diff --git a/app/Actions/Database/RestartDatabase.php b/app/Actions/Database/RestartDatabase.php
index 940bc69fb7..f8fef5855c 100644
--- a/app/Actions/Database/RestartDatabase.php
+++ b/app/Actions/Database/RestartDatabase.php
@@ -22,6 +22,10 @@ class RestartDatabase
if (! $server->isFunctional()) {
return 'Server is not functional';
}
+ $prerequisiteError = StartDatabase::prerequisiteError($database);
+ if ($prerequisiteError !== null) {
+ return $prerequisiteError;
+ }
StopDatabase::run($database, dockerCleanup: false);
return StartDatabase::run($database);
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index cb1c517539..af2b48e893 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -4,6 +4,7 @@ namespace App\Actions\Database;
use App\Enums\ActivityTypes;
use App\Enums\ProcessStatus;
+use App\Exceptions\DatabaseStartException;
use App\Jobs\DatabaseStartJob;
use App\Models\StandaloneClickhouse;
use App\Models\StandaloneDragonfly;
@@ -13,9 +14,11 @@ use App\Models\StandaloneMongodb;
use App\Models\StandaloneMysql;
use App\Models\StandalonePostgresql;
use App\Models\StandaloneRedis;
+use App\Support\ResourceStartActivity;
use Lorisleiva\Actions\Concerns\AsAction;
use Lorisleiva\Actions\Decorators\JobDecorator;
use Spatie\Activitylog\Models\Activity;
+use Throwable;
class StartDatabase
{
@@ -32,6 +35,10 @@ class StartDatabase
if (! $server->isFunctional()) {
return 'Server is not functional';
}
+ $prerequisiteError = self::prerequisiteError($database);
+ if ($prerequisiteError !== null) {
+ return $prerequisiteError;
+ }
$database->update([
'restart_count' => 0,
'last_restart_at' => null,
@@ -45,7 +52,7 @@ class StartDatabase
'type_uuid' => $database->uuid,
'status' => ProcessStatus::QUEUED->value,
'team_id' => $server->team_id,
- 'operation' => 'database-start',
+ 'operation' => ResourceStartActivity::DATABASE_START_OPERATION,
])
->performedOn($database)
->event(ActivityTypes::INLINE->value)
@@ -55,13 +62,19 @@ class StartDatabase
return 'Database start could not be queued because activity logging is disabled.';
}
- DatabaseStartJob::dispatch(
- $database->getMorphClass(),
- (int) $database->getKey(),
- (int) $database->team()->id,
- (int) $activity->getKey(),
- auth()->id(),
- );
+ try {
+ DatabaseStartJob::dispatch(
+ $database->getMorphClass(),
+ (int) $database->getKey(),
+ (int) $database->team()->id,
+ (int) $activity->getKey(),
+ auth()->id(),
+ );
+ } catch (Throwable $e) {
+ ResourceStartActivity::markFailed($activity, 'Database start could not be queued.');
+
+ throw $e;
+ }
if ($database->is_public && $database->public_port) {
StartDatabaseProxy::dispatch($database);
@@ -69,4 +82,21 @@ class StartDatabase
return $activity;
}
+
+ /**
+ * Check prerequisites that would make the queued start fail, so the user gets the
+ * error immediately instead of a queued start that can only fail later.
+ */
+ public static function prerequisiteError(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database): ?string
+ {
+ if (! $database->enable_ssl) {
+ return null;
+ }
+
+ if (! $database->destination->server->ensureCaCertificate()) {
+ return DatabaseStartException::missingCaCertificate()->getMessage();
+ }
+
+ return null;
+ }
}
diff --git a/app/Actions/Database/StartDragonfly.php b/app/Actions/Database/StartDragonfly.php
index a4c1540206..1c4f0ca486 100644
--- a/app/Actions/Database/StartDragonfly.php
+++ b/app/Actions/Database/StartDragonfly.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandaloneDragonfly;
@@ -59,18 +60,7 @@ class StartDragonfly
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index c10723b59e..1b434345aa 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandaloneKeydb;
@@ -59,18 +60,7 @@ class StartKeydb
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index 6eb73f65b3..0479703dae 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandaloneMariadb;
@@ -59,18 +60,7 @@ class StartMariadb
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index f85d0c86fa..388bda0b30 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandaloneMongodb;
@@ -66,18 +67,7 @@ class StartMongodb
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
if (! $this->ssl_certificate) {
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index e69993323e..ff06e0f464 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandaloneMysql;
@@ -61,18 +62,7 @@ class StartMysql
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 18e5413200..940e1abdde 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandalonePostgresql;
@@ -65,18 +66,7 @@ class StartPostgresql
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
diff --git a/app/Actions/Database/StartRedis.php b/app/Actions/Database/StartRedis.php
index 580738635d..2fb74e3e45 100644
--- a/app/Actions/Database/StartRedis.php
+++ b/app/Actions/Database/StartRedis.php
@@ -2,6 +2,7 @@
namespace App\Actions\Database;
+use App\Exceptions\DatabaseStartException;
use App\Helpers\SslHelper;
use App\Models\SslCertificate;
use App\Models\StandaloneRedis;
@@ -61,18 +62,7 @@ class StartRedis
$this->commands[] = "mkdir -p $this->configuration_dir/ssl";
$server = $this->database->destination->server;
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-
- if (! $caCert) {
- $server->generateCaCertificate();
- $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
- }
-
- if (! $caCert) {
- $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
- return;
- }
+ $caCert = $server->ensureCaCertificate() ?? throw DatabaseStartException::missingCaCertificate();
$this->ssl_certificate = $this->database->sslCertificates()->first();
diff --git a/app/Actions/Proxy/DeleteTraefikCertificate.php b/app/Actions/Proxy/DeleteTraefikCertificate.php
new file mode 100644
index 0000000000..7ce79dca18
--- /dev/null
+++ b/app/Actions/Proxy/DeleteTraefikCertificate.php
@@ -0,0 +1,57 @@
+proxyType() !== ProxyTypes::TRAEFIK->value) {
+ throw new RuntimeException('TLS certificates can only be managed for Traefik proxies.');
+ }
+
+ $contents = $this->getTraefikCertificates->contents($server);
+ if ($contents === null) {
+ throw new RuntimeException('The Traefik ACME file could not be found.');
+ }
+
+ $certificate = collect($this->acmeService->certificates($contents))
+ ->firstWhere('id', $certificateId);
+ if ($certificate === null) {
+ throw new RuntimeException('The selected certificate could not be found.');
+ }
+
+ $updatedContents = $this->acmeService->deleteCertificate(
+ $contents,
+ $certificate['resolver'],
+ $certificateId,
+ );
+
+ $path = rtrim($server->proxyPath(), '/').'/acme.json';
+ $temporaryPath = $path.'.coolify-'.bin2hex(random_bytes(8));
+ $encodedContents = base64_encode($updatedContents);
+ $script = sprintf(
+ 'set -e; umask 077; printf %%s %s | base64 -d > %s; chmod 600 %s; mv -- %s %s',
+ escapeshellarg($encodedContents),
+ escapeshellarg($temporaryPath),
+ escapeshellarg($temporaryPath),
+ escapeshellarg($temporaryPath),
+ escapeshellarg($path),
+ );
+
+ instant_remote_process(['sh -c '.escapeshellarg($script)], $server);
+ }
+}
diff --git a/app/Actions/Proxy/GetTraefikCertificates.php b/app/Actions/Proxy/GetTraefikCertificates.php
new file mode 100644
index 0000000000..7ca7f11bc3
--- /dev/null
+++ b/app/Actions/Proxy/GetTraefikCertificates.php
@@ -0,0 +1,55 @@
+, store: ?string, expires_at: ?string}> */
+ public function handle(Server $server): array
+ {
+ if ($server->proxyType() !== ProxyTypes::TRAEFIK->value) {
+ return [];
+ }
+
+ $contents = $this->contents($server);
+
+ return $contents === null ? [] : $this->acmeService->certificates($contents);
+ }
+
+ public function contents(Server $server): ?string
+ {
+ $path = escapeshellarg(rtrim($server->proxyPath(), '/').'/acme.json');
+ $readLimit = self::MAX_FILE_SIZE_BYTES + 1;
+ $tooLargeMarker = '__COOLIFY_ACME_FILE_TOO_LARGE__';
+ $output = instant_remote_process([
+ "if [ ! -f {$path} ]; then exit 0; elif [ \"\$(wc -c < {$path})\" -gt ".self::MAX_FILE_SIZE_BYTES." ]; then echo '{$tooLargeMarker}'; else head -c {$readLimit} {$path} | base64 | tr -d '\\n'; fi",
+ ], $server, false);
+
+ if ($output === null || trim($output) === '') {
+ return null;
+ }
+
+ if (trim($output) === $tooLargeMarker) {
+ throw new RuntimeException('The Traefik ACME file exceeds the 10 MiB size limit.');
+ }
+
+ $contents = base64_decode(trim($output), true);
+ if ($contents === false || strlen($contents) > self::MAX_FILE_SIZE_BYTES) {
+ throw new RuntimeException('The Traefik ACME file could not be read safely.');
+ }
+
+ return $contents;
+ }
+}
diff --git a/app/Actions/Service/DeleteService.php b/app/Actions/Service/DeleteService.php
index a5f99bf391..6c843e57de 100644
--- a/app/Actions/Service/DeleteService.php
+++ b/app/Actions/Service/DeleteService.php
@@ -51,14 +51,16 @@ class DeleteService
throw new RuntimeException('Server is not functional.');
}
- $this->removeContainers($service, $resource->id);
+ $this->removeContainers($service, $resource);
}
- private function removeContainers(Service $service, ?int $subresourceId = null): void
+ private function removeContainers(Service $service, ServiceApplication|ServiceDatabase|null $subresource = null): void
{
$filters = "--filter 'label=coolify.serviceId={$service->id}'";
- if ($subresourceId !== null) {
- $filters .= " --filter 'label=coolify.service.subId={$subresourceId}'";
+ if ($subresource !== null) {
+ // Applications and databases are separate tables, so an id alone can match the other type.
+ $subType = $subresource instanceof ServiceDatabase ? 'database' : 'application';
+ $filters .= " --filter 'label=coolify.service.subId={$subresource->id}' --filter 'label=coolify.service.subType={$subType}'";
}
$command = "container_ids=\$(docker ps -aq {$filters}); [ -z \"\$container_ids\" ] || docker rm -f \$container_ids";
diff --git a/app/Console/Commands/Init.php b/app/Console/Commands/Init.php
index da379be23c..4f3a808df1 100644
--- a/app/Console/Commands/Init.php
+++ b/app/Console/Commands/Init.php
@@ -15,6 +15,7 @@ use App\Models\ScheduledTaskExecution;
use App\Models\Server;
use App\Models\StandalonePostgresql;
use App\Models\User;
+use App\Support\ResourceStartActivity;
use Carbon\Carbon;
use Illuminate\Console\Command;
use Illuminate\Support\Facades\Artisan;
@@ -105,6 +106,16 @@ class Init extends Command
echo "Could not cleanup inprogress deployments: {$e->getMessage()}\n";
}
+ try {
+ $interruptedStartCount = ResourceStartActivity::failInterrupted();
+
+ if ($interruptedStartCount > 0) {
+ echo "Marked {$interruptedStartCount} interrupted database/service starts as failed\n";
+ }
+ } catch (\Throwable $e) {
+ echo "Could not cleanup interrupted database/service starts: {$e->getMessage()}\n";
+ }
+
try {
$updatedTaskCount = ScheduledTaskExecution::where('status', 'running')->update([
'status' => 'failed',
diff --git a/app/Enums/ManagedDnsDeletionResult.php b/app/Enums/ManagedDnsDeletionResult.php
new file mode 100644
index 0000000000..a5b6311fd6
--- /dev/null
+++ b/app/Enums/ManagedDnsDeletionResult.php
@@ -0,0 +1,26 @@
+hasTooManyManualWebhookFailures($request, 'bitbucket')) {
+ return $this->tooManyManualWebhookFailuresResponse($request, 'bitbucket');
+ }
+
try {
$return_payloads = collect([]);
$payload = $request->collect();
@@ -74,7 +78,7 @@ class Bitbucket extends Controller
}
$applications = $this->manualWebhookApplications(Application::query()->where('git_branch', $branch), $full_name);
if ($applications->isEmpty()) {
- return response([$this->unauthenticatedManualWebhookFailurePayload()]);
+ return $this->unauthenticatedManualWebhookResponse($request, 'bitbucket');
}
foreach ($applications as $application) {
$webhook_secret = data_get($application, 'manual_webhook_secret_bitbucket');
@@ -275,7 +279,7 @@ class Bitbucket extends Controller
}
}
- return $this->manualWebhookResponse($return_payloads);
+ return $this->manualWebhookResponse($return_payloads, $request, 'bitbucket');
} catch (Exception $e) {
return handleError($e);
}
diff --git a/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php b/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php
index 7aa2d6b48d..080b4a1725 100644
--- a/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php
+++ b/app/Http/Controllers/Webhook/Concerns/MatchesManualWebhookApplications.php
@@ -4,11 +4,14 @@ namespace App\Http\Controllers\Webhook\Concerns;
use App\Models\Application;
use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\Request;
use Illuminate\Http\Response;
use Illuminate\Support\Collection;
trait MatchesManualWebhookApplications
{
+ use ThrottlesManualWebhookFailures;
+
protected function manualWebhookRepositoryFullName(mixed $fullName): ?string
{
if (! is_string($fullName)) {
@@ -62,12 +65,23 @@ trait MatchesManualWebhookApplications
];
}
- protected function manualWebhookResponse(Collection $payloads): Response
+ /**
+ * Respond to a delivery that could not be authenticated (no matching
+ * application or no signature) and count it as a failed attempt.
+ */
+ protected function unauthenticatedManualWebhookResponse(Request $request, string $provider): Response
+ {
+ $this->recordManualWebhookFailure($request, $provider);
+
+ return response([$this->unauthenticatedManualWebhookFailurePayload()]);
+ }
+
+ protected function manualWebhookResponse(Collection $payloads, Request $request, string $provider): Response
{
$failure = $this->unauthenticatedManualWebhookFailurePayload();
$authorizedPayloads = $payloads->reject(fn (array $payload): bool => $payload === $failure)->values();
if ($authorizedPayloads->isEmpty() && $payloads->isNotEmpty()) {
- return response([$failure]);
+ return $this->unauthenticatedManualWebhookResponse($request, $provider);
}
return response($authorizedPayloads);
diff --git a/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php b/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php
new file mode 100644
index 0000000000..fe2832eb1a
--- /dev/null
+++ b/app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php
@@ -0,0 +1,46 @@
+manualWebhookFailureRateLimitKey($request, $provider), self::MANUAL_WEBHOOK_MAX_FAILURES);
+ }
+
+ protected function tooManyManualWebhookFailuresResponse(Request $request, string $provider): Response
+ {
+ $retryAfter = RateLimiter::availableIn($this->manualWebhookFailureRateLimitKey($request, $provider));
+
+ return response([
+ 'status' => 'failed',
+ 'message' => 'Too many failed webhook authentication attempts. Try again later.',
+ ], 429)->header('Retry-After', (string) max($retryAfter, 1));
+ }
+
+ protected function recordManualWebhookFailure(Request $request, string $provider): void
+ {
+ RateLimiter::hit($this->manualWebhookFailureRateLimitKey($request, $provider), self::MANUAL_WEBHOOK_FAILURE_DECAY_SECONDS);
+ }
+}
diff --git a/app/Http/Controllers/Webhook/Gitea.php b/app/Http/Controllers/Webhook/Gitea.php
index 97051d5beb..975e990973 100644
--- a/app/Http/Controllers/Webhook/Gitea.php
+++ b/app/Http/Controllers/Webhook/Gitea.php
@@ -21,6 +21,10 @@ class Gitea extends Controller
public function manual(Request $request)
{
+ if ($this->hasTooManyManualWebhookFailures($request, 'gitea')) {
+ return $this->tooManyManualWebhookFailuresResponse($request, 'gitea');
+ }
+
try {
$return_payloads = collect([]);
$x_gitea_delivery = request()->header('X-Gitea-Delivery');
@@ -69,13 +73,13 @@ class Gitea extends Controller
if ($x_gitea_event === 'push') {
$applications = $this->manualWebhookApplications($applications->where('git_branch', $branch), $full_name);
if ($applications->isEmpty()) {
- return response([$this->unauthenticatedManualWebhookFailurePayload()]);
+ return $this->unauthenticatedManualWebhookResponse($request, 'gitea');
}
}
if ($x_gitea_event === 'pull_request') {
$applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
if ($applications->isEmpty()) {
- return response([$this->unauthenticatedManualWebhookFailurePayload()]);
+ return $this->unauthenticatedManualWebhookResponse($request, 'gitea');
}
}
foreach ($applications as $application) {
@@ -281,7 +285,7 @@ class Gitea extends Controller
}
}
- return $this->manualWebhookResponse($return_payloads);
+ return $this->manualWebhookResponse($return_payloads, $request, 'gitea');
} catch (Exception $e) {
return handleError($e);
}
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index 3272b27983..e00c9cf4a4 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -25,6 +25,10 @@ class Github extends Controller
public function manual(Request $request)
{
+ if ($this->hasTooManyManualWebhookFailures($request, 'github')) {
+ return $this->tooManyManualWebhookFailuresResponse($request, 'github');
+ }
+
try {
$return_payloads = collect([]);
$x_github_delivery = request()->header('X-GitHub-Delivery');
@@ -79,7 +83,7 @@ class Github extends Controller
if ($x_github_event === 'push') {
$applications = $this->manualWebhookApplications($applications->where('git_branch', $branch), $full_name);
if ($applications->isEmpty()) {
- return response([$this->unauthenticatedManualWebhookFailurePayload()]);
+ return $this->unauthenticatedManualWebhookResponse($request, 'github');
}
}
if ($x_github_event === 'pull_request') {
@@ -88,7 +92,7 @@ class Github extends Controller
}
$applications = $this->manualWebhookApplications($applications, $full_name);
if ($applications->isEmpty()) {
- return response([$this->unauthenticatedManualWebhookFailurePayload()]);
+ return $this->unauthenticatedManualWebhookResponse($request, 'github');
}
}
$applicationsByServer = $applications->groupBy(function ($app) {
@@ -239,7 +243,7 @@ class Github extends Controller
}
}
- return $this->manualWebhookResponse($return_payloads);
+ return $this->manualWebhookResponse($return_payloads, $request, 'github');
} catch (Exception $e) {
return handleError($e);
}
diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index 8ac1cab18a..e95a98b230 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -336,6 +336,10 @@ class Gitlab extends Controller
public function manual(Request $request)
{
+ if ($this->hasTooManyManualWebhookFailures($request, 'gitlab')) {
+ return $this->tooManyManualWebhookFailuresResponse($request, 'gitlab');
+ }
+
try {
$return_payloads = collect([]);
$payload = $request->collect();
@@ -356,12 +360,8 @@ class Gitlab extends Controller
auditLogWebhookFailure('gitlab', 'webhook_token_missing', [
'event' => $x_gitlab_event,
]);
- $return_payloads->push([
- 'status' => 'failed',
- 'message' => 'Invalid signature.',
- ]);
- return response($return_payloads);
+ return $this->unauthenticatedManualWebhookResponse($request, 'gitlab');
}
if ($x_gitlab_event === 'push') {
@@ -416,17 +416,13 @@ class Gitlab extends Controller
if ($x_gitlab_event === 'push') {
$applications = $this->manualWebhookApplications($applications->where('git_branch', $branch), $full_name);
if ($applications->isEmpty()) {
- $return_payloads->push($this->unauthenticatedManualWebhookFailurePayload());
-
- return response($return_payloads);
+ return $this->unauthenticatedManualWebhookResponse($request, 'gitlab');
}
}
if ($x_gitlab_event === 'merge_request') {
$applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
if ($applications->isEmpty()) {
- $return_payloads->push($this->unauthenticatedManualWebhookFailurePayload());
-
- return response($return_payloads);
+ return $this->unauthenticatedManualWebhookResponse($request, 'gitlab');
}
}
foreach ($applications as $application) {
@@ -635,7 +631,7 @@ class Gitlab extends Controller
}
}
- return $this->manualWebhookResponse($return_payloads);
+ return $this->manualWebhookResponse($return_payloads, $request, 'gitlab');
} catch (Exception $e) {
return handleError($e);
}
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index fb70c9c9cc..5484147409 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -758,8 +758,6 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
return;
}
- $this->validateComposeBuildPaths($composeFile);
-
// Add build secrets to compose file if enabled and BuildKit is supported
if ($this->dockerSecretsSupported && ! empty($this->build_secrets)) {
$composeFile = $this->add_build_secrets_to_compose($composeFile);
@@ -4915,7 +4913,13 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
}
$dockerfilePath = $this->resolveComposeDockerfilePath($service['build']);
- $fullDockerfilePath = escapeshellarg("{$this->workdir}/{$dockerfilePath}");
+ if ($dockerfilePath === null) {
+ $this->application_deployment_queue->addLogEntry("The build context of service {$serviceName} is remote or uses variables, skipping ARG injection.");
+
+ continue;
+ }
+ // Compose resolves relative paths from the project directory (the workdir).
+ $fullDockerfilePath = escapeshellarg(str_starts_with($dockerfilePath, '/') ? $dockerfilePath : "{$this->workdir}/{$dockerfilePath}");
// BusyBox realpath in the helper image accepts no options; a missing file prints nothing.
$this->execute_remote_command([
@@ -4924,8 +4928,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
'save' => 'dockerfile_check_'.$serviceName,
]);
+ // A monorepo context may leave the base directory, but never the cloned repository.
$resolvedDockerfilePath = str($this->saved_outputs->get('dockerfile_check_'.$serviceName))->trim()->toString();
- if (! str_starts_with($resolvedDockerfilePath, "{$this->workdir}/")) {
+ if (! str_starts_with($resolvedDockerfilePath, "{$this->basedir}/")) {
$this->application_deployment_queue->addLogEntry("Dockerfile not found for service {$serviceName} at {$dockerfilePath}, skipping ARG injection.");
continue;
@@ -5042,60 +5047,29 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
}
}
- private function validateComposeBuildPaths(array|Collection $composeFile): void
- {
- foreach (data_get($composeFile, 'services', []) as $service) {
- if (isset($service['build'])) {
- $this->resolveComposeDockerfilePath($service['build']);
- }
- }
- }
-
- private function resolveComposeDockerfilePath(mixed $build): string
+ /**
+ * Returns the Dockerfile path of a Compose build as written (relative to the project directory,
+ * or absolute), or null when Coolify cannot inspect it locally: a remote git context, a path that
+ * Compose fills in from variables, or an inline Dockerfile. The path is untrusted: the caller
+ * quotes it and only uses the resolved file when it is inside the cloned repository.
+ */
+ private function resolveComposeDockerfilePath(mixed $build): ?string
{
if (! is_string($build) && ! is_array($build)) {
- throw new \RuntimeException('Invalid Docker Compose build definition.');
+ return null;
}
$context = is_string($build) ? $build : data_get($build, 'context', '.');
$dockerfile = is_array($build) ? data_get($build, 'dockerfile', 'Dockerfile') : 'Dockerfile';
- if (! is_string($context) || ! is_string($dockerfile)) {
- throw new \RuntimeException('Invalid Docker Compose build path: context and dockerfile must be strings.');
+ if (! is_string($context) || ! is_string($dockerfile) || $context === '' || (is_array($build) && array_key_exists('dockerfile_inline', $build))) {
+ return null;
+ }
+ if (str_contains($context.$dockerfile, '$') || preg_match('~^[a-z][a-z0-9+.-]*://|^git@~i', $context) === 1) {
+ return null;
}
- $this->validateComposeBuildPath($context, 'context');
- $this->validateComposeBuildPath($dockerfile, 'dockerfile');
-
- return $this->normalizeComposeBuildPath("{$context}/{$dockerfile}", 'dockerfile');
- }
-
- private function validateComposeBuildPath(string $path, string $fieldName): void
- {
- if ($path === '' || str_starts_with($path, '/') || ! preg_match('/^[a-zA-Z0-9._\-\/@+]+$/', $path)) {
- throw new \RuntimeException("Invalid Docker Compose build.{$fieldName} path.");
- }
- }
-
- private function normalizeComposeBuildPath(string $path, string $fieldName): string
- {
- $segments = [];
- foreach (explode('/', $path) as $segment) {
- if ($segment === '' || $segment === '.') {
- continue;
- }
- if ($segment === '..') {
- if ($segments === []) {
- throw new \RuntimeException("Invalid Docker Compose build.{$fieldName} path: path traversal outside the repository.");
- }
- array_pop($segments);
-
- continue;
- }
- $segments[] = $segment;
- }
-
- return $segments === [] ? '.' : implode('/', $segments);
+ return str_starts_with($dockerfile, '/') ? $dockerfile : rtrim($context, '/').'/'.$dockerfile;
}
private function add_build_secrets_to_compose($composeFile)
diff --git a/app/Jobs/DatabaseStartJob.php b/app/Jobs/DatabaseStartJob.php
index e21ee38c61..e520c79dfe 100644
--- a/app/Jobs/DatabaseStartJob.php
+++ b/app/Jobs/DatabaseStartJob.php
@@ -12,6 +12,7 @@ use App\Actions\Database\StartPostgresql;
use App\Actions\Database\StartRedis;
use App\Enums\ProcessStatus;
use App\Events\DatabaseStatusChanged;
+use App\Exceptions\DatabaseStartException;
use App\Models\StandaloneClickhouse;
use App\Models\StandaloneDragonfly;
use App\Models\StandaloneKeydb;
@@ -20,6 +21,7 @@ use App\Models\StandaloneMongodb;
use App\Models\StandaloneMysql;
use App\Models\StandalonePostgresql;
use App\Models\StandaloneRedis;
+use App\Support\ResourceStartActivity;
use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldBeEncrypted;
use Illuminate\Contracts\Queue\ShouldQueue;
@@ -53,7 +55,7 @@ class DatabaseStartJob implements ShouldBeEncrypted, ShouldQueue
abort_unless((int) $database->team()->id === $this->teamId, 403);
$activity = Activity::query()->findOrFail($this->activityId);
- match ($database->getMorphClass()) {
+ $result = match ($database->getMorphClass()) {
StandalonePostgresql::class => StartPostgresql::run($database, $activity),
StandaloneRedis::class => StartRedis::run($database, $activity),
StandaloneMongodb::class => StartMongodb::run($database, $activity),
@@ -64,6 +66,10 @@ class DatabaseStartJob implements ShouldBeEncrypted, ShouldQueue
StandaloneClickhouse::class => StartClickhouse::run($database, $activity),
};
+ if (! $result instanceof Activity || data_get($result, 'properties.status') !== ProcessStatus::FINISHED->value) {
+ throw DatabaseStartException::startCommandsDidNotRun();
+ }
+
event(new DatabaseStatusChanged($this->userId));
}
@@ -75,12 +81,10 @@ class DatabaseStartJob implements ShouldBeEncrypted, ShouldQueue
return;
}
- $activity->properties = $activity->properties->merge([
- 'status' => ProcessStatus::ERROR->value,
- 'error' => 'Database start failed.',
- 'failed_at' => now()->toIso8601String(),
- ]);
- $activity->save();
+ ResourceStartActivity::markFailed(
+ $activity,
+ $exception instanceof DatabaseStartException ? $exception->getMessage() : 'Database start failed.',
+ );
} finally {
event(new DatabaseStatusChanged($this->userId));
}
diff --git a/app/Jobs/ReleaseManagedDnsRecordsJob.php b/app/Jobs/ReleaseManagedDnsRecordsJob.php
new file mode 100644
index 0000000000..6519da83af
--- /dev/null
+++ b/app/Jobs/ReleaseManagedDnsRecordsJob.php
@@ -0,0 +1,46 @@
+releaseResource($this->resourceType, $this->resourceId)) {
+ return;
+ }
+
+ if ($this->attempts() < self::MAX_ATTEMPTS) {
+ $this->release(60 * $this->attempts());
+
+ return;
+ }
+
+ Log::warning('Managed DNS records of a deleted resource could not be cleaned up; they were left in place.', [
+ 'resource_type' => $this->resourceType,
+ 'resource_id' => $this->resourceId,
+ ]);
+ }
+}
diff --git a/app/Livewire/Concerns/InteractsWithDnsProviders.php b/app/Livewire/Concerns/InteractsWithDnsProviders.php
index 2f7e86c7ff..da47073011 100644
--- a/app/Livewire/Concerns/InteractsWithDnsProviders.php
+++ b/app/Livewire/Concerns/InteractsWithDnsProviders.php
@@ -2,11 +2,13 @@
namespace App\Livewire\Concerns;
+use App\Enums\ManagedDnsDeletionResult;
use App\Exceptions\DnsRecordConflictException;
use App\Jobs\ConfigureDnsRecordJob;
use App\Models\DnsProviderZone;
use App\Models\ManagedDnsRecord;
use App\Services\Dns\CloudflareDnsProvider;
+use App\Services\Dns\ManagedDnsRecordCleanup;
use Illuminate\Database\Eloquent\Model;
trait InteractsWithDnsProviders
@@ -48,7 +50,8 @@ trait InteractsWithDnsProviders
return;
}
try {
- $cloudflare->createRecord($zone, $hostname, $content, $this->dnsResourceForHostname($hostname));
+ $record = $cloudflare->createRecord($zone, $hostname, $content, $this->dnsResourceForHostname($hostname));
+ $this->referenceDnsRecordFromAllResources($record, $hostname);
$this->markDnsManaged($hostname, $zone->integrationToken->name);
$this->dispatch('success', "DNS record created for {$hostname}.");
$this->loadDnsProviderProposals();
@@ -146,7 +149,7 @@ trait InteractsWithDnsProviders
return;
}
try {
- app(CloudflareDnsProvider::class)->replaceRecord(
+ $record = app(CloudflareDnsProvider::class)->replaceRecord(
$zone,
(string) ($conflict['record_id'] ?? ''),
$hostname,
@@ -154,6 +157,7 @@ trait InteractsWithDnsProviders
$this->dnsResourceForHostname($hostname),
(string) ($conflict['current'] ?? ''),
);
+ $this->referenceDnsRecordFromAllResources($record, $hostname);
unset($this->dnsProviderConflicts[$key]);
$this->dispatch('success', "DNS record replaced for {$hostname}.");
$this->loadDnsProviderProposals();
@@ -220,36 +224,46 @@ trait InteractsWithDnsProviders
$this->dispatch('error', "DNS record could not be added for {$event['hostname']}: {$event['message']}");
}
- protected function deleteManagedDnsForUrl(string $url): void
+ /**
+ * Releases the resource's reference to the managed DNS record of a removed URL. The provider record is deleted only when
+ * $deleteRecord is set, Coolify created it, and no other resource or URL (in any team) still uses the hostname.
+ */
+ protected function releaseManagedDnsForUrl(string $url, ?Model $resource = null, bool $deleteRecord = true): void
{
$hostname = parse_url($url, PHP_URL_HOST);
if (! is_string($hostname)) {
return;
}
- $resource = $this->dnsResourceForHostname($hostname);
+ $resource ??= $this->dnsResourceForHostname($hostname);
if ($resource === null) {
return;
}
- $record = ManagedDnsRecord::query()
- ->where('team_id', currentTeam()->id)
- ->where('name', strtolower($hostname))
- ->where('resource_type', $resource->getMorphClass())
- ->where('resource_id', $resource->getKey())
- ->first();
+ $result = app(ManagedDnsRecordCleanup::class)->releaseHostname($resource, $hostname, currentTeam()->id, $deleteRecord);
- if ($record !== null && ! app(CloudflareDnsProvider::class)->deleteRecord($record)) {
- auditLog('ui.dns_record.delete_skipped', [
- 'team_id' => currentTeam()->id,
- 'hostname' => $hostname,
- 'provider' => 'cloudflare',
- 'reason' => 'remote_record_changed',
- ], 'warning');
+ if ($result === ManagedDnsDeletionResult::ChangedExternally) {
$this->dispatch('warning', 'The domain was removed, but its DNS record changed externally and was left untouched.');
+ } elseif ($result === ManagedDnsDeletionResult::Failed) {
+ $this->dispatch('warning', 'The domain was removed, but its DNS record could not be deleted because Cloudflare did not respond. It was left untouched.');
}
}
+ /**
+ * Service domains can share a hostname across several service applications; each of them references the record.
+ */
+ protected function referenceDnsRecordFromAllResources(ManagedDnsRecord $record, string $hostname): void
+ {
+ if (property_exists($this, 'application') || ! property_exists($this, 'service') || $this->service === null) {
+ return;
+ }
+
+ $cleanup = app(ManagedDnsRecordCleanup::class);
+ $this->service->applications()->get()
+ ->filter(fn (Model $application): bool => in_array(strtolower($hostname), $cleanup->hostnamesOf($application), true))
+ ->each(fn (Model $application) => $record->addReference($application));
+ }
+
protected function authorizeDnsProviderChange(): void
{
$this->authorize('update', property_exists($this, 'application') ? $this->application : $this->service);
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 929c02e93e..246d0c113a 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -211,7 +211,7 @@ class Domains extends Component
match ($status) {
'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
- 'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+ 'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record. If you changed it recently, DNS propagation can take some time, so please try again later."),
default => $this->dispatch('info', "DNS check skipped for {$host}."),
};
}
@@ -1601,9 +1601,7 @@ class Domains extends Component
return;
}
- if (in_array('deleteManagedDns', $selectedActions, true)) {
- $this->deleteManagedDnsForUrl($url);
- }
+ $this->releaseManagedDnsForUrl($url, $this->application, in_array('deleteManagedDns', $selectedActions, true));
if ($this->editingIndex === $index) {
$this->cancelEdit();
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index 5f454d91ba..9a34d9f10c 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -391,7 +391,7 @@ class PreviewDomains extends Component
match ($status) {
'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
- 'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+ 'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record. If you changed it recently, DNS propagation can take some time, so please try again later."),
default => $this->dispatch('info', "DNS check skipped for {$host}."),
};
}
diff --git a/app/Livewire/Project/Database/Heading.php b/app/Livewire/Project/Database/Heading.php
index 9a7a8634aa..030da438ac 100644
--- a/app/Livewire/Project/Database/Heading.php
+++ b/app/Livewire/Project/Database/Heading.php
@@ -6,11 +6,10 @@ use App\Actions\Database\RestartDatabase;
use App\Actions\Database\StartDatabase;
use App\Actions\Database\StopDatabase;
use App\Actions\Docker\GetContainersStatus;
-use App\Enums\ProcessStatus;
use App\Events\ServiceStatusChanged;
+use App\Support\ResourceStartActivity;
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Livewire\Component;
-use Spatie\Activitylog\Models\Activity;
class Heading extends Component
{
@@ -79,15 +78,9 @@ class Heading extends Component
public function checkDeployments()
{
try {
- $activity = Activity::where('properties->type_uuid', $this->database->uuid)->latest()->first();
- $status = data_get($activity, 'properties.status');
- if ($status === ProcessStatus::QUEUED->value || $status === ProcessStatus::IN_PROGRESS->value) {
- $this->isDeploymentProgress = true;
- $this->runningActivityId = $activity->id;
- } else {
- $this->isDeploymentProgress = false;
- $this->runningActivityId = null;
- }
+ $activity = ResourceStartActivity::latestRunning($this->database->uuid);
+ $this->isDeploymentProgress = $activity !== null;
+ $this->runningActivityId = $activity?->id;
} catch (\Throwable) {
$this->isDeploymentProgress = false;
$this->runningActivityId = null;
@@ -157,6 +150,11 @@ class Heading extends Component
$this->authorize('manage', $this->database);
$activity = RestartDatabase::run($this->database);
+ if (is_string($activity)) {
+ $this->dispatch('error', $activity);
+
+ return;
+ }
$this->auditDatabaseAction('ui.database.restarted');
$this->markDeploymentRunning($activity);
$this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
@@ -172,6 +170,11 @@ class Heading extends Component
$this->authorize('manage', $this->database);
$activity = StartDatabase::run($this->database);
+ if (is_string($activity)) {
+ $this->dispatch('error', $activity);
+
+ return;
+ }
$this->auditDatabaseAction('ui.database.started');
$this->markDeploymentRunning($activity);
$this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index 79c89322a7..92affb9a7d 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -192,7 +192,7 @@ class Domains extends Component
match ($status) {
'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
- 'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+ 'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record. If you changed it recently, DNS propagation can take some time, so please try again later."),
default => $this->dispatch('info', "DNS check skipped for {$host}."),
};
}
@@ -1357,9 +1357,7 @@ class Domains extends Component
return;
}
- if (in_array('deleteManagedDns', $selectedActions, true)) {
- $this->deleteManagedDnsForUrl($url);
- }
+ $this->releaseManagedDnsForUrl($url, $app, in_array('deleteManagedDns', $selectedActions, true));
$this->forceSaveDomains = false;
$this->forceRemovePort = false;
diff --git a/app/Livewire/Project/Service/Heading.php b/app/Livewire/Project/Service/Heading.php
index 33fce9f079..fc6720b218 100644
--- a/app/Livewire/Project/Service/Heading.php
+++ b/app/Livewire/Project/Service/Heading.php
@@ -10,6 +10,7 @@ use App\Enums\ProcessStatus;
use App\Models\Service;
use App\Models\ServiceApplication;
use App\Models\ServiceDatabase;
+use App\Support\ResourceStartActivity;
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Illuminate\Support\Facades\Auth;
use Livewire\Component;
@@ -103,15 +104,9 @@ class Heading extends Component
$this->authorizeService('view');
try {
- $activity = Activity::where('properties->type_uuid', $this->service->uuid)->latest()->first();
- $status = data_get($activity, 'properties.status');
- if ($status === ProcessStatus::QUEUED->value || $status === ProcessStatus::IN_PROGRESS->value) {
- $this->isDeploymentProgress = true;
- $this->runningActivityId = $activity->id;
- } else {
- $this->isDeploymentProgress = false;
- $this->runningActivityId = null;
- }
+ $activity = ResourceStartActivity::latestRunning($this->service->uuid);
+ $this->isDeploymentProgress = $activity !== null;
+ $this->runningActivityId = $activity?->id;
} catch (\Throwable) {
$this->isDeploymentProgress = false;
$this->runningActivityId = null;
diff --git a/app/Livewire/Server/LogDrains.php b/app/Livewire/Server/LogDrains.php
index cdc4162bba..965232af44 100644
--- a/app/Livewire/Server/LogDrains.php
+++ b/app/Livewire/Server/LogDrains.php
@@ -128,7 +128,6 @@ class LogDrains extends Component
$this->syncDataAxiom($toModel);
$this->syncDataCustom($toModel);
}
- $this->auditLogDrain($this->{$enabledProperty} ? 'enabled' : 'disabled', $type);
}
}
@@ -210,6 +209,7 @@ class LogDrains extends Component
}
$this->syncData(true);
+ $this->auditLogDrain($this->{$enabledProperty} ? 'enabled' : 'disabled', $type);
if ($this->server->isLogDrainEnabled()) {
StartLogDrain::run($this->server);
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index a3f9be2db5..5c3624a2b6 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -2,7 +2,9 @@
namespace App\Livewire\Server;
+use App\Actions\Proxy\DeleteTraefikCertificate;
use App\Actions\Proxy\GetProxyConfiguration;
+use App\Actions\Proxy\GetTraefikCertificates;
use App\Actions\Proxy\SaveProxyConfiguration;
use App\Enums\ProxyTypes;
use App\Models\Server;
@@ -26,6 +28,10 @@ class Proxy extends Component
public bool $generateExactLabels = false;
+ public array $traefikCertificates = [];
+
+ public bool $traefikCertificatesLoaded = false;
+
/**
* Cache the versions.json file data in memory for this component instance.
* This avoids multiple file reads during a single request/render cycle.
@@ -195,6 +201,7 @@ class Proxy extends Component
}
}
+<<<<<<< Updated upstream
public function getTraefikVersionForWarningProperty(): ?string
{
if ($this->server->detected_traefik_version) {
@@ -211,6 +218,32 @@ class Proxy extends Component
}
return $matches[1];
+=======
+ public function loadTraefikCertificates(): void
+ {
+ $this->traefikCertificates = [];
+
+ try {
+ $this->authorize('view', $this->server);
+ $this->traefikCertificates = GetTraefikCertificates::run($this->server);
+ $this->traefikCertificatesLoaded = true;
+ } catch (\Throwable $e) {
+ $this->traefikCertificatesLoaded = true;
+ handleError($e, $this);
+ }
+ }
+
+ public function deleteTraefikCertificate(string $certificateId, string $password = ''): void
+ {
+ try {
+ $this->authorize('update', $this->server);
+ DeleteTraefikCertificate::run($this->server, $certificateId);
+ $this->traefikCertificates = GetTraefikCertificates::run($this->server);
+ $this->dispatch('success', 'TLS certificate deleted. Restart Traefik to remove it from the running proxy.');
+ } catch (\Throwable $e) {
+ handleError($e, $this);
+ }
+>>>>>>> Stashed changes
}
/**
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 3ef2b28813..bbc37290b4 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -11,19 +11,20 @@ use App\Services\DeploymentConfiguration\ConfigurationDiffer;
use App\Support\DomainPortOverrides;
use App\Support\DomainUrlParts;
use App\Traits\Auditable;
-
use App\Traits\ClearsGlobalSearchCache;
use App\Traits\HasConfiguration;
use App\Traits\HasMetrics;
use App\Traits\HasNoindexDomains;
use App\Traits\HasSafeStringAttribute;
use App\Traits\HasSecretManager;
+use App\Traits\ReleasesManagedDnsRecords;
use Database\Factories\ApplicationFactory;
use Illuminate\Database\Eloquent\Casts\Attribute;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Relations\HasMany;
use Illuminate\Database\Eloquent\SoftDeletes;
use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Str;
use OpenApi\Attributes as OA;
@@ -128,7 +129,7 @@ use Symfony\Component\Yaml\Yaml;
class Application extends BaseModel
{
/** @use HasFactory| Domain | +Resolver | +Alternative names | +Expires | +Actions | +
|---|---|---|---|---|
| + {{ $certificate['main_domain'] }} + | ++ {{ $certificate['resolver'] }} + @if ($certificate['store']) + + ({{ $certificate['store'] }}) + + @endif + | +
+ @if (count($certificate['sans']) > 0)
+
+ @foreach ($certificate['sans'] as $domain)
+
+ {{ $domain }}
+
+ @endforeach
+
+ @else
+ None
+ @endif
+ |
+ + {{ $certificate['expires_at'] ?? 'Unknown' }} + | +
+ @can('update', $server)
+ |
+