         }
-        if ($application->settings->is_container_label_readonly_enabled && ($requestHasDomains || $requestHasNoindexDomains) && $server->isProxyShouldRun()) {
+        if ($application->settings->is_container_label_readonly_enabled && ($requestHasDomains || $requestHasNoindexDomains || $requestHasHttpBasicAuth) && $server->isProxyShouldRun()) {
             $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
         }
         $application->save();

app/Http/Controllers/Api/OtherController.php

@@ -316,6 +316,6 @@ class OtherController extends Controller
     )]
     public function healthcheck(Request $request)
     {
-        return 'OK';
+        return response('OK');
     }
 }

app/Http/Controllers/ProjectIconController.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Project;
+use App\Services\ProjectIconStorageService;
+use Illuminate\Http\Response;
+
+class ProjectIconController extends Controller
+{
+    public function __invoke(string $project_uuid, ProjectIconStorageService $iconStorage): Response
+    {
+        $project = Project::ownedByCurrentTeam()->where('uuid', $project_uuid)->firstOrFail();
+        $contents = $iconStorage->projectContents($project);
+
+        abort_if($contents === null, 404);
+
+        return response($contents)->header('Content-Type', 'image/jpeg');
+    }
+}

app/Http/Kernel.php

@@ -20,8 +20,6 @@ use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\TrimStrings;
 use App\Http\Middleware\TrustHosts;
 use App\Http\Middleware\TrustProxies;
-use App\Http\Middleware\V5\EnsureCurrentTeam as V5EnsureCurrentTeam;
-use App\Http\Middleware\V5\HandleInertiaRequests as V5HandleInertiaRequests;
 use App\Http\Middleware\ValidateSignature;
 use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
@@ -82,23 +80,6 @@ class Kernel extends HttpKernel
 
         ],
 
-        'v5.web' => [
-            EncryptCookies::class,
-            AddQueuedCookiesToResponse::class,
-            StartSession::class,
-            ShareErrorsFromSession::class,
-            VerifyCsrfToken::class,
-            SubstituteBindings::class,
-            V5HandleInertiaRequests::class,
-        ],
-
-        'v5.authenticated' => [
-            'auth',
-            'verified',
-            'throttle:v5',
-            V5EnsureCurrentTeam::class,
-        ],
-
         'api' => [
             // \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
             ThrottleRequests::class.':api',

app/Jobs/ApplicationDeploymentJob.php

@@ -431,6 +431,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 ["docker version --format '{{.Server.Version}}'"],
                 $serverToCheck
             );
+            $serverToCheck->rememberDockerVersion($dockerVersion);
 
             $versionParts = explode('.', $dockerVersion);
             $majorVersion = (int) $versionParts[0];
@@ -3972,11 +3973,11 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
 
             if ($skipRemove) {
                 $this->execute_remote_command(
-                    ["docker stop --time=$timeout $containerName", 'hidden' => true, 'ignore_errors' => true]
+                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true]
                 );
             } else {
                 $this->execute_remote_command(
-                    ["docker stop --time=$timeout $containerName", 'hidden' => true, 'ignore_errors' => true],
+                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true],
                     ["docker rm -f $containerName", 'hidden' => true, 'ignore_errors' => true]
                 );
             }

app/Jobs/CheckAndStartSentinelJob.php

@@ -21,6 +21,10 @@ class CheckAndStartSentinelJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle(): void
     {
+        if (! $this->sentinelIsEnabled()) {
+            return;
+        }
+
         $latestVersion = get_latest_sentinel_version();
 
         // Check if sentinel is running
@@ -28,7 +32,7 @@ class CheckAndStartSentinelJob implements ShouldBeEncrypted, ShouldQueue
         $sentinelFoundJson = json_decode($sentinelFound, true);
         $sentinelStatus = data_get($sentinelFoundJson, '0.State.Status', 'exited');
         if ($sentinelStatus !== 'running') {
-            StartSentinel::run(server: $this->server, restart: true, latestVersion: $latestVersion);
+            $this->startSentinel($latestVersion);
 
             return;
         }
@@ -38,15 +42,31 @@ class CheckAndStartSentinelJob implements ShouldBeEncrypted, ShouldQueue
             $runningVersion = '0.0.0';
         }
         if ($latestVersion === '0.0.0' && $runningVersion === '0.0.0') {
-            StartSentinel::run(server: $this->server, restart: true, latestVersion: 'latest');
+            $this->startSentinel('latest');
 
             return;
         } else {
             if (version_compare($runningVersion, $latestVersion, '<')) {
-                StartSentinel::run(server: $this->server, restart: true, latestVersion: $latestVersion);
+                $this->startSentinel($latestVersion);
 
                 return;
             }
         }
     }
+
+    private function sentinelIsEnabled(): bool
+    {
+        $this->server->unsetRelation('settings');
+
+        return $this->server->isSentinelEnabled();
+    }
+
+    private function startSentinel(string $latestVersion): void
+    {
+        if (! $this->sentinelIsEnabled()) {
+            return;
+        }
+
+        StartSentinel::run(server: $this->server, restart: true, latestVersion: $latestVersion);
+    }
 }

app/Jobs/DatabaseBackupJob.php

@@ -18,6 +18,7 @@ use App\Notifications\Database\BackupFailed;
 use App\Notifications\Database\BackupSuccess;
 use App\Notifications\Database\BackupSuccessWithS3Warning;
 use App\Rules\SafeWebhookUrl;
+use App\Support\BackupCompression;
 use App\Support\ClickhouseBackupCommand;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
@@ -609,7 +610,8 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
             $escapedUsername = escapeshellarg($this->database->postgres_user);
             if ($this->backup->dump_all) {
-                $backupCommand .= " $this->container_name pg_dumpall --username $escapedUsername | gzip > $this->backup_location";
+                $backupCommand .= " $this->container_name pg_dumpall --username $escapedUsername";
+                $backupCommand = $this->buildCompressedDumpCommand($backupCommand).' > '.escapeshellarg($this->backup_location);
             } else {
                 // Validate and escape database name to prevent command injection
                 validateShellSafePath($database, 'database name');
@@ -635,7 +637,8 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $commands[] = 'mkdir -p '.$this->backup_dir;
             $escapedPassword = escapeshellarg($this->database->mysql_root_password);
             if ($this->backup->dump_all) {
-                $commands[] = "docker exec $this->container_name mysqldump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false --compress | gzip > $this->backup_location";
+                $dumpCommand = "docker exec $this->container_name mysqldump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false";
+                $commands[] = $this->buildCompressedDumpCommand($dumpCommand).' > '.escapeshellarg($this->backup_location);
             } else {
                 // Validate and escape database name to prevent command injection
                 validateShellSafePath($database, 'database name');
@@ -659,7 +662,8 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $commands[] = 'mkdir -p '.$this->backup_dir;
             $escapedPassword = escapeshellarg($this->database->mariadb_root_password);
             if ($this->backup->dump_all) {
-                $commands[] = "docker exec $this->container_name mariadb-dump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false --compress > $this->backup_location";
+                $dumpCommand = "docker exec $this->container_name mariadb-dump -u root -p$escapedPassword --all-databases --single-transaction --quick --lock-tables=false";
+                $commands[] = $this->buildCompressedDumpCommand($dumpCommand).' > '.escapeshellarg($this->backup_location);
             } else {
                 // Validate and escape database name to prevent command injection
                 validateShellSafePath($database, 'database name');
@@ -785,7 +789,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
 
             $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc alias set{$resolveOptions} temporary {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
             $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp {$escapedBackupLocation} {$escapedS3Destination}";
-            instant_remote_process($commands, $this->server, true, false, null, disableMultiplexing: true);
+            instant_remote_process($commands, $this->server, true, false, $this->timeout, disableMultiplexing: true);
 
             $this->s3_uploaded = true;
         } catch (Throwable $e) {
@@ -806,6 +810,15 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         return "{$helperImage}:{$latestVersion}";
     }
 
+    private function buildCompressedDumpCommand(string $dumpCommand): string
+    {
+        $cpuPercentage = BackupCompression::cpuPercentage($this->server->settings->backup_compression_cpu_percentage);
+        $compressorCommand = BackupCompression::compressorCommand($cpuPercentage);
+        $script = "compressor=\$({$compressorCommand}); exec \$compressor";
+
+        return $dumpCommand.' | docker run --rm -i '.escapeshellarg($this->getFullImageName()).' sh -c '.escapeshellarg($script);
+    }
+
     private function markStaleExecutionsAsFailed(): void
     {
         try {

app/Jobs/DeleteResourceJob.php

@@ -216,7 +216,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
 
         $containerList = implode(' ', array_map('escapeshellarg', $containerNames));
         $commands = [
-            "docker stop -t $timeout $containerList",
+            dockerStopCommand($timeout, $containerList, $server),
             "docker rm -f $containerList",
         ];
         instant_remote_process(

app/Jobs/PushServerUpdateJob.php

@@ -188,7 +188,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             Cache::forget($storageCacheKey);
         }
 
-        if ($this->containers->isEmpty()) {
+        if ($this->containers->isEmpty() && ! $this->isCompleteSnapshot()) {
             return;
         }
 
@@ -625,12 +625,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             return;
         }
 
-        // Only protection: Verify we received any container data at all
-        // If containers collection is completely empty, Sentinel might have failed
-        if ($this->containers->isEmpty()) {
-            return;
-        }
-
         // Batch update: mark all not-found applications as exited (excluding already exited ones)
         Application::whereIn('id', $notFoundApplicationIds)
             ->where('status', 'not like', 'exited%')
@@ -644,12 +638,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             return;
         }
 
-        // Only protection: Verify we received any container data at all
-        // If containers collection is completely empty, Sentinel might have failed
-        if ($this->containers->isEmpty()) {
-            return;
-        }
-
         // Collect IDs of previews that need to be marked as exited
         $previewIdsToUpdate = collect();
         foreach ($notFoundApplicationPreviewsIds as $previewKey) {
@@ -738,12 +726,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             return;
         }
 
-        // Only protection: Verify we received any container data at all
-        // If containers collection is completely empty, Sentinel might have failed
-        if ($this->containers->isEmpty()) {
-            return;
-        }
-
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {

app/Jobs/RestartProxyJob.php

@@ -98,7 +98,7 @@ class RestartProxyJob implements ShouldBeEncrypted, ShouldQueue
         // === STOP PHASE ===
         $commands = $commands->merge([
             "echo 'Stopping proxy...'",
-            "docker stop -t=$stopTimeout $containerName 2>/dev/null || true",
+            dockerStopCommand($stopTimeout, $containerName, $this->server).' 2>/dev/null || true',
             "docker rm -f $containerName 2>/dev/null || true",
             '# Wait for container to be fully removed',
             'for i in {1..15}; do',

app/Jobs/ScheduledJobManager.php

@@ -149,8 +149,8 @@ class ScheduledJobManager implements ShouldQueue
 
     private function processScheduledBackupsAndTasks(): void
     {
-        $lastBackupId = 0;
-        $lastTaskId = 0;
+        $lastBackupId = null;
+        $lastTaskId = null;
 
         do {
             $backups = $this->scheduledBackupQuery($lastBackupId)->get();
@@ -190,16 +190,16 @@ class ScheduledJobManager implements ShouldQueue
         }
     }
 
-    private function scheduledBackupQuery(int $lastBackupId): Builder
+    private function scheduledBackupQuery(?int $lastBackupId): Builder
     {
         return ScheduledDatabaseBackup::with(['database', 'team.subscription'])
             ->where('enabled', true)
-            ->where('id', '>', $lastBackupId)
+            ->when($lastBackupId !== null, fn (Builder $query) => $query->where('id', '>', $lastBackupId))
             ->orderBy('id')
             ->limit(self::CHUNK_SIZE);
     }
 
-    private function scheduledTaskQuery(int $lastTaskId): Builder
+    private function scheduledTaskQuery(?int $lastTaskId): Builder
     {
         return ScheduledTask::with([
             'service.destination.server.settings',
@@ -208,7 +208,7 @@ class ScheduledJobManager implements ShouldQueue
             'application.destination.server.team.subscription',
         ])
             ->where('enabled', true)
-            ->where('id', '>', $lastTaskId)
+            ->when($lastTaskId !== null, fn (Builder $query) => $query->where('id', '>', $lastTaskId))
             ->orderBy('id')
             ->limit(self::CHUNK_SIZE);
     }

app/Jobs/ServerConnectionCheckJob.php

@@ -194,6 +194,20 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
             $output = trim($output);
             if (! empty($output)) {
                 $dockerInfo = json_decode($output, true);
+                $dockerVersion = dockerEngineVersionFromJson($output);
+                if ($dockerVersion !== null) {
+                    $this->server->rememberDockerVersion($dockerVersion);
+                }
+
+                $composeOutput = instant_remote_process_with_timeout(
+                    ['docker compose version --short'],
+                    $this->server,
+                    false
+                );
+                $composeVersion = parseDockerEngineVersion($composeOutput);
+                if ($composeVersion !== null) {
+                    $this->server->rememberComposeVersion($composeVersion);
+                }
 
                 return isset($dockerInfo['Server']['Version']);
             }

app/Jobs/VolumeBackupJob.php

@@ -8,6 +8,7 @@ use App\Models\ScheduledVolumeBackup;
 use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Rules\SafeWebhookUrl;
+use App\Support\BackupCompression;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -77,14 +78,19 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $source = $this->backup->sourcePath();
             $containerName = 'volume-backup-'.$this->execution->uuid;
             $image = coolifyHelperImage().':'.getHelperVersion();
+            $compressionCpuPercentage = BackupCompression::cpuPercentage($server->settings->backup_compression_cpu_percentage);
+            $this->logCompressorInDevelopment($image, $server, $compressionCpuPercentage);
             $verifySourceCommand = $target instanceof LocalPersistentVolume && blank($target->host_path)
                 ? 'docker volume inspect '.escapeshellarg($source).' >/dev/null'
                 : 'test -d '.escapeshellarg($source);
 
+            $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
+            $archiveScript = "compressor=\$({$compressorCommand}); tar -I \"\$compressor\" -cf - -C /volume .";
             $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
                 .' -v '.escapeshellarg($source.':/volume:ro')
                 .' '.escapeshellarg($image)
-                .' tar -czf - -C /volume . > '.escapeshellarg($backupLocation);
+                .' sh -c '.escapeshellarg($archiveScript)
+                .' > '.escapeshellarg($backupLocation);
 
             if ($this->backup->stop_during_backup) {
                 $containers = $this->containersUsingVolume($source, $server);
@@ -332,6 +338,29 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function logCompressorInDevelopment(string $image, Server $server, int $compressionCpuPercentage): void
+    {
+        if (! isDev()) {
+            return;
+        }
+
+        $script = BackupCompression::compressorCommand($compressionCpuPercentage);
+        $compressor = instant_remote_process(
+            ['docker run --rm '.escapeshellarg($image).' sh -c '.escapeshellarg($script)],
+            $server,
+            timeout: 60,
+            disableMultiplexing: true,
+        );
+
+        Log::info('Volume backup compressor selected', [
+            'backup_id' => $this->backup->id,
+            'execution_id' => $this->execution?->id,
+            'compressor' => $compressor,
+            'helper_image' => $image,
+            'cpu_percentage' => $compressionCpuPercentage,
+        ]);
+    }
+
     private function removeExpiredBackups(Server $server): void
     {
         if ($this->hasRetentionLimits(

app/Livewire/Notifications/Email.php

@@ -302,7 +302,7 @@ class Email extends Component
             $this->resetErrorBag();
             $this->validate([
                 'resendEnabled' => 'boolean',
-                'resendApiKey' => 'required|string',
+                'resendApiKey' => $this->resendEnabled ? 'required|string' : 'nullable|string',
                 'smtpFromAddress' => 'required|email',
                 'smtpFromName' => 'required|string',
             ], [

app/Livewire/Profile/Index.php

@@ -38,7 +38,7 @@ class Index extends Component
 
     public $avatar;
 
-    public function uploadAvatar(AvatarStorageService $avatarStorage): void
+    public function uploadAvatar(AvatarStorageService $avatarStorage): bool
     {
         try {
             $this->validate([
@@ -49,8 +49,12 @@ class Index extends Component
             $this->reset('avatar');
             $this->dispatch('avatar-updated', url: route('profile.avatar', ['v' => Auth::user()->fresh()->updated_at->timestamp]));
             $this->dispatch('success', 'Profile picture updated.');
+
+            return true;
         } catch (\Throwable $e) {
             handleError($e, $this);
+
+            return false;
         }
     }
 

app/Livewire/Project/Application/Deployment/Index.php

@@ -22,6 +22,14 @@ class Index extends Component
 
     public int $defaultTake = 10;
 
+    public function updatedDefaultTake(): void
+    {
+        $this->defaultTake = max(1, min(100, $this->defaultTake));
+
+        $this->skip = 0;
+        $this->loadDeployments();
+    }
+
     public bool $showNext = false;
 
     public bool $showPrev = false;
@@ -65,10 +73,11 @@ class Index extends Component
         if (! $project) {
             return redirect()->route('dashboard');
         }
-        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first()->load(['applications']);
+        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first();
         if (! $environment) {
-            return redirect()->route('dashboard');
+            abort(404);
         }
+        $environment->load(['applications']);
         $application = $environment->applications->where('uuid', request()->route('application_uuid'))->first();
         if (! $application) {
             return redirect()->route('dashboard');

app/Livewire/Project/Application/Deployment/Show.php

@@ -39,10 +39,11 @@ class Show extends Component
         if (! $project) {
             return redirect()->route('dashboard');
         }
-        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first()->load(['applications']);
+        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first();
         if (! $environment) {
-            return redirect()->route('dashboard');
+            abort(404);
         }
+        $environment->load(['applications']);
         $application = $environment->applications->where('uuid', request()->route('application_uuid'))->first();
         if (! $application) {
             return redirect()->route('dashboard');

app/Livewire/Project/Application/Domains.php

@@ -41,10 +41,6 @@ class Domains extends Component
 
     public string $editingDomain = '';
 
-    public string $editingIndexing = 'index';
-
-    public string $editingDirection = 'both';
-
     public ?string $editingService = null;
 
     /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool}> */
@@ -103,8 +99,6 @@ class Domains extends Component
         return [
             'newDomain' => ValidationPatterns::applicationDomainRules(),
             'editingDomain' => ValidationPatterns::applicationDomainRules(),
-            'editingIndexing' => 'string|in:index,noindex',
-            'editingDirection' => 'string|in:both,www,non-www',
             'redirect' => 'string|required|in:both,www,non-www',
             'serviceRedirects' => 'array',
             'serviceRedirects.*' => 'string|in:both,www,non-www',
@@ -151,6 +145,12 @@ class Domains extends Component
         $this->dispatch('success', 'Search engine indexing updated.');
     }
 
+    public function updateRedirect(string $redirect): void
+    {
+        $this->redirect = $redirect;
+        $this->setRedirect();
+    }
+
     public function loadDomainState(): void
     {
         $this->application->refresh();
@@ -293,9 +293,6 @@ class Domains extends Component
                     $configured[] = $row;
                 }
 
-                foreach ($this->buildSuggestedWwwRows($configured, $stored, $serviceName) as $suggested) {
-                    $rows[] = $suggested;
-                }
             }
 
             return $this->sortDomainRowsByDnsStatus($rows);
@@ -305,7 +302,7 @@ class Domains extends Component
             $rows[] = $this->domainRowFromStored($url, null, $stored);
         }
 
-        return $this->sortDomainRowsByDnsStatus(array_merge($rows, $this->buildSuggestedWwwRows($rows, $stored)));
+        return $this->sortDomainRowsByDnsStatus($rows);
     }
 
     /**
@@ -912,8 +909,6 @@ class Domains extends Component
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingService = $this->domainRows[$index]['service'];
-        $this->editingDirection = $this->serviceRedirectFor($this->editingService);
-        $this->editingIndexing = $this->application->isDomainNoindexed($this->editingDomain) ? 'noindex' : 'index';
         $this->resetEditDomainDnsGate();
         $this->resetErrorBag('editingDomain');
         $this->showEditDomainModal = true;
@@ -996,8 +991,6 @@ class Domains extends Component
         $this->editingIndex = null;
         $this->editingDomain = '';
         $this->editingService = null;
-        $this->editingDirection = 'both';
-        $this->editingIndexing = 'index';
         $this->resetEditDomainDnsGate();
         $this->resetErrorBag('editingDomain');
         if ($this->pendingAction === 'update') {
@@ -1040,6 +1033,7 @@ class Domains extends Component
             $newUrl = $this->splitDomains($normalized)[0];
             $oldUrl = $this->domainRows[$this->editingIndex]['url'];
             $service = $this->editingService;
+            $wasNoindexed = $this->application->isDomainNoindexed($oldUrl);
 
             $current = $this->currentDomainList($service);
             if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
@@ -1066,20 +1060,13 @@ class Domains extends Component
             }
 
             $noindexDomains = $this->application->noindexDomains()->reject(fn (string $domain) => $domain === $oldUrl);
-            if ($this->editingIndexing === 'noindex') {
+            if ($wasNoindexed) {
                 $noindexDomains->push($newUrl);
             }
             $this->application->setNoindexDomains($noindexDomains);
             $this->application->save();
             $this->resetDefaultLabels();
 
-            if ($this->isCompose && filled($service) && $this->editingDirection !== $this->savedRedirectForService($service)) {
-                $this->serviceRedirects[$this->serviceRedirectWireKey($service)] = $this->editingDirection;
-                $this->notifyRedirectUpdate = false;
-                $this->setServiceRedirect($service);
-                $this->notifyRedirectUpdate = true;
-            }
-
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
             $this->cancelEdit();
@@ -1237,6 +1224,12 @@ class Domains extends Component
         }
     }
 
+    public function updateServiceRedirect(string $serviceName, string $redirect): void
+    {
+        $this->serviceRedirects[$this->serviceRedirectWireKey($serviceName)] = $redirect;
+        $this->setServiceRedirect($serviceName);
+    }
+
     /**
      * @param  mixed  ...$modalArgs  Extra args from modal-confirmation (password, etc.)
      */

app/Livewire/Project/Application/Previews.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Application;
 
 use App\Actions\Docker\GetContainersStatus;
+use App\Events\ServiceStatusChanged;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
@@ -354,7 +355,7 @@ class Previews extends Component
 
         foreach ($containersToStop as $containerName) {
             instant_remote_process(command: [
-                "docker stop --time=$timeout $containerName",
+                dockerStopCommand($timeout, $containerName, $server),
                 "docker rm -f $containerName",
             ], server: $server, throwError: false);
         }
@@ -373,6 +374,11 @@ class Previews extends Component
                 $this->stopContainers($containers, $server);
             }
 
+            ApplicationPreview::where('application_id', $this->application->id)
+                ->where('pull_request_id', $pull_request_id)
+                ->update(['status' => 'exited']);
+            ServiceStatusChanged::dispatch($this->application->environment->project->team->id);
+
             GetContainersStatus::run($server);
             $this->application->refresh();
             $this->dispatch('containerStatusUpdated');

app/Livewire/Project/Database/Backup/Execution.php

@@ -26,10 +26,11 @@ class Execution extends Component
         if (! $project) {
             return redirect()->route('dashboard');
         }
-        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first()->load(['applications']);
+        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first();
         if (! $environment) {
-            return redirect()->route('dashboard');
+            abort(404);
         }
+        $environment->load(['applications']);
         $database = $environment->databases()->where('uuid', request()->route('database_uuid'))->first();
         if (! $database) {
             return redirect()->route('dashboard');

app/Livewire/Project/Database/Backup/Index.php

@@ -14,10 +14,11 @@ class Index extends Component
         if (! $project) {
             return redirect()->route('dashboard');
         }
-        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first()->load(['applications']);
+        $environment = $project->load(['environments'])->environments->where('uuid', request()->route('environment_uuid'))->first();
         if (! $environment) {
-            return redirect()->route('dashboard');
+            abort(404);
         }
+        $environment->load(['applications']);
         $database = $environment->databases()->where('uuid', request()->route('database_uuid'))->first();
         if (! $database) {
             return redirect()->route('dashboard');

app/Livewire/Project/Database/Health.php

@@ -66,7 +66,7 @@ class Health extends Component
             $this->authorize('update', $this->database);
             $this->syncData(true);
             $updateSuccessful = true;
-            $this->dispatch('success', 'Health check updated. Restart the database to apply the changes.');
+            $this->dispatch('success', 'Healthcheck updated. Restart the database to apply the changes.');
         } catch (\Throwable $e) {
             handleError($e, $this);
         }
@@ -87,7 +87,7 @@ class Health extends Component
             $this->healthCheckEnabled = ! $this->healthCheckEnabled;
             $this->syncData(true);
             $updateSuccessful = true;
-            $this->dispatch('success', 'Health check '.($this->healthCheckEnabled ? 'enabled' : 'disabled').'. Restart the database to apply the changes.');
+            $this->dispatch('success', 'Healthcheck '.($this->healthCheckEnabled ? 'enabled' : 'disabled').'. Restart the database to apply the changes.');
         } catch (\Throwable $e) {
             handleError($e, $this);
         }

app/Livewire/Project/Database/ImportForm.php

@@ -812,14 +812,13 @@ EOD;
         // /* ... */ block comment (used to split keywords like FROM/**/PROGRAM).
         $sep = '([[:space:]]|/\\*[^*]*\\*/)';
 
-        $pattern = implode('|', [
-            "copy{$sep}+[^;]*(from|to){$sep}+program",
-            '(^|[[:space:]])\\\\!',
-            "(^|[[:space:]])\\\\(o|g){$sep}*\\|",
-        ]);
-        $escapedPattern = escapeshellarg($pattern);
+        $sqlPattern = "(^|;){$sep}*copy{$sep}+[^;]*(from|to){$sep}+program";
+        $psqlPattern = "^{$sep}*\\\\(!|copy{$sep}+[^[:space:]]+.*{$sep}+program|(o|g){$sep}*\\|)";
+        $escapedSqlPattern = escapeshellarg($sqlPattern);
+        $escapedPsqlPattern = escapeshellarg($psqlPattern);
+        $contents = "{ gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}; }";
 
-        return "if (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | sed 's/--.*//' | tr '\n\r\t' '   ' | grep -Eiq {$escapedPattern}; then echo 'Blocked PostgreSQL restore: COPY ... PROGRAM and psql shell commands are not allowed.'; exit 1; fi";
+        return "header=\$({$contents} | head -c 5); if [ \"\$header\" = 'PGDMP' ]; then exit 0; fi; if {$contents} | sed 's/--.*//' | grep -Eiq {$escapedPsqlPattern} || {$contents} | sed 's/--.*//' | tr '\n\r\t' '   ' | grep -Eiq {$escapedSqlPattern}; then echo 'Blocked PostgreSQL restore: COPY ... PROGRAM and psql shell commands are not allowed.'; exit 1; fi";
     }
 
     private function addRestoreSafetyCheckCommand(array &$commands, string $tmpPath): void

app/Livewire/Project/Edit.php

@@ -3,13 +3,16 @@
 namespace App\Livewire\Project;
 
 use App\Models\Project;
+use App\Services\ProjectIconStorageService;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
+use Livewire\WithFileUploads;
 
 class Edit extends Component
 {
     use AuthorizesRequests;
+    use WithFileUploads;
 
     public Project $project;
 
@@ -17,6 +20,40 @@ class Edit extends Component
 
     public ?string $description = null;
 
+    public $icon;
+
+    public function uploadIcon(ProjectIconStorageService $iconStorage): bool
+    {
+        try {
+            $this->authorize('update', $this->project);
+            $this->validate([
+                'icon' => ['required', 'image', 'mimes:jpg,jpeg,png,webp', 'max:5120', 'dimensions:max_width=6000,max_height=6000'],
+            ]);
+            $iconStorage->storeProject($this->project, $this->icon);
+            $this->reset('icon');
+            $this->project->refresh();
+            $this->dispatch('success', 'Project icon updated.');
+
+            return true;
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return false;
+        }
+    }
+
+    public function removeIcon(ProjectIconStorageService $iconStorage): void
+    {
+        try {
+            $this->authorize('update', $this->project);
+            $iconStorage->deleteProject($this->project);
+            $this->project->refresh();
+            $this->dispatch('success', 'Project icon removed.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     protected function rules(): array
     {
         return [

app/Livewire/Project/Index.php

@@ -53,6 +53,10 @@ class Index extends Component
                     'uuid' => $project->uuid,
                     'name' => $project->name,
                     'description' => $project->description,
+                    'iconUrl' => $project->icon_path ? route('project.icon', [
+                        'project_uuid' => $project->uuid,
+                        'v' => $project->updated_at->timestamp,
+                    ]) : null,
                     'href' => $project->navigateTo(),
                     'environmentCount' => $project->environments->count(),
                     'resourceCount' => $resourceCount,

app/Livewire/Project/Resource/Index.php

@@ -4,8 +4,6 @@ namespace App\Livewire\Project\Resource;
 
 use App\Models\Environment;
 use App\Models\Project;
-use App\Models\V5\Application as V5Application;
-use App\Support\V5\V5Feature;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 
@@ -72,10 +70,6 @@ class Index extends Component
             'clickhouses:id,uuid,name,environment_id',
         ];
 
-        if (V5Feature::enabled()) {
-            $environmentRelations[] = 'v5Applications:id,uuid,name,environment_id,status';
-        }
-
         $this->allEnvironments = $project->environments()
             ->select('id', 'uuid', 'name', 'project_id')
             ->with($environmentRelations)
@@ -111,24 +105,6 @@ class Index extends Component
 
             return $application;
         });
-        if (V5Feature::enabled()) {
-            $this->applications = $this->applications->merge(V5Application::query()
-                ->where('team_id', currentTeam()->id)
-                ->where('project_id', $this->project->id)
-                ->where('environment_id', $this->environment->id)
-                ->with('server:id,name')
-                ->get()
-                ->map(function (V5Application $application) use ($projectUuid, $environmentUuid) {
-                    $application->hrefLink = route('v5.dashboard', [
-                        'project' => $projectUuid,
-                        'environment' => $environmentUuid,
-                        'application' => $application->uuid,
-                    ]);
-
-                    return $application;
-                }));
-        }
-
         $this->applications = $this->applications->sortBy('name');
 
         // Load all database resources in a single query per type
@@ -207,21 +183,18 @@ class Index extends Component
             'uuid' => $item->uuid,
             'name' => $item->name,
             'type' => $type,
-            'typeLabel' => $item instanceof V5Application ? 'Application (V5)' : $typeLabel,
+            'typeLabel' => $typeLabel,
             'fqdn' => $item->fqdn ?? null,
-            'description' => $item instanceof V5Application ? 'Managed by Coolify V5' : ($item->description ?? null),
+            'description' => $item->description ?? null,
             'status' => $item->status ?? '',
-            'version' => $item instanceof V5Application ? 'v5' : 'v4',
             'server_status' => $item->server_status ?? null,
             'hrefLink' => $item->hrefLink ?? '',
             'destination' => [
                 'server' => [
-                    'name' => $item instanceof V5Application
-                        ? ($item->server?->name ?? 'Unknown')
-                        : ($item->destination?->server?->name ?? 'Unknown'),
+                    'name' => $item->destination?->server?->name ?? 'Unknown',
                 ],
             ],
-            'tags' => ($item instanceof V5Application ? collect() : $item->tags)->map(fn ($tag) => [
+            'tags' => $item->tags->map(fn ($tag) => [
                 'id' => $tag->id,
                 'name' => $tag->name,
             ])->values()->toArray(),

app/Livewire/Project/Service/Domains.php

@@ -7,6 +7,7 @@ use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
@@ -46,10 +47,6 @@ class Domains extends Component
 
     public string $editingDomain = '';
 
-    public string $editingDirection = 'both';
-
-    public string $editingIndexing = 'index';
-
     public ?int $editingServiceApplicationId = null;
 
     public bool $showEditDomainModal = false;
@@ -102,8 +99,6 @@ class Domains extends Component
         return [
             'newDomain' => ValidationPatterns::applicationDomainRules(),
             'editingDomain' => ValidationPatterns::applicationDomainRules(),
-            'editingDirection' => 'string|in:both,www,non-www',
-            'editingIndexing' => 'string|in:index,noindex',
             'newServiceApplicationId' => 'nullable|integer',
             'serviceRedirects' => 'array',
             'serviceRedirects.*' => 'string|in:both,www,non-www',
@@ -135,6 +130,7 @@ class Domains extends Component
         $application->setNoindexDomains($domains);
         $application->save();
         $this->service->parse();
+        $this->refreshDomains();
         $this->dispatch('configurationChanged')->to(ConfigurationChecker::class);
         $this->dispatch('success', 'Search engine indexing updated.');
     }
@@ -226,9 +222,6 @@ class Domains extends Component
                 $configured[] = $row;
             }
 
-            foreach ($this->buildSuggestedWwwRows($configured, $app, $stored) as $suggested) {
-                $rows[] = $suggested;
-            }
         }
 
         return collect($rows)
@@ -924,9 +917,6 @@ class Domains extends Component
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingServiceApplicationId = (int) $this->domainRows[$index]['service_application_id'];
-        $app = $this->findServiceApp($this->editingServiceApplicationId);
-        $this->editingDirection = $this->normalizeRedirect($app?->redirect);
-        $this->editingIndexing = $app?->isDomainNoindexed($this->editingDomain) ? 'noindex' : 'index';
         $this->editDomainDnsFailed = false;
         $this->editDomainDnsMessage = '';
         $this->forceSaveEditDns = false;
@@ -940,8 +930,6 @@ class Domains extends Component
         $this->editingIndex = null;
         $this->editingDomain = '';
         $this->editingServiceApplicationId = null;
-        $this->editingDirection = 'both';
-        $this->editingIndexing = 'index';
         $this->editDomainDnsFailed = false;
         $this->editDomainDnsMessage = '';
         $this->forceSaveEditDns = false;
@@ -974,6 +962,7 @@ class Domains extends Component
             $newUrl = $this->splitDomains($normalized)[0];
             $oldUrl = $this->domainRows[$this->editingIndex]['url'];
             $current = collect($this->splitDomains($app->fqdn));
+            $wasNoindexed = $app->isDomainNoindexed($oldUrl);
 
             if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured for this service.");
@@ -1000,18 +989,12 @@ class Domains extends Component
             }
 
             $noindexDomains = $app->noindexDomains()->reject(fn (string $domain) => $domain === $oldUrl);
-            if ($this->editingIndexing === 'noindex') {
+            if ($wasNoindexed) {
                 $noindexDomains->push($newUrl);
             }
             $app->setNoindexDomains($noindexDomains);
             $app->save();
 
-            if ($this->editingDirection !== $this->normalizeRedirect($app->redirect)) {
-                $this->notifyRedirectUpdate = false;
-                $this->updateServiceRedirect((int) $app->id, $this->editingDirection);
-                $this->notifyRedirectUpdate = true;
-            }
-
             $this->cancelEdit();
             $this->dispatch('edit-domain-saved');
             $this->forceSaveDomains = false;
@@ -1140,12 +1123,9 @@ class Domains extends Component
             $domain = generateUrl(server: $server, random: new_public_id());
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null) {
-                $parts = parse_url($domain);
-                if (is_array($parts) && empty($parts['port'])) {
-                    $scheme = $parts['scheme'] ?? 'https';
-                    $host = $parts['host'] ?? '';
-                    $path = $parts['path'] ?? '';
-                    $domain = "{$scheme}://{$host}:{$requiredPort}{$path}";
+                $parts = DomainUrlParts::split($domain);
+                if ($parts['port'] === '') {
+                    $domain = DomainUrlParts::compose($parts['scheme'], $parts['host'], (string) $requiredPort, $parts['path']);
                 }
             }
 

app/Livewire/Project/Service/StackForm.php

@@ -101,6 +101,7 @@ class StackForm extends Component
                 $rules = data_get($field, 'rules', 'nullable');
                 $isPassword = data_get($field, 'isPassword', false);
                 $customHelper = data_get($field, 'customHelper', false);
+                $sortOrder = data_get($field, 'sortOrder');
                 $this->fields->put($key, [
                     'serviceName' => $serviceName,
                     'key' => $key,
@@ -109,6 +110,7 @@ class StackForm extends Component
                     'isPassword' => $isPassword,
                     'rules' => $rules,
                     'customHelper' => $customHelper,
+                    'sortOrder' => $sortOrder,
                 ]);
 
                 $this->validationAttributes["fields.$key.value"] = $fieldKey;
@@ -116,7 +118,7 @@ class StackForm extends Component
         }
         $this->fields = $this->fields->groupBy('serviceName')->map(function ($group) {
             return $group->sortBy(function ($field) {
-                return data_get($field, 'isPassword') ? 1 : 0;
+                return data_get($field, 'sortOrder') ?? (data_get($field, 'isPassword') ? 1 : 0);
             })->mapWithKeys(function ($field) {
                 return [$field['key'] => $field];
             });

app/Livewire/Project/Shared/EnvironmentVariable/All.php

@@ -44,6 +44,14 @@ class All extends Component
 
     public int $perPage = 10;
 
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+
+        $this->page = 1;
+        $this->clearEnvironmentVariableCaches();
+    }
+
     public bool $is_env_sorting_enabled = false;
 
     public bool $use_build_secrets = false;
@@ -714,6 +722,12 @@ class All extends Component
         // Extract all hard-coded variables
         $hardcodedVars = extractHardcodedEnvironmentVariables($dockerComposeRaw);
 
+        // Compose self-references are inputs supplied through Coolify's .env file,
+        // not hard-coded values. Keep them editable in the environment variables UI.
+        $hardcodedVars = $hardcodedVars->reject(
+            fn (array $variable): bool => $this->isSelfReferencingComposeVariable($variable)
+        );
+
         // Filter out magic variables (SERVICE_FQDN_*, SERVICE_URL_*, SERVICE_NAME_*)
         $hardcodedVars = $hardcodedVars->filter(function ($var) {
             $key = $var['key'];
@@ -755,7 +769,14 @@ class All extends Component
             return [];
         }
 
-        return extractHardcodedEnvironmentVariables($dockerComposeRaw)
+        $assignments = extractHardcodedEnvironmentVariables($dockerComposeRaw);
+        $editableKeys = $assignments
+            ->filter(fn (array $variable): bool => $this->isSelfReferencingComposeVariable($variable))
+            ->pluck('key')
+            ->unique();
+
+        return $assignments
+            ->reject(fn (array $variable): bool => $editableKeys->contains($variable['key']))
             ->pluck('key')
             ->reject(fn (string $key): bool => str($key)->startsWith(['SERVICE_FQDN_', 'SERVICE_URL_', 'SERVICE_NAME_']))
             ->unique()
@@ -763,6 +784,28 @@ class All extends Component
             ->all();
     }
 
+    private function isSelfReferencingComposeVariable(array $variable): bool
+    {
+        $value = $variable['value'] ?? null;
+        if (! is_string($value)) {
+            return false;
+        }
+
+        if ($value === '$'.$variable['key']) {
+            return true;
+        }
+
+        $reference = extractBalancedBraceContent($value);
+        if ($reference === null || $reference['start'] !== 1 || $reference['end'] !== strlen($value) - 1) {
+            return false;
+        }
+
+        $splitReference = splitOnOperatorOutsideNested($reference['content']);
+        $referencedKey = $splitReference['variable'] ?? $reference['content'];
+
+        return $referencedKey === $variable['key'];
+    }
+
     public function getDevView()
     {
         $this->variables = $this->formatEnvironmentVariables($this->getEnvironmentVariables(false, false));

app/Livewire/Project/Shared/ExecuteContainerCommand.php

@@ -69,6 +69,9 @@ class ExecuteContainerCommand extends Component
             $this->type = 'service';
             $this->resource = Service::ownedByCurrentTeam()->where('uuid', $this->parameters['service_uuid'])->firstOrFail();
             $this->authorize('view', $this->resource);
+            if (! $this->resource->isRunning()) {
+                $this->containersLoaded = true;
+            }
             if ($this->resource->server->isFunctional()) {
                 $this->servers = $this->servers->push($this->resource->server);
             }

app/Livewire/Project/Shared/HealthChecks.php

@@ -151,7 +151,7 @@ class HealthChecks extends Component
         $this->resource->health_check_start_period = $this->healthCheckStartPeriod;
         $this->resource->custom_healthcheck_found = $this->customHealthcheckFound;
         $this->resource->save();
-        $this->dispatch('success', 'Health check updated.');
+        $this->dispatch('success', 'Healthcheck updated.');
         $this->dispatch('configurationChanged');
     }
 
@@ -178,7 +178,7 @@ class HealthChecks extends Component
             $this->resource->health_check_start_period = $this->healthCheckStartPeriod;
             $this->resource->custom_healthcheck_found = $this->customHealthcheckFound;
             $this->resource->save();
-            $this->dispatch('success', 'Health check updated.');
+            $this->dispatch('success', 'Healthcheck updated.');
             $this->dispatch('configurationChanged');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -211,9 +211,9 @@ class HealthChecks extends Component
             $this->resource->save();
 
             if ($this->healthCheckEnabled && ! $wasEnabled && $this->resource->isRunning()) {
-                $this->dispatch('info', 'Health check has been enabled. A restart is required to apply the new settings.');
+                $this->dispatch('info', 'Healthcheck has been enabled. A restart is required to apply the new settings.');
             } else {
-                $this->dispatch('success', 'Health check '.($this->healthCheckEnabled ? 'enabled' : 'disabled').'.');
+                $this->dispatch('success', 'Healthcheck '.($this->healthCheckEnabled ? 'enabled' : 'disabled').'.');
             }
             $this->dispatch('configurationChanged');
         } catch (\Throwable $e) {

app/Livewire/Project/Shared/Storages/All.php

@@ -21,7 +21,7 @@ class All extends Component
     /**
      * Editable form state keyed by storage id.
      *
-     * @var array<int|string, array{name: string, mountPath: string, hostPath: ?string, isPreviewSuffixEnabled: bool, isReadOnly: bool}>
+     * @var array<int|string, array{name: string, mountPath: string, hostPath: ?string, isPreviewSuffixEnabled: bool, isReadOnly: bool, canDeleteStale: bool}>
      */
     public array $forms = [];
 
@@ -42,13 +42,16 @@ class All extends Component
 
     public bool $canUpdate = false;
 
+    public bool $deleteDockerVolume = false;
+
     protected $listeners = ['refreshStorages' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
 
     public function mount(): void
     {
         $this->canUpdate = (bool) auth()->user()?->can('update', $this->resource);
         $this->supportsPreviewSuffix = $this->resource instanceof Application
-            && $this->resource->git_based();
+            && $this->resource->git_based()
+            && filled($this->resource->git_repository);
         $this->showActionsColumn = $this->canUpdate;
         $this->showBackupAction = $this->resource instanceof Application
             || $this->resource instanceof ServiceApplication
@@ -129,12 +132,35 @@ class All extends Component
 
         $storage = $this->findStorageOrFail($storageId);
 
+        if ($this->isComposeOrService && $storage->isDeclaredInCompose()) {
+            $this->dispatch('error', 'This volume is managed by the current Docker Compose file.');
+
+            return false;
+        }
+
         if ($storage->scheduledBackups()->exists()) {
             $this->dispatch('error', 'Delete this volume backup schedule and its archives before deleting the volume.');
 
             return false;
         }
 
+        $this->deleteDockerVolume = in_array('deleteDockerVolume', $selectedActions, true);
+        if ($this->deleteDockerVolume) {
+            $server = $this->resource instanceof Application
+                ? $this->resource->destination->server
+                : $this->resource->service->server;
+
+            try {
+                instant_remote_process([
+                    'docker volume rm -f '.escapeshellarg($storage->name),
+                ], $server);
+            } catch (\Throwable $exception) {
+                $this->dispatch('error', 'Failed to delete the Docker volume: '.$exception->getMessage());
+
+                return false;
+            }
+        }
+
         $storage->delete();
         $this->refreshList();
         $this->dispatch('refreshStorages');
@@ -169,6 +195,9 @@ class All extends Component
                 'hostPath' => $storage->host_path,
                 'isPreviewSuffixEnabled' => (bool) ($storage->is_preview_suffix_enabled ?? true),
                 'isReadOnly' => $storage->shouldBeReadOnlyInUI() || ! $this->canUpdate,
+                'canDeleteStale' => $this->canUpdate
+                    && ($storage->isServiceResource() || $storage->isDockerComposeResource())
+                    && ! $storage->isDeclaredInCompose(),
             ];
         }
         $this->forms = $forms;

app/Livewire/Project/Shared/Storages/Show.php

@@ -105,6 +105,7 @@ class Show extends Component
         // PR deployment volume suffixes only apply to git-based applications.
         $this->supportsPreviewSuffix = $this->resource instanceof Application
             && $this->resource->git_based()
+            && filled($this->resource->git_repository)
             && ! $this->isService;
         // Parent All batches badge/url; isolated embeds still hydrate themselves.
         if (! $this->backupMetaHydrated) {

app/Livewire/Project/Shared/Storages/VolumeBackups.php

@@ -58,6 +58,15 @@ class VolumeBackups extends Component
 
     public int $timeout = 3600;
 
+    public int $perPage = 10;
+
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+
+        $this->resetPage();
+    }
+
     public bool $delete_backup_s3 = false;
 
     public Collection $availableS3Storages;
@@ -316,7 +325,7 @@ class VolumeBackups extends Component
 
     public function render()
     {
-        $executions = $this->backup?->executions()->paginate(10);
+        $executions = $this->backup?->executions()->paginate($this->perPage);
 
         return view('livewire.project.shared.storages.volume-backups', [
             'executions' => $executions ?? collect(),

app/Livewire/Security/PrivateKey/Show.php

@@ -151,6 +151,9 @@ class Show extends Component
             refresh_server_connection($this->private_key);
             $this->dispatch('success', 'Private key updated.');
             $this->dispatch('securityResourceChanged');
+            if ($this->modalMode) {
+                $this->dispatch('close-modal');
+            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }

app/Livewire/Server/Advanced.php

@@ -27,6 +27,9 @@ class Advanced extends Component
     #[Validate(['required', 'integer', 'min:1'])]
     public int|string $deploymentQueueLimit = 25;
 
+    #[Validate(['required', 'integer', 'in:25,50,75,100'])]
+    public int|string $backupCompressionCpuPercentage = 25;
+
     public function mount(string $server_uuid)
     {
         try {
@@ -47,6 +50,7 @@ class Advanced extends Component
             $this->server->settings->concurrent_builds = $this->concurrentBuilds;
             $this->server->settings->dynamic_timeout = $this->dynamicTimeout;
             $this->server->settings->deployment_queue_limit = $this->deploymentQueueLimit;
+            $this->server->settings->backup_compression_cpu_percentage = $this->backupCompressionCpuPercentage;
             $this->server->settings->server_disk_usage_notification_threshold = $this->serverDiskUsageNotificationThreshold;
             $this->server->settings->server_disk_usage_check_frequency = $this->serverDiskUsageCheckFrequency;
             $this->server->settings->save();
@@ -54,6 +58,7 @@ class Advanced extends Component
             $this->concurrentBuilds = $this->server->settings->concurrent_builds;
             $this->dynamicTimeout = $this->server->settings->dynamic_timeout;
             $this->deploymentQueueLimit = $this->server->settings->deployment_queue_limit;
+            $this->backupCompressionCpuPercentage = $this->server->settings->backup_compression_cpu_percentage;
             $this->serverDiskUsageNotificationThreshold = $this->server->settings->server_disk_usage_notification_threshold;
             $this->serverDiskUsageCheckFrequency = $this->server->settings->server_disk_usage_check_frequency;
         }

app/Livewire/Server/Show.php

@@ -371,6 +371,8 @@ class Show extends Component
                 $this->server->settings->is_usable = $this->isUsable = true;
                 $this->server->settings->save();
                 ServerReachabilityChanged::dispatch($this->server);
+                $this->server->gatherServerMetadata();
+                $this->server->refresh();
             } else {
                 $this->dispatch('error', 'Server is not reachable.', 'Please validate your configuration and connection.<br><br>Check this <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br>Error: '.$error);
 
@@ -671,12 +673,18 @@ class Show extends Component
     {
         try {
             $this->authorize('update', $this->server);
+            if (! $this->server->isFunctional()) {
+                $this->dispatch('error', 'Validate the server connection before fetching details.');
+
+                return;
+            }
+
             $result = $this->server->gatherServerMetadata();
             if ($result) {
-                $this->server->refresh();
+                $this->server->refresh()->load('settings');
                 $this->dispatch('success', 'Server details refreshed.');
             } else {
-                $this->dispatch('error', 'Could not fetch server details. Is the server reachable?');
+                $this->dispatch('error', 'Could not collect server details. Check the application logs for the remote command output.');
             }
         } catch (\Throwable $e) {
             handleError($e, $this);

app/Livewire/SettingsEmail.php

@@ -203,7 +203,7 @@ class SettingsEmail extends Component
             $this->authorize('update', $this->settings);
             $this->validate([
                 'resendEnabled' => 'boolean',
-                'resendApiKey' => 'required|string',
+                'resendApiKey' => $this->resendEnabled ? 'required|string' : 'nullable|string',
                 'smtpFromAddress' => 'required|email',
                 'smtpFromName' => 'required|string',
             ], [

app/Livewire/Storage/Create.php

@@ -26,7 +26,7 @@ class Create extends Component
 
     public string $bucket;
 
-    public string $endpoint;
+    public string $endpoint = '';
 
     public S3Storage $storage;
 
@@ -71,34 +71,12 @@ class Create extends Component
         'endpoint' => 'Endpoint',
     ];
 
-    public function updatedEndpoint($value)
-    {
-        try {
-            if (empty($value)) {
-                return;
-            }
-            if (str($value)->contains('digitaloceanspaces.com')) {
-                $uri = Uri::of($value);
-                $host = $uri->host();
-
-                if (preg_match('/^(.+)\.([^.]+\.digitaloceanspaces\.com)$/', $host, $matches)) {
-                    $host = $matches[2];
-                    $value = "https://{$host}";
-                }
-            }
-        } finally {
-            if (! str($value)->startsWith('https://') && ! str($value)->startsWith('http://')) {
-                $value = 'https://'.$value;
-            }
-            $this->endpoint = $value;
-        }
-    }
-
     public function submit()
     {
         try {
             $this->authorize('create', S3Storage::class);
 
+            $this->endpoint = $this->normalizeEndpoint($this->endpoint);
             $this->validate();
             $this->storage = new S3Storage;
             $this->storage->name = $this->name;
@@ -118,8 +96,42 @@ class Create extends Component
 
             return redirectRoute($this, 'storage.show', [$this->storage->uuid]);
         } catch (\Throwable $e) {
-            $this->dispatch('error', 'Failed to create storage.', $e->getMessage());
+            $this->dispatch('error', 'Failed to create storage.', $this->connectionErrorDescription($e));
             // return handleError($e, $this);
         }
     }
+
+    private function connectionErrorDescription(\Throwable $exception): string
+    {
+        $settingsUrl = route('settings.advanced').'#endpoint-section';
+        $description = e($exception->getMessage());
+
+        if (! str_contains($exception->getMessage(), $settingsUrl)) {
+            return $description;
+        }
+
+        $link = '<a class="font-medium underline" href="'.e($settingsUrl).'">Set them here.</a>';
+
+        return str_replace(e($settingsUrl), $link, $description);
+    }
+
+    private function normalizeEndpoint(string $endpoint): string
+    {
+        $endpoint = trim($endpoint);
+
+        $hasScheme = preg_match('/^(?:https?:|[a-z][a-z0-9+.-]*:\/\/)/i', $endpoint) === 1;
+        if (! $hasScheme) {
+            $endpoint = 'https://'.$endpoint;
+        }
+
+        if (str($endpoint)->contains('digitaloceanspaces.com')) {
+            $host = Uri::of($endpoint)->host();
+
+            if (preg_match('/^(.+)\.([^.]+\.digitaloceanspaces\.com)$/', $host, $matches)) {
+                return "https://{$matches[2]}";
+            }
+        }
+
+        return $endpoint;
+    }
 }

app/Livewire/Storage/Form.php

@@ -122,20 +122,39 @@ class Form extends Component
 
     public function testConnection()
     {
+        $testedStorage = null;
+
         try {
             $this->authorize('validateConnection', $this->storage);
+            $testedStorage = new S3Storage;
+            $testedStorage->uuid = $this->storage->uuid;
+            $testedStorage->team_id = $this->storage->team_id;
+            $testedStorage->unusable_email_sent = $this->storage->unusable_email_sent;
+            $testedStorage->name = $this->name;
+            $testedStorage->description = $this->description;
+            $testedStorage->endpoint = $this->endpoint;
+            $testedStorage->bucket = $this->bucket;
+            $testedStorage->region = $this->region;
+            $testedStorage->key = $this->key;
+            $testedStorage->secret = $this->secret;
 
-            $this->storage->testConnection(shouldSave: true);
+            $testedStorage->testConnection();
 
             // Update component property to reflect the new validation status
-            $this->isUsable = $this->storage->is_usable;
+            $this->isUsable = $testedStorage->is_usable;
+            $this->storage->is_usable = $testedStorage->is_usable;
+            $this->storage->unusable_email_sent = $testedStorage->unusable_email_sent;
+            $this->storage->save();
             $this->dispatch('storage-status-changed', isUsable: $this->isUsable);
 
             return $this->dispatch('success', 'Connection is working.', 'Tested with "ListObjectsV2" action.');
         } catch (\Throwable $e) {
-            // Refresh model and sync to get the latest state
-            $this->storage->refresh();
-            $this->isUsable = $this->storage->is_usable;
+            if ($testedStorage) {
+                $this->isUsable = $testedStorage->is_usable;
+                $this->storage->is_usable = $testedStorage->is_usable;
+                $this->storage->unusable_email_sent = $testedStorage->unusable_email_sent;
+                $this->storage->save();
+            }
             $this->dispatch('storage-status-changed', isUsable: $this->isUsable);
 
             $this->dispatch('error', 'Failed to test connection.', $e->getMessage());

app/Livewire/Team/AdminView.php

@@ -16,6 +16,8 @@ class AdminView extends Component
 
     public string $sort = 'name_asc';
 
+    public int $perPage = 10;
+
     public function mount()
     {
         if (! isInstanceAdmin()) {
@@ -42,6 +44,13 @@ class AdminView extends Component
         $this->resetPage();
     }
 
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+
+        $this->resetPage();
+    }
+
     public function submitSearch(): void
     {
         if (! isInstanceAdmin()) {
@@ -103,7 +112,7 @@ class AdminView extends Component
             ->when($this->sort === 'email_desc', fn ($query) => $query->orderByDesc('email'))
             ->when($this->sort === 'name_asc', fn ($query) => $query->orderBy('name'))
             ->orderBy('id')
-            ->paginate(10);
+            ->paginate($this->perPage);
 
         return view('livewire.team.admin-view', [
             'users' => $users,

app/Livewire/Team/Member/Index.php

@@ -22,6 +22,11 @@ class Index extends Component
 
     public function render()
     {
-        return view('livewire.team.member.index');
+        $members = currentTeam()->members;
+
+        return view('livewire.team.member.index', [
+            'members' => $members,
+            'membersWithoutTwoFactorCount' => $members->whereNull('two_factor_confirmed_at')->count(),
+        ]);
     }
 }

app/Livewire/Upgrade.php

@@ -5,6 +5,7 @@ namespace App\Livewire;
 use App\Actions\Server\UpdateCoolify;
 use App\Models\InstanceSettings;
 use App\Models\Server;
+use App\Services\CoolifyUpgradeStatus;
 use Livewire\Component;
 
 class Upgrade extends Component
@@ -69,7 +70,13 @@ class Upgrade extends Component
                 return;
             }
             $this->updateInProgress = true;
-            UpdateCoolify::run(manual_update: true);
+            dispatch(function () {
+                try {
+                    UpdateCoolify::run(manual_update: true);
+                } catch (\Throwable $e) {
+                    report($e);
+                }
+            })->afterResponse();
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -100,45 +107,10 @@ class Upgrade extends Component
             return ['status' => 'none'];
         }
 
-        if (empty($content)) {
-            return ['status' => 'none'];
-        }
-
-        $parts = explode('|', $content);
-        if (count($parts) < 3) {
-            return ['status' => 'none'];
-        }
-
-        [$step, $message, $timestamp] = $parts;
-
-        // Check if status is stale (older than 10 minutes)
-        try {
-            $statusTime = new \DateTime($timestamp);
-            $now = new \DateTime;
-            $diffMinutes = ($now->getTimestamp() - $statusTime->getTimestamp()) / 60;
-
-            if ($diffMinutes > 10) {
-                return ['status' => 'none'];
-            }
-        } catch (\Throwable $e) {
-            return ['status' => 'none'];
-        }
-
-        if ($step === 'error') {
-            return [
-                'status' => 'error',
-                'step' => 0,
-                'message' => $message,
-            ];
-        }
-
-        $stepInt = (int) $step;
-        $status = $stepInt >= 6 ? 'complete' : 'in_progress';
-
-        return [
-            'status' => $status,
-            'step' => $stepInt,
-            'message' => $message,
-        ];
+        return CoolifyUpgradeStatus::fromFile(
+            content: $content,
+            runningVersion: $this->currentVersion !== '' ? $this->currentVersion : (string) config('constants.coolify.version'),
+            targetVersion: $this->latestVersion !== '' ? $this->latestVersion : get_latest_version_of_coolify(),
+        );
     }
 }

app/Models/Environment.php

@@ -2,9 +2,6 @@
 
 namespace App\Models;
 
-use App\Models\V5\Application as V5Application;
-use App\Models\V5\ResourceConnection as V5ResourceConnection;
-use App\Support\V5\V5Feature;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -57,11 +54,7 @@ class Environment extends BaseModel
 
     public function isEmpty()
     {
-        return (! V5Feature::enabled() || (
-            ! V5Application::query()->where('environment_id', $this->id)->exists() &&
-            ! V5ResourceConnection::query()->where('environment_id', $this->id)->exists()
-        )) &&
-            $this->applications()->count() == 0 &&
+        return $this->applications()->count() == 0 &&
             $this->redis()->count() == 0 &&
             $this->postgresqls()->count() == 0 &&
             $this->mysqls()->count() == 0 &&
@@ -83,11 +76,6 @@ class Environment extends BaseModel
         return $this->hasMany(Application::class);
     }
 
-    public function v5Applications()
-    {
-        return $this->hasMany(V5Application::class);
-    }
-
     public function postgresqls()
     {
         return $this->hasMany(StandalonePostgresql::class);

app/Models/LocalPersistentVolume.php

@@ -4,6 +4,7 @@ namespace App\Models;
 
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Relations\MorphMany;
+use Illuminate\Support\Str;
 use Symfony\Component\Yaml\Yaml;
 
 class LocalPersistentVolume extends BaseModel
@@ -136,6 +137,49 @@ class LocalPersistentVolume extends BaseModel
         return $this->isReadOnlyVolume();
     }
 
+    public function isDeclaredInCompose(): bool
+    {
+        try {
+            $resource = $this->resource;
+            if (! $resource) {
+                return true;
+            }
+
+            $composeContent = $resource instanceof Application
+                ? $resource->docker_compose_raw
+                : data_get($resource, 'service.docker_compose_raw');
+
+            if (blank($composeContent)) {
+                return true;
+            }
+
+            $compose = Yaml::parse($composeContent);
+            $services = data_get($compose, 'services', []);
+
+            if ($this->isServiceResource()) {
+                $services = array_intersect_key($services, [$resource->name => true]);
+            }
+
+            foreach ($services as $service) {
+                foreach (data_get($service, 'volumes', []) as $volume) {
+                    $parsedVolume = is_array($volume) ? $volume : parseDockerVolumeString($volume);
+                    $source = data_get($parsedVolume, 'source');
+                    $target = data_get($parsedVolume, 'target');
+                    $resourceUuid = $resource instanceof Application ? $resource->uuid : data_get($resource, 'service.uuid');
+                    $generatedName = $source ? $resourceUuid.'_'.Str::slug($source, '-') : null;
+
+                    if ($generatedName === $this->name && $target && str($target)->start('/')->value() === $this->mount_path) {
+                        return true;
+                    }
+                }
+            }
+
+            return false;
+        } catch (\Throwable) {
+            return true;
+        }
+    }
+
     // Check if this volume is read-only by parsing the docker-compose content
     public function isReadOnlyVolume(): bool
     {

app/Models/Project.php

@@ -2,9 +2,6 @@
 
 namespace App\Models;
 
-use App\Models\V5\Application as V5Application;
-use App\Models\V5\ResourceConnection as V5ResourceConnection;
-use App\Support\V5\V5Feature;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -147,11 +144,7 @@ class Project extends BaseModel
 
     public function isEmpty()
     {
-        return (! V5Feature::enabled() || (
-            ! V5Application::query()->where('project_id', $this->id)->exists() &&
-            ! V5ResourceConnection::query()->where('project_id', $this->id)->exists()
-        )) &&
-            $this->applications()->count() == 0 &&
+        return $this->applications()->count() == 0 &&
             $this->redis()->count() == 0 &&
             $this->postgresqls()->count() == 0 &&
             $this->mysqls()->count() == 0 &&
@@ -166,13 +159,13 @@ class Project extends BaseModel
     public function databases(array $with = []): Collection
     {
         return $this->postgresqls()->with($with)->get()
-            ->merge($this->redis()->with($with)->get())
-            ->merge($this->mongodbs()->with($with)->get())
-            ->merge($this->mysqls()->with($with)->get())
-            ->merge($this->mariadbs()->with($with)->get())
-            ->merge($this->keydbs()->with($with)->get())
-            ->merge($this->dragonflies()->with($with)->get())
-            ->merge($this->clickhouses()->with($with)->get());
+            ->concat($this->redis()->with($with)->get())
+            ->concat($this->mongodbs()->with($with)->get())
+            ->concat($this->mysqls()->with($with)->get())
+            ->concat($this->mariadbs()->with($with)->get())
+            ->concat($this->keydbs()->with($with)->get())
+            ->concat($this->dragonflies()->with($with)->get())
+            ->concat($this->clickhouses()->with($with)->get());
     }
 
     public function navigateTo()

app/Models/ScheduledDatabaseBackupExecution.php

@@ -24,6 +24,7 @@ class ScheduledDatabaseBackupExecution extends BaseModel
     {
         return [
             'size' => 'integer',
+            'finished_at' => 'datetime',
             's3_uploaded' => 'boolean',
             'local_storage_deleted' => 'boolean',
             's3_storage_deleted' => 'boolean',

app/Models/Server.php

@@ -961,7 +961,7 @@ $schema://$host {
 
     public function stopUnmanaged($id)
     {
-        return instant_remote_process(['docker stop -t 0 '.escapeshellarg($id)], $this);
+        return instant_remote_process([dockerStopCommand(0, escapeshellarg($id), $this)], $this);
     }
 
     public function restartUnmanaged($id)
@@ -1351,7 +1351,7 @@ $schema://$host {
 
         try {
             $output = instant_remote_process([
-                'echo "---PRETTY_NAME---" && grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d \'"\' && echo "---ARCH---" && uname -m && echo "---KERNEL---" && uname -r && echo "---CPUS---" && nproc && echo "---MEMORY---" && free -b | awk \'/Mem:/{print $2}\' && echo "---UPTIME_SINCE---" && uptime -s',
+                'echo "---PRETTY_NAME---" && grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d \'"\' && echo "---ARCH---" && uname -m && echo "---KERNEL---" && uname -r && echo "---CPUS---" && nproc && echo "---MEMORY---" && free -b | awk \'/Mem:/{print $2}\' && echo "---UPTIME_SINCE---" && uptime -s && echo "---DOCKER---" && (docker version --format \'{{.Server.Version}}\' 2>/dev/null || true) && echo "---COMPOSE---" && (docker compose version --short 2>/dev/null || true)',
             ], $this, false);
 
             if (! $output) {
@@ -1381,6 +1381,23 @@ $schema://$host {
 
             $this->update(['server_metadata' => $metadata]);
 
+            try {
+                $detectedDockerVersion = parseDockerEngineVersion($sections['DOCKER'] ?? null);
+                if ($detectedDockerVersion !== null) {
+                    $this->rememberDockerVersion($detectedDockerVersion);
+                }
+
+                $detectedComposeVersion = parseDockerEngineVersion($sections['COMPOSE'] ?? null);
+                if ($detectedComposeVersion !== null) {
+                    $this->rememberComposeVersion($detectedComposeVersion);
+                }
+            } catch (\Throwable $e) {
+                Log::debug('Failed to store server runtime versions', [
+                    'server_id' => $this->id,
+                    'error' => $e->getMessage(),
+                ]);
+            }
+
             return $metadata;
         } catch (\Throwable $e) {
             Log::debug('Failed to gather server metadata', [
@@ -1604,11 +1621,40 @@ $schema://$host {
         return true;
     }
 
+    public function dockerVersion(): ?string
+    {
+        return $this->settings?->docker_version;
+    }
+
+    public function rememberDockerVersion(?string $version): void
+    {
+        $this->settings->update([
+            'docker_version' => parseDockerEngineVersion($version),
+            'docker_version_checked_at' => now(),
+        ]);
+    }
+
+    public function composeVersion(): ?string
+    {
+        return $this->settings?->compose_version;
+    }
+
+    public function rememberComposeVersion(?string $version): void
+    {
+        $this->settings->update([
+            'compose_version' => parseDockerEngineVersion($version),
+            'compose_version_checked_at' => now(),
+        ]);
+    }
+
     public function validateDockerEngineVersion()
     {
         $dockerVersionRaw = instant_remote_process(['docker version --format json'], $this, false);
         $dockerVersionJson = json_decode($dockerVersionRaw, true);
         $dockerVersion = data_get($dockerVersionJson, 'Server.Version', '0.0.0');
+        $this->rememberDockerVersion(is_string($dockerVersion) ? $dockerVersion : null);
+        $composeVersionRaw = instant_remote_process(['docker compose version --short'], $this, false);
+        $this->rememberComposeVersion(is_string($composeVersionRaw) ? $composeVersionRaw : null);
         $dockerVersion = checkMinimumDockerEngineVersion($dockerVersion);
         if (is_null($dockerVersion)) {
             $this->settings->is_usable = false;

app/Models/ServerSetting.php

@@ -15,6 +15,7 @@ use OpenApi\Attributes as OA;
         'id' => ['type' => 'integer'],
         'concurrent_builds' => ['type' => 'integer'],
         'deployment_queue_limit' => ['type' => 'integer'],
+        'backup_compression_cpu_percentage' => ['type' => 'integer'],
         'dynamic_timeout' => ['type' => 'integer'],
         'force_disabled' => ['type' => 'boolean'],
         'force_server_cleanup' => ['type' => 'boolean'],
@@ -51,6 +52,10 @@ use OpenApi\Attributes as OA;
         'delete_unused_volumes' => ['type' => 'boolean', 'description' => 'The flag to indicate if the unused volumes should be deleted.'],
         'delete_unused_networks' => ['type' => 'boolean', 'description' => 'The flag to indicate if the unused networks should be deleted.'],
         'connection_timeout' => ['type' => 'integer', 'description' => 'SSH connection timeout in seconds.'],
+        'docker_version' => ['type' => 'string', 'nullable' => true, 'description' => 'Detected Docker Engine version on the server.'],
+        'docker_version_checked_at' => ['type' => 'string', 'nullable' => true, 'description' => 'When Docker Engine version was last detected.'],
+        'compose_version' => ['type' => 'string', 'nullable' => true, 'description' => 'Detected Docker Compose plugin version on the server.'],
+        'compose_version_checked_at' => ['type' => 'string', 'nullable' => true, 'description' => 'When Docker Compose version was last detected.'],
     ]
 )]
 class ServerSetting extends Model
@@ -98,8 +103,13 @@ class ServerSetting extends Model
         'server_disk_usage_check_frequency',
         'is_terminal_enabled',
         'deployment_queue_limit',
+        'backup_compression_cpu_percentage',
         'disable_application_image_retention',
         'connection_timeout',
+        'docker_version',
+        'docker_version_checked_at',
+        'compose_version',
+        'compose_version_checked_at',
     ];
 
     protected $casts = [
@@ -113,6 +123,9 @@ class ServerSetting extends Model
         'is_terminal_enabled' => 'boolean',
         'disable_application_image_retention' => 'boolean',
         'connection_timeout' => 'integer',
+        'docker_version_checked_at' => 'datetime',
+        'compose_version_checked_at' => 'datetime',
+        'backup_compression_cpu_percentage' => 'integer',
     ];
 
     /**

app/Models/Service.php

@@ -1180,6 +1180,27 @@ class Service extends BaseModel
                     }
                     $fields->put('Openclaw', $data->toArray());
                     break;
+                case $image->contains('coollabsio/jean-server'):
+                    $data = collect([]);
+                    $settings = [
+                        'Token' => ['key' => 'SERVICE_PASSWORD_64_JEAN', 'rules' => 'required', 'isPassword' => true, 'sortOrder' => 1, 'customHelper' => 'Token required to access Jean Server. Variable name: SERVICE_PASSWORD_64_JEAN'],
+                        'Allowed Origins' => ['key' => 'JEAN_ALLOWED_ORIGINS', 'rules' => 'nullable|string', 'sortOrder' => 2, 'customHelper' => 'Comma-separated additional browser origins. Same-origin access is always allowed. Variable name: JEAN_ALLOWED_ORIGINS'],
+                    ];
+
+                    foreach ($settings as $label => $setting) {
+                        $variable = $this->environment_variables()->where('key', $setting['key'])->first();
+                        if (! $variable) {
+                            continue;
+                        }
+
+                        $data->put($label, [
+                            ...$setting,
+                            'value' => data_get($variable, 'value'),
+                        ]);
+                    }
+
+                    $fields->put('', $data->toArray());
+                    break;
                 default:
                     $data = collect([]);
                     $admin_user = $this->environment_variables()->where('key', 'SERVICE_USER_ADMIN')->first();

app/Models/Team.php

@@ -4,12 +4,10 @@ namespace App\Models;
 
 use App\Actions\User\RevokeUserTeamTokens;
 use App\Events\ServerReachabilityChanged;
-use App\Jobs\V5TeardownTeamJob;
 use App\Notifications\Channels\SendsDiscord;
 use App\Notifications\Channels\SendsEmail;
 use App\Notifications\Channels\SendsPushover;
 use App\Notifications\Channels\SendsSlack;
-use App\Support\V5\V5Feature;
 use App\Traits\HasNotificationSettings;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -81,20 +79,6 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
         });
 
         static::deleting(function (Team $team) {
-            // Best-effort on-host teardown of this team's v5 resources BEFORE the
-            // DB cascade removes the servers/applications/private keys. Captured
-            // synchronously into a queued job so an unreachable host cannot block
-            // or fail the team deletion (see V5TeardownTeamJob). Guarded so a v5
-            // teardown problem never breaks v4 team deletion. This is disabled
-            // with the rest of v5 outside development environments.
-            if (V5Feature::enabled()) {
-                try {
-                    V5TeardownTeamJob::dispatchForTeam($team);
-                } catch (\Throwable $exception) {
-                    report($exception);
-                }
-            }
-
             RevokeUserTeamTokens::forTeam($team->id);
 
             foreach ($team->privateKeys as $key) {
@@ -107,7 +91,7 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
 
             // Delete non-instance-wide sources owned by this team
             $teamSources = GithubApp::where('team_id', $team->id)->get()
-                ->merge(GitlabApp::where('team_id', $team->id)->get());
+                ->concat(GitlabApp::where('team_id', $team->id)->get());
             foreach ($teamSources as $source) {
                 $source->delete();
             }

app/Providers/AppServiceProvider.php

@@ -3,10 +3,7 @@
 namespace App\Providers;
 
 use App\Models\PersonalAccessToken;
-use App\Models\V5\Application;
-use App\Support\V5\V5Feature;
 use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Facades\App;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
@@ -26,11 +23,6 @@ class AppServiceProvider extends ServiceProvider
     {
         $this->configureCommands();
 
-        if (V5Feature::enabled()) {
-            $this->loadMigrationsFrom(database_path('migrations-v5'));
-            $this->configureMorphMap();
-        }
-
         $this->configureModels();
         $this->configurePasswords();
         $this->configureSanctumModel();
@@ -45,18 +37,6 @@ class AppServiceProvider extends ServiceProvider
         }
     }
 
-    /**
-     * Map v5 models to stable morph aliases so polymorphic rows survive class
-     * renames. Deliberately NOT enforced: v4 polymorphic relations store FQCNs
-     * and must keep resolving them.
-     */
-    private function configureMorphMap(): void
-    {
-        Relation::morphMap([
-            'v5.application' => Application::class,
-        ]);
-    }
-
     private function configureModels(): void
     {
         // Disabled because it's causing issues with the application

app/Providers/AuthServiceProvider.php

@@ -38,10 +38,6 @@ use App\Models\SwarmDocker;
 use App\Models\Tag;
 use App\Models\Team;
 use App\Models\TelegramNotificationSettings;
-use App\Models\V5\Application as V5Application;
-use App\Models\V5\Cluster as V5Cluster;
-use App\Models\V5\ResourceConnection as V5ResourceConnection;
-use App\Models\V5\Server as V5Server;
 use App\Models\WebhookNotificationSettings;
 use App\Policies\ApiTokenPolicy;
 use App\Policies\ApplicationPolicy;
@@ -69,10 +65,6 @@ use App\Policies\StandaloneDockerPolicy;
 use App\Policies\SwarmDockerPolicy;
 use App\Policies\TagPolicy;
 use App\Policies\TeamPolicy;
-use App\Policies\V5\ApplicationPolicy as V5ApplicationPolicy;
-use App\Policies\V5\ClusterPolicy as V5ClusterPolicy;
-use App\Policies\V5\ResourceConnectionPolicy as V5ResourceConnectionPolicy;
-use App\Policies\V5\ServerPolicy as V5ServerPolicy;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
 use Illuminate\Support\Facades\Gate;
 use Laravel\Sanctum\PersonalAccessToken;
@@ -138,12 +130,6 @@ class AuthServiceProvider extends ServiceProvider
         CloudInitScript::class => CloudInitScriptPolicy::class,
         Tag::class => TagPolicy::class,
 
-        // V5 policies - scoped to the current team resolved from the request
-        V5Application::class => V5ApplicationPolicy::class,
-        V5Cluster::class => V5ClusterPolicy::class,
-        V5ResourceConnection::class => V5ResourceConnectionPolicy::class,
-        V5Server::class => V5ServerPolicy::class,
-
     ];
 
     /**

app/Providers/RouteServiceProvider.php

@@ -2,7 +2,6 @@
 
 namespace App\Providers;
 
-use App\Support\V5\V5Feature;
 use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
 use Illuminate\Http\Request;
@@ -35,13 +34,6 @@ class RouteServiceProvider extends ServiceProvider
             Route::prefix('webhooks')
                 ->group(base_path('routes/webhooks.php'));
 
-            if (V5Feature::enabled()) {
-                Route::middleware('v5.web')
-                    ->prefix('v5')
-                    ->as('v5.')
-                    ->group(base_path('routes/v5.php'));
-            }
-
             Route::middleware('web')
                 ->group(base_path('routes/web.php'));
         });
@@ -63,12 +55,6 @@ class RouteServiceProvider extends ServiceProvider
             return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
         });
 
-        if (V5Feature::enabled()) {
-            RateLimiter::for('v5', function (Request $request) {
-                return Limit::perMinute(120)->by($request->user()?->id ?: $request->ip());
-            });
-        }
-
         RateLimiter::for('feedback', function (Request $request) {
             return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
         });

app/Rules/SafeExternalUrl.php

@@ -2,178 +2,10 @@
 
 namespace App\Rules;
 
-use Closure;
-use Illuminate\Contracts\Validation\ValidationRule;
-use Illuminate\Support\Facades\Log;
-
-class SafeExternalUrl implements ValidationRule
-{
-    /**
-     * @param  (Closure(string): array<int, string>)|null  $resolver
-     */
-    public function __construct(private ?Closure $resolver = null) {}
-
-    /**
-     * Run the validation rule.
-     *
-     * Validates that a URL points to an external, publicly-routable host.
-     * Blocks private IP ranges, reserved ranges, localhost, and link-local
-     * addresses to prevent Server-Side Request Forgery (SSRF).
-     */
-    public function validate(string $attribute, mixed $value, Closure $fail): void
-    {
-        if (! filter_var($value, FILTER_VALIDATE_URL)) {
-            $fail('The :attribute must be a valid URL.');
-
-            return;
-        }
-
-        $scheme = strtolower(parse_url($value, PHP_URL_SCHEME) ?? '');
-        if (! in_array($scheme, ['https', 'http'])) {
-            $fail('The :attribute must use the http or https scheme.');
-
-            return;
-        }
-
-        $host = parse_url($value, PHP_URL_HOST);
-        if (! $host) {
-            $fail('The :attribute must contain a valid host.');
-
-            return;
-        }
-
-        $host = strtolower($host);
-        $hostForIpCheck = $this->normalizeHostForIpCheck($host);
-        $hostForDns = rtrim($hostForIpCheck, '.');
-
-        $internalHosts = ['localhost', '0.0.0.0', '::1'];
-        if (in_array($hostForDns, $internalHosts, true) || str_ends_with($hostForDns, '.local') || str_ends_with($hostForDns, '.internal')) {
-            $this->logBlockedHost($attribute, $value, $host);
-            $fail('The :attribute must not point to internal hosts.');
-
-            return;
-        }
-
-        if (filter_var($hostForIpCheck, FILTER_VALIDATE_IP)) {
-            if (! $this->isPublicIp($hostForIpCheck)) {
-                $this->logBlockedIp($attribute, $value, $host, $hostForIpCheck);
-                $fail('The :attribute must not point to a private or reserved IP address.');
-
-                return;
-            }
-
-            return;
-        }
-
-        $resolvedIps = $this->resolveHost($hostForDns);
-        if ($resolvedIps === []) {
-            $fail('The :attribute host could not be resolved.');
-
-            return;
-        }
-
-        foreach ($resolvedIps as $resolvedIp) {
-            if (! $this->isPublicIp($resolvedIp)) {
-                $this->logBlockedIp($attribute, $value, $host, $resolvedIp);
-                $fail('The :attribute must not point to a private or reserved IP address.');
-
-                return;
-            }
-        }
-    }
-
-    private function normalizeHostForIpCheck(string $host): string
-    {
-        return (str_starts_with($host, '[') && str_ends_with($host, ']'))
-            ? substr($host, 1, -1)
-            : $host;
-    }
-
-    /**
-     * @return array<int, string>
-     */
-    private function resolveHost(string $host): array
-    {
-        if ($this->resolver instanceof Closure) {
-            return array_values(array_filter(($this->resolver)($host), fn (string $ip): bool => filter_var($ip, FILTER_VALIDATE_IP) !== false));
-        }
-
-        $records = @dns_get_record($host, DNS_A | DNS_AAAA);
-        if ($records === false) {
-            $records = [];
-        }
-
-        $ips = [];
-        foreach ($records as $record) {
-            foreach (['ip', 'ipv6'] as $key) {
-                if (isset($record[$key]) && filter_var($record[$key], FILTER_VALIDATE_IP)) {
-                    $ips[] = $record[$key];
-                }
-            }
-        }
-
-        $ipv4Addresses = @gethostbynamel($host);
-        if (is_array($ipv4Addresses)) {
-            foreach ($ipv4Addresses as $ip) {
-                if (filter_var($ip, FILTER_VALIDATE_IP)) {
-                    $ips[] = $ip;
-                }
-            }
-        }
-
-        return array_values(array_unique($ips));
-    }
-
-    private function isPublicIp(string $ip): bool
-    {
-        $embeddedIpv4 = $this->extractIpv4FromMappedIpv6($ip);
-        if ($embeddedIpv4 !== null) {
-            return filter_var($embeddedIpv4, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
-        }
-
-        return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
-    }
-
-    private function extractIpv4FromMappedIpv6(string $ip): ?string
-    {
-        $packed = @inet_pton($ip);
-        if ($packed === false || strlen($packed) !== 16) {
-            return null;
-        }
-
-        $prefix = substr($packed, 0, 12);
-        if ($prefix !== str_repeat("\0", 10)."\xff\xff") {
-            return null;
-        }
-
-        $parts = unpack('C4', substr($packed, 12, 4));
-        if ($parts === false) {
-            return null;
-        }
-
-        return implode('.', $parts);
-    }
-
-    private function logBlockedHost(string $attribute, string $url, string $host): void
-    {
-        Log::warning('External URL points to internal host', [
-            'attribute' => $attribute,
-            'url' => $url,
-            'host' => $host,
-            'ip' => request()->ip(),
-            'user_id' => auth()->id(),
-        ]);
-    }
-
-    private function logBlockedIp(string $attribute, string $url, string $host, string $resolvedIp): void
-    {
-        Log::warning('External URL resolves to private or reserved IP', [
-            'attribute' => $attribute,
-            'url' => $url,
-            'host' => $host,
-            'resolved_ip' => $resolvedIp,
-            'ip' => request()->ip(),
-            'user_id' => auth()->id(),
-        ]);
-    }
-}
+/**
+ * Backwards-compatible name for outbound URL validation.
+ *
+ * External service URLs use the same private-target allowlist as webhooks
+ * and S3 endpoints.
+ */
+class SafeExternalUrl extends SafeWebhookUrl {}

app/Rules/SafeWebhookUrl.php

@@ -62,7 +62,7 @@ class SafeWebhookUrl implements ValidationRule
 
         if ($this->isBlockedHostname($hostForDns) && ! $this->isAllowedHostname($hostForDns)) {
             $this->logBlockedHost($attribute, $host);
-            $fail('The :attribute must not point to localhost or internal hosts.');
+            $fail($this->privateTargetMessage($attribute));
 
             return;
         }
@@ -70,7 +70,9 @@ class SafeWebhookUrl implements ValidationRule
         if (filter_var($hostForIpCheck, FILTER_VALIDATE_IP)) {
             if (! $this->isAllowedIp($hostForIpCheck, $hostForDns)) {
                 $this->logBlockedIp($attribute, $host, $hostForIpCheck);
-                $fail('The :attribute must not point to private, reserved, loopback, or link-local addresses.');
+                $fail($this->isLinkLocalIp($hostForIpCheck)
+                    ? 'The :attribute must not point to link-local addresses.'
+                    : $this->privateTargetMessage($attribute));
 
                 return;
             }
@@ -88,13 +90,22 @@ class SafeWebhookUrl implements ValidationRule
         foreach ($resolvedIps as $resolvedIp) {
             if (! $this->isAllowedIp($resolvedIp, $hostForDns)) {
                 $this->logBlockedIp($attribute, $host, $resolvedIp);
-                $fail('The :attribute must not point to private, reserved, loopback, or link-local addresses.');
+                $fail($this->isLinkLocalIp($resolvedIp)
+                    ? 'The :attribute must not resolve to a link-local address.'
+                    : $this->privateTargetMessage($attribute));
 
                 return;
             }
         }
     }
 
+    private function privateTargetMessage(string $attribute): string
+    {
+        $settingsUrl = route('settings.advanced').'#endpoint-section';
+
+        return "The {$attribute} points to a local or private address that is not allowed. Configure allowed internal targets: {$settingsUrl}";
+    }
+
     /**
      * Build HTTP client options that pin the validated host to the resolved IPs.
      *
@@ -334,6 +345,10 @@ class SafeWebhookUrl implements ValidationRule
             $ip = $embeddedIpv4;
         }
 
+        if ($this->isLinkLocalIp($ip)) {
+            return false;
+        }
+
         if ($this->isPublicIp($ip)) {
             return true;
         }
@@ -350,6 +365,15 @@ class SafeWebhookUrl implements ValidationRule
         return $this->isAllowlistedIp($ip);
     }
 
+    private function isLinkLocalIp(string $ip): bool
+    {
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            return $this->ipv4InCidr($ip, '169.254.0.0/16');
+        }
+
+        return $this->ipInCidr($ip, 'fe80::/10');
+    }
+
     private function isPublicIp(string $ip): bool
     {
         $embeddedIpv4 = $this->extractIpv4FromMappedIpv6($ip);

app/Services/AvatarStorageService.php

@@ -68,7 +68,7 @@ class AvatarStorageService
         ]);
     }
 
-    private function disk(string $storageType, ?int $s3StorageId): FilesystemAdapter
+    protected function disk(string $storageType, ?int $s3StorageId): FilesystemAdapter
     {
         if ($storageType !== 's3') {
             return Storage::disk('local');
@@ -82,7 +82,7 @@ class AvatarStorageService
         return $storage->filesystem();
     }
 
-    private function compress(UploadedFile $upload): string
+    protected function compress(UploadedFile $upload): string
     {
         $imageInfo = getimagesize($upload->getRealPath());
         if ($imageInfo && $imageInfo['mime'] === 'image/jpeg' && $imageInfo[0] <= 256 && $imageInfo[1] <= 256) {

app/Services/CoolifyUpgradeStatus.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Services;
+
+use DateTimeInterface;
+
+class CoolifyUpgradeStatus
+{
+    public const STALE_AFTER_MINUTES = 10;
+
+    /**
+     * @return array{status: string, step?: int, message?: string, running_version: string, target_version: string}
+     */
+    public static function fromFile(
+        string $content,
+        string $runningVersion,
+        string $targetVersion,
+        ?DateTimeInterface $now = null,
+        int $staleAfterMinutes = self::STALE_AFTER_MINUTES,
+    ): array {
+        $base = [
+            'running_version' => $runningVersion,
+            'target_version' => $targetVersion,
+        ];
+
+        $content = trim($content);
+        if ($content === '') {
+            return ['status' => 'none', ...$base];
+        }
+
+        $parts = explode('|', $content);
+        if (count($parts) < 3) {
+            return ['status' => 'none', ...$base];
+        }
+
+        [$step, $message, $timestamp] = $parts;
+
+        try {
+            $statusTime = new \DateTime($timestamp);
+            $now = $now ?? new \DateTime;
+            $diffMinutes = ($now->getTimestamp() - $statusTime->getTimestamp()) / 60;
+
+            if ($diffMinutes > $staleAfterMinutes) {
+                return ['status' => 'none', ...$base];
+            }
+        } catch (\Throwable) {
+            return ['status' => 'none', ...$base];
+        }
+
+        if ($step === 'error') {
+            return [
+                'status' => 'error',
+                'step' => 0,
+                'message' => $message,
+                ...$base,
+            ];
+        }
+
+        $stepInt = (int) $step;
+
+        if ($stepInt >= 6 && ! self::hasReachedTargetVersion($runningVersion, $targetVersion)) {
+            return [
+                'status' => 'in_progress',
+                'step' => $stepInt,
+                'message' => "Waiting for Coolify {$targetVersion} to come online...",
+                ...$base,
+            ];
+        }
+
+        $status = $stepInt >= 6 ? 'complete' : 'in_progress';
+
+        return [
+            'status' => $status,
+            'step' => $stepInt,
+            'message' => $message,
+            ...$base,
+        ];
+    }
+
+    public static function hasReachedTargetVersion(string $runningVersion, string $targetVersion): bool
+    {
+        if ($runningVersion === '' || $targetVersion === '') {
+            return false;
+        }
+
+        return version_compare($runningVersion, $targetVersion, '>=');
+    }
+}

app/Services/ProjectIconStorageService.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Project;
+use Illuminate\Http\UploadedFile;
+use RuntimeException;
+
+class ProjectIconStorageService extends AvatarStorageService
+{
+    public function storeProject(Project $project, UploadedFile $upload): void
+    {
+        $settings = instanceSettings();
+        $storageType = $settings->avatar_storage_type === 's3' && $settings->avatar_s3_storage_id ? 's3' : 'local';
+        $s3StorageId = $storageType === 's3' ? $settings->avatar_s3_storage_id : null;
+        $disk = $this->disk($storageType, $s3StorageId);
+        $path = "project-icons/{$project->uuid}/icon.jpg";
+
+        if (! $disk->put($path, $this->compress($upload))) {
+            throw new RuntimeException('Unable to store the project icon.');
+        }
+
+        $oldStorageType = $project->icon_storage_type;
+        $oldS3StorageId = $project->icon_s3_storage_id;
+        $oldPath = $project->icon_path;
+
+        $project->forceFill([
+            'icon_path' => $path,
+            'icon_storage_type' => $storageType,
+            'icon_s3_storage_id' => $s3StorageId,
+        ])->save();
+
+        if ($oldPath && ($oldStorageType !== $storageType || $oldS3StorageId !== $s3StorageId)) {
+            $this->disk($oldStorageType ?? 'local', $oldS3StorageId)->delete($oldPath);
+        }
+    }
+
+    public function projectContents(Project $project): ?string
+    {
+        if (! $project->icon_path) {
+            return null;
+        }
+
+        try {
+            $disk = $this->disk($project->icon_storage_type ?? 'local', $project->icon_s3_storage_id);
+        } catch (RuntimeException) {
+            return null;
+        }
+
+        return $disk->exists($project->icon_path) ? $disk->get($project->icon_path) : null;
+    }
+
+    public function deleteProject(Project $project): void
+    {
+        if ($project->icon_path) {
+            try {
+                $this->disk($project->icon_storage_type ?? 'local', $project->icon_s3_storage_id)
+                    ->delete($project->icon_path);
+            } catch (RuntimeException) {
+            }
+        }
+
+        $project->forceFill([
+            'icon_path' => null,
+            'icon_storage_type' => null,
+            'icon_s3_storage_id' => null,
+        ])->save();
+    }
+}

app/Support/BackupCompression.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Support;
+
+final class BackupCompression
+{
+    public static function cpuPercentage(int|string|null $configuredPercentage): int
+    {
+        $percentage = (int) $configuredPercentage;
+
+        return in_array($percentage, [25, 50, 75, 100], true) ? $percentage : 25;
+    }
+
+    public static function compressorCommand(int $cpuPercentage): string
+    {
+        $cpuPercentage = self::cpuPercentage($cpuPercentage);
+
+        return "if command -v pigz >/dev/null 2>&1; then printf 'pigz -3 -p %s' \"\$(( (\$(nproc) * {$cpuPercentage} + 99) / 100 ))\"; else printf 'gzip -3'; fi";
+    }
+}

app/Support/DatabaseBackupFileValidator.php

@@ -90,13 +90,17 @@ class DatabaseBackupFileValidator
 
     public static function containsPostgresqlProgramExecution(string $sql): bool
     {
+        if (str_starts_with($sql, 'PGDMP')) {
+            return false;
+        }
+
         $withoutComments = self::stripSqlComments($sql);
 
-        if (preg_match('/^\s*\\\\(?:!|copy\b.*\bprogram\b)/mi', $withoutComments) === 1) {
+        if (preg_match('/^\s*\\\\(?:!|copy\b[^\r\n]*\bprogram\b|(?:o|g)\s*\|)/mi', $withoutComments) === 1) {
             return true;
         }
 
-        return preg_match('/\bcopy\b[\s\S]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
+        return preg_match('/(?:^|;)\s*copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
     }
 
     private static function extensionFor(string $name): ?string

app/Support/DomainUrlParts.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Support;
+
+class DomainUrlParts
+{
+    public static function compose(string $scheme, string $host, string $port = '', string $path = ''): string
+    {
+        $scheme = strtolower(trim($scheme)) === 'http' ? 'http' : 'https';
+        $host = trim($host);
+        $port = trim($port);
+        $path = trim($path);
+
+        if ($path !== '' && ! str_starts_with($path, '/') && ! str_starts_with($path, '?') && ! str_starts_with($path, '#')) {
+            $path = '/'.$path;
+        }
+
+        return $scheme.'://'.$host.($port !== '' ? ':'.$port : '').$path;
+    }
+
+    /**
+     * @return array{scheme: string, host: string, port: string, path: string}
+     */
+    public static function split(?string $url): array
+    {
+        $parts = filled($url) ? parse_url($url) : false;
+        if (! is_array($parts) || blank($parts['host'] ?? null)) {
+            return self::empty();
+        }
+
+        $path = $parts['path'] ?? '';
+        if (isset($parts['query'])) {
+            $path .= '?'.$parts['query'];
+        }
+        if (isset($parts['fragment'])) {
+            $path .= '#'.$parts['fragment'];
+        }
+
+        return [
+            'scheme' => in_array(strtolower($parts['scheme'] ?? ''), ['http', 'https'], true)
+                ? strtolower($parts['scheme'])
+                : 'https',
+            'host' => (string) $parts['host'],
+            'port' => isset($parts['port']) ? (string) $parts['port'] : '',
+            'path' => $path,
+        ];
+    }
+
+    /**
+     * @return array{scheme: string, host: string, port: string, path: string}
+     */
+    public static function empty(): array
+    {
+        return ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+    }
+}